CVE-2025-49656

Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue...

Security Bulletin: Vulnerabilities in path-to-regexp affects IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Potential vulnerability in path-to-regexp has been identified that affects IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component. The vulnerability has been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-52798 DESCRIPTION:...

Security Bulletin: Vulnerabilities in axios affects IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Potential vulnerability in axios has been identified that affects IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component. The vulnerability has been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2025-27152 DESCRIPTION: axios is a...

PT-2025-30325 · Ibm · Ibm Cognos Analytics Mobile

Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics Mobile iOS versions 1.1.0 through 1.1.22 Description: IBM Cognos Analytics Mobile iOS is susceptible to a security issue that may allow malicious actors to obtain sensitive information. This is due to the cleartext...

PT-2025-30336 · Phproxy · Phproxy

Name of the Vulnerable Software and Affected Versions: PHProxy versions prior to 1.1.1 Description: A Server-Side Request Forgery SSRF issue exists in the URL processing functionality. Insufficient input validation for the proxurl parameter allows a remote, unauthenticated attacker to submit a...

PT-2025-30244 · WordPress · Shortcodes Ultimate

Name of the Vulnerable Software and Affected Versions: WP Shortcodes Plugin — Shortcodes Ultimate versions prior to 7.4.2 Description: The WordPress Shortcodes Ultimate plugin is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the preview function. This...

PT-2025-30288 · Sk Telecom · Com.Skt.Prod.Dialer

Name of the Vulnerable Software and Affected Versions: com.skt.prod.dialer versions through 12.5.0 Description: The application allows any installed application, without requiring any permissions, to initiate phone calls without user interaction. This is achieved by sending a specially crafted...

PT-2025-30321

Name of the Vulnerable Software and Affected Versions Jakarta Mail version 2.2 Description The software is susceptible to a SMTP Injection issue. This can be triggered by utilizing the carriage return r and newline UTF-8 characters to separate messages. Recommendations At the moment, there is no...

PT-2025-30362

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev90 Description pyLoad contains an authenticated path traversal vulnerability in the /json/upload endpoint. By manipulating the filename of an uploaded file, an attacker can traverse out of the intended uploa...

PT-2025-30341

Name of the Vulnerable Software and Affected Versions Starlette versions 0.47.1 and below Description Starlette is a lightweight ASGI framework/toolkit for building async web services in Python. When parsing multi-part forms with large files exceeding the default maximum spool size, Starlette...

PT-2025-30302 · Unknown · Hmailserver

Name of the Vulnerable Software and Affected Versions: hMailServer versions 5.6.9-beta through 5.8.6 Description: The software uses a hardcoded cryptographic key in the Encryption.cs file. This allows an attacker to decrypt passwords for other servers stored in the hMailAdmin.exe.config file,...

PT-2025-30259 · Unknown · Two App Studio Journey

Name of the Vulnerable Software and Affected Versions: Two App Studio Journey version 5.5.9 Description: The application stores data in an unencrypted format within its database on iOS devices. This allows local attackers to extract sensitive information by directly accessing the application’s...

PT-2025-30343

Name of the Vulnerable Software and Affected Versions Manager-io/Manager versions up to and including 25.7.18.2519 Description Manager-io/Manager is accounting software with a critical unauthenticated Server-Side Request Forgery SSRF vulnerability identified in the proxy handler component. This...

PT-2025-30243 · WordPress · Shortcodes Ultimate

Name of the Vulnerable Software and Affected Versions: WP Shortcodes Plugin — Shortcodes Ultimate versions prior to 7.4.3 Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s shortcodes. Insufficient...

PT-2025-30228 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: WordPress versions 3.5 through 6.8.2 Description: WordPress versions 3.5 through 6.8.2 are susceptible to a flaw that allows remote attackers to determine the titles of private and draft posts through pingback.ping XML-RPC requests...

PT-2025-30269 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 21.0 MR1 21.0.1 Description: A post-authentication SQL injection vulnerability exists in the WebAdmin component. Successful exploitation can potentially allow administrators to achieve arbitrary code executio...

PT-2025-30291 · Unknown +1 · Strongswan +1

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-WLC100P version 2.03b03 Description: The i dont care about security and use aggressive mode psk option is enabled in the strongSwan configuration file, allowing IKE Responders to use IKEv1 Aggressive Mode with Pre-Shared Keys. Th...

PT-2025-30271 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 21.0 MR2 21.0.2 Description: An arbitrary file writing vulnerability exists in the Secure PDF eXchange SPX feature. This can lead to pre-authentication remote code execution when SPX is enabled with a specifi...

PT-2025-30345 · Unknown · Haxcms-Nodejs

Name of the Vulnerable Software and Affected Versions: HAX CMS NodeJs versions 11.0.7 and below Description: HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. The NodeJS version of HAX CMS has a disabled Content Security Policy CSP in versions 11.0.7 and below...

PT-2025-30344 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAXcms versions prior to 11.0.7 Description: HAXcms with a nodejs backend allows users to start the server in any HAXsite or HAXcms instance. The NodeJS version of HAXcms, in versions 11.0.6 and below, uses an insecure default configuration...