PT-2025-30640 · WordPress · The Security Ninja – Wordpress Security Plugin & Firewall

Name of the Vulnerable Software and Affected Versions: The Security Ninja – WordPress Security Plugin & Firewall versions prior to 5.243 Description: The Security Ninja – WordPress Security Plugin & Firewall plugin for WordPress is susceptible to an arbitrary file read issue. This allows...

PT-2025-30660 · WordPress · Get Youtube Subs

Name of the Vulnerable Software and Affected Versions: Get Youtube Subs plugin for WordPress versions up to and including 3.5 Description: The Get Youtube Subs plugin for WordPress is susceptible to Stored Cross-Site Scripting through the channel, layout, and subs count parameters. Insufficient...

PT-2025-30630 · Medtronic · Mycarelink Patient Monitor

Name of the Vulnerable Software and Affected Versions: Medtronic MyCareLink Patient Monitor models 24950 and 24952 before June 25, 2025 Description: The Medtronic MyCareLink Patient Monitor contains a built-in user account with no password. This allows an attacker with physical access to log in...

PT-2025-30665

Name of the Vulnerable Software and Affected Versions SMG Software Information Portal versions prior to 13.06.2025 Description The software contains an unrestricted file upload and improper neutralization of special elements used in an OS command vulnerability, potentially leading to code injecti...

PT-2025-30648 · WordPress · Wp Applink

Name of the Vulnerable Software and Affected Versions: WP Applink plugin for WordPress versions prior to 0.4.2 Description: The WP Applink plugin for WordPress is susceptible to Stored Cross-Site Scripting through the title parameter. Insufficient input sanitization and output escaping allow...

PT-2025-30657 · WordPress · Wp Wallcreeper

Name of the Vulnerable Software and Affected Versions: WP Wallcreeper plugin for WordPress versions up to and including 1.6.1 Description: The WP Wallcreeper plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check on the admin notices hook. This...

PT-2025-30705 · WordPress · Elementskit Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: ElementsKit Elementor Addons and Templates versions prior to 3.5.3 Description: The ElementsKit Elementor Addons and Templates plugin for WordPress is susceptible to Stored Cross-Site Scripting via the URL attribute of a custom widget due to...

PT-2025-30645 · WordPress · Muse.Ai Video Embedding Plugin

Name of the Vulnerable Software and Affected Versions: muse.ai video embedding plugin for WordPress versions up to and including 0.4 Description: The muse.ai video embedding plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s muse-ai shortcode. Insufficient inp...

PT-2025-30661 · WordPress · Mine Cloudvod

Name of the Vulnerable Software and Affected Versions: Mine CloudVod plugin for WordPress versions up to and including 2.1.10 Description: The Mine CloudVod plugin for WordPress is susceptible to Stored Cross-Site Scripting XSS through the audio parameter. Insufficient input sanitization and outp...

PT-2025-30652 · WordPress · Funnelcockpit

Name of the Vulnerable Software and Affected Versions: FunnelCockpit plugin for WordPress versions up to and including 1.4.2 Description: The plugin is susceptible to Reflected Cross-Site Scripting via the error parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-30706 · Quiet · Quiet

Name of the Vulnerable Software and Affected Versions: Quiet versions 6.1.0-alpha.4 and below Description: Quiet’s API for backend/frontend communication used an insecure, not constant-time comparison function for token verification. This allowed for a potential timing attack where an attacker...

JVN#39913189: TP-Link Archer C1200 vulnerable to clickjacking

Archer C1200 provided by TP-Link Systems Inc. contains the following vulnerability. Clickjacking CWE-1021 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 5.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Base Score 4.3 CVE-2025-6983 Impact If a user views a malicious pag...

PT-2025-30658 · WordPress · Ithoughts Advanced Code Editor

Name of the Vulnerable Software and Affected Versions: iThoughts Advanced Code Editor plugin for WordPress versions through 1.2.10 Description: The iThoughts Advanced Code Editor plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the...

PT-2025-30667 · Unknown · Moderec Tourtella

Name of the Vulnerable Software and Affected Versions: Moderec Tourtella versions prior to 26.05.2025 Description: A SQL Injection issue exists in Moderec Tourtella due to improper neutralization of special elements used in an SQL command. This allows for the execution of malicious commands...

PT-2025-30628 · Medtronic · Mycarelink Patient Monitor 24952 +1

Name of the Vulnerable Software and Affected Versions: Medtronic MyCareLink Patient Monitor models 24950 and 24952 before June 25, 2025 Description: The Medtronic MyCareLink Patient Monitor contains an internal service that deserializes data. A local attacker can interact with this service by...

PT-2025-30643 · WordPress · Structured Content

Name of the Vulnerable Software and Affected Versions: Structured Content plugin for WordPress versions prior to 1.6.5 Description: The Structured Content plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s sc fs local business shortcode. Insufficient input...

Infinite loop

Overview Magick.NET-Q8-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

CVE-2025-8069

CVE-2025-8069 affects AWS Client VPN Windows client. The installation process reads an OpenSSL configuration file from an unprotected directory (C:\usr\local\windows-x86_64-openssl-localbuild\ssl), allowing a non-admin user to insert malicious config. If an admin starts the installer, that code c...

AZL-65654 CVE-2025-54090 affecting package httpd for versions less than 2.4.65-1

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to signature forgery due to the node-forge package (CVE-2022-24771, CVE-2022-24772 )

Summary Node-forge is used by DataStage on Cloud Pak for Data as part of connection encryption. Vulnerability Details CVEID:CVE-2022-24771 DESCRIPTION: Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signatu...