PT-2025-38141

Name of the Vulnerable Software and Affected Versions Dokuzsoft Technology E-Commerce Web Design Product versions prior to 11.08.2025 Description The software contains an Improper Neutralization of Input During Web Page Generation vulnerability, which allows for Cross-site Scripting XSS through...

Apache Camel 4.8.0 < 4.8.6 / 4.10.0 < 4.10.3 – Camel-Undertow Bypass/Injection Vulnerability (CVE-2025-30177)

This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6. It is, therefore, affected by a message header injection vulnerability: - Bypass/Injection vulnerability in Apache Camel components under particular conditions. In particular the custom header filter strategy use...

Django: Multiple Vulnerabilities

Background Django is a Python-based web framework. Description Multiple vulnerabilities have been discovered in Django. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workaround at this...

PT-2025-38272

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description A peer can obtain a valid TLS certificate for arbitrary IP addresses, rendering the mTLS authentication ineffective. The Manager’s Certificate gRPC service does not validate if the requested IP...

PT-2025-38153

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.527 and earlier Jenkins LTS versions 2.516.2 and earlier Description: Jenkins does not restrict or transform characters inserted from user-specified content in log messages. This allows attackers who can control log message...

CVE-2025-59334

Linkr (versions up to 2.0.0) does not verify the integrity or authenticity of .linkr manifest files, allowing an attacker to tamper a manifest and inject arbitrary file entries, potentially enabling remote code execution if a downloaded file is executed. Version 2.0.1 adds a manifest integrity ch...

PT-2025-38075

Name of the Vulnerable Software and Affected Versions: Ilevia EVE X1 Server versions prior to 4.7.18.0.eden Description: Ilevia EVE X1 Server versions prior to 4.7.18.0.eden contain a pre-authentication file disclosure issue via the db log POST parameter. Remote attackers can retrieve arbitrary...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses crypto/x509 which is vulnerable to this CVE-2025-22874

Summary Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses crypto/x509 which is vulnerable to this CVE-2025-22874 Vulnerability Details CVEID:CVE-2025-22874 DESCRIPTION: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally...

BIT-NIFI-2023-34212 Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location...

CVE-2025-58065 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface...

Debian dla-4298 : cups - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4298 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4298-1 [email protected]...

Incorrect Conversion between Numeric Types

Overview Affected versions of this package are vulnerable to Incorrect Conversion between Numeric Types via the TTL function, which casts the 64-bit etcd lease ID to a uint32 and uses it as the TTL. An attacker can cause prolonged caching of DNS records and disrupt DNS resolution by supplying lar...

CVE-2025-58180 OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename...

CVE-2025-10183 XML External Entity Injection in TecConnect 4.1

A blind XML External Entity XXE injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of December 2023. Users are advised to upgrade to TecCo...

KB5065767: Servicing stack update for Windows Server 2012 R2: September 9, 2025

None None...

PT-2025-36738

Name of the Vulnerable Software and Affected Versions: TecCom TecConnect version 4.1 Description: The OpenMessaging webservice in TecCom TecConnect version 4.1 contains a blind XML External Entity XXE injection. This allows an unauthenticated attacker to exfiltrate arbitrary files to an...

PT-2025-36573

Name of the Vulnerable Software and Affected Versions: Wilmer Core plugin for WordPress versions up to and including 2.4.5 Description: The Wilmer Core plugin for WordPress is susceptible to Stored Cross-Site Scripting through shortcodes due to inadequate input sanitization and output escaping of...

Linux Distros Unpatched Vulnerability : CVE-2025-9649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in appneta tcpreplay 4.5.1. Impacted is the function calcsleeptime of the file sendpackets.c. Such manipulation leads...

PT-2025-35554

Name of the Vulnerable Software and Affected Versions: E3 Site Supervisor Control versions prior to 2.31F01 Description: The RCI service in E3 Site Supervisor Control contains an API call that allows reading user information, including all usernames and password hashes for application services...

PT-2025-38557

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.17.0-rc2-virtme-g2a89cb21162c through 6.17.0-rc2-virtmne-g6ee90cb26014 Description A null pointer dereference NPD issue was identified in the vxlan module when using nexthop objects with the "proxy" option enabled. This...