PT-2025-31000 · Yanyutao0402 · Chancms

Name of the Vulnerable Software and Affected Versions: yanyutao0402 ChanCMS versions through 3.1.2 Description: A vulnerability exists in yanyutao0402 ChanCMS that may lead to information disclosure. The issue is related to the manipulation of the accessKey/secretKey arguments within an unknown...

[SECURITY] [DLA 4251-1] libxml2 security update

Debian LTS Advisory DLA-4251-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin July 26, 2025 https://wiki.debian.org/LTS Package : libxml2 Version : 2.9.10+dfsg-6.7+deb11u8 CVE ID : CVE-2024-34459 CVE-2025-6021 CVE-2025-6170 CVE-2025-49794 CVE-2025-49796 Debian Bug...

CVE-2025-8176

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function gethistogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the publi...

CVE-2025-8177 LibTIFF thumbnail.c setrow buffer overflow

A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It...

PT-2025-30951 · Anubis · Anubis

Name of the Vulnerable Software and Affected Versions: Anubis versions 1.21.2 and below Description: Anubis is a Web AI Firewall Utility designed to protect upstream resources from scraper bots. Attackers can craft malicious pass-challenge pages that cause a user to execute arbitrary JavaScript...

PT-2025-30947 · WordPress · Geodirectory – Wp Business Directory Plugin +1

Name of the Vulnerable Software and Affected Versions: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress versions prior to 2.8.98 Description: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is...

PT-2025-30968 · WordPress · Kallyas

Name of the Vulnerable Software and Affected Versions: Kallyas versions prior to 4.21.1 Description: The Kallyas theme for WordPress is susceptible to arbitrary folder deletion due to inadequate file path validation within the delete font function. Authenticated attackers possessing...

PT-2025-30969 · WordPress · Kallyas Theme

Name of the Vulnerable Software and Affected Versions: kallyas theme for WordPress versions prior to 4.21.1 Description: The kallyas theme for WordPress is susceptible to Local File Inclusion via the TH LatestPosts4 widget. Authenticated attackers with Contributor-level access or higher can inclu...

PT-2025-30963 · WordPress · Advanced Iframe

Name of the Vulnerable Software and Affected Versions: Advanced iFrame plugin for WordPress versions prior to 2025.5 Description: The Advanced iFrame plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin's advanced iframe shortcode. Insufficient input sanitization...

Security Bulletin: The iconv() function in the GNU C Library affects IBM Data Observability by Databand Self-Hosted (CVE-2024-2961)

Summary The vulnerability regarding iconv function in the GNU C Library versions 2.39 and older was addressed in IBM Data Observability by Databand Self-Hosted. Vulnerability Details CVEID:CVE-2024-2961 DESCRIPTION: The iconv function in the GNU C Library versions 2.39 and older may overflow the...

CVE-2025-8133

ChanCMS up to version 3.1.2 is vulnerable to server-side request forgery in the getArticle function (app/modules/api/service/gather.js) via manipulation of the targetUrl parameter. Remote exploitation is possible and has been disclosed publicly. Upgrading to version 3.1.3 addresses the issue (pat...

CVE-2025-8132 yanyutao0402 ChanCMS utils.js delfile path traversal

A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been rated as critical. Affected by this issue is the function delfile of the file app/extend/utils.js. The manipulation leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public...

CVE-2025-8132

CVE-2025-8132 affects ChanCMS up to version 3.1.2. The vulnerability is a path traversal in the delfile function of app/extend/utils.js, enabling remote exploitation. Public exploit details exist, and upgrading to version 3.1.3 addresses the issue. The recommended patch identifier is c8a282bf02a6...

NewStart CGSL MAIN 7.02 : libvpx Multiple Vulnerabilities (NS-SA-2025-0182)

The remote NewStart CGSL host, running version MAIN 7.02, has libvpx packages installed that are affected by multiple vulnerabilities: - There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpximgalloc with a large value of the dw, dh, or align parameter may result in...

PT-2025-30910 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: OpenCart version 4.1.0.4 Description: OpenCart version 4.1.0.4 is susceptible to a Stored Cross-Site Scripting XSS attack through the blog editor. The issue occurs because input within the blog editor is not adequately sanitized or escaped...

PT-2025-30915 · Grav · Grav

Name of the Vulnerable Software and Affected Versions: grav versions prior to 1.7.49 Description: A Cross Site Scripting vulnerability exists in grav versions prior to 1.7.49. This allows an attacker to execute arbitrary code via a crafted script to the form fields. Recommendations: Update to gra...

PT-2025-30717 · Openai +1 · Openai Codex Cli +1

Name of the Vulnerable Software and Affected Versions: OpenAI Codex CLI versions prior to 0.9.0 Description: The OpenAI Codex CLI application automatically approves the execution of ripgrep rg even when specific flags—--pre, --hostname-bin, --search-zip, or -z—are used. Recommendations: Update to...

PT-2025-30943

Vulnerability Summary Name of the Vulnerable Software and Affected Versions skops versions 0.11.0 and below Description skops is a Python library used for sharing and shipping scikit-learn based models. An inconsistency in the OperatorFuncNode allows exploitation to hide the execution of untruste...

PT-2025-30909 · Unknown · Codeigniter4

Name of the Vulnerable Software and Affected Versions: CodeIgniter4 version 4.6.0 Description: A stored cross-site scripting XSS vulnerability exists in CodeIgniter4. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the debugbar time parameter...

NewStart CGSL MAIN 7.02 : dav1d Vulnerability (NS-SA-2025-0159)

The remote NewStart CGSL host, running version MAIN 7.02, has dav1d packages installed that are affected by a vulnerability: - An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommen...