PT-2025-30652 · WordPress · Funnelcockpit

Name of the Vulnerable Software and Affected Versions: FunnelCockpit plugin for WordPress versions up to and including 1.4.2 Description: The plugin is susceptible to Reflected Cross-Site Scripting via the error parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-30657 · WordPress · Wp Wallcreeper

Name of the Vulnerable Software and Affected Versions: WP Wallcreeper plugin for WordPress versions up to and including 1.6.1 Description: The WP Wallcreeper plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check on the admin notices hook. This...

PT-2025-30648 · WordPress · Wp Applink

Name of the Vulnerable Software and Affected Versions: WP Applink plugin for WordPress versions prior to 0.4.2 Description: The WP Applink plugin for WordPress is susceptible to Stored Cross-Site Scripting through the title parameter. Insufficient input sanitization and output escaping allow...

PT-2025-30645 · WordPress · Muse.Ai Video Embedding Plugin

Name of the Vulnerable Software and Affected Versions: muse.ai video embedding plugin for WordPress versions up to and including 0.4 Description: The muse.ai video embedding plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s muse-ai shortcode. Insufficient inp...

PT-2025-30667 · Unknown · Moderec Tourtella

Name of the Vulnerable Software and Affected Versions: Moderec Tourtella versions prior to 26.05.2025 Description: A SQL Injection issue exists in Moderec Tourtella due to improper neutralization of special elements used in an SQL command. This allows for the execution of malicious commands...

JVN#39913189: TP-Link Archer C1200 vulnerable to clickjacking

Archer C1200 provided by TP-Link Systems Inc. contains the following vulnerability. Clickjacking CWE-1021 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 5.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Base Score 4.3 CVE-2025-6983 Impact If a user views a malicious pag...

PT-2025-30658 · WordPress · Ithoughts Advanced Code Editor

Name of the Vulnerable Software and Affected Versions: iThoughts Advanced Code Editor plugin for WordPress versions through 1.2.10 Description: The iThoughts Advanced Code Editor plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the...

PT-2025-30643 · WordPress · Structured Content

Name of the Vulnerable Software and Affected Versions: Structured Content plugin for WordPress versions prior to 1.6.5 Description: The Structured Content plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s sc fs local business shortcode. Insufficient input...

PT-2025-30628 · Medtronic · Mycarelink Patient Monitor 24952 +1

Name of the Vulnerable Software and Affected Versions: Medtronic MyCareLink Patient Monitor models 24950 and 24952 before June 25, 2025 Description: The Medtronic MyCareLink Patient Monitor contains an internal service that deserializes data. A local attacker can interact with this service by...

Infinite loop

Overview Magick.NET-Q8-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

CVE-2025-8069

CVE-2025-8069 affects AWS Client VPN Windows client. The installation process reads an OpenSSL configuration file from an unprotected directory (C:\usr\local\windows-x86_64-openssl-localbuild\ssl), allowing a non-admin user to insert malicious config. If an admin starts the installer, that code c...

AZL-65654 CVE-2025-54090 affecting package httpd for versions less than 2.4.65-1

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to signature forgery due to the node-forge package (CVE-2022-24771, CVE-2022-24772 )

Summary Node-forge is used by DataStage on Cloud Pak for Data as part of connection encryption. Vulnerability Details CVEID:CVE-2022-24771 DESCRIPTION: Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signatu...

CVE-2025-54090

A bug in Apache HTTP Server 2.4.64 causes all "RewriteCond expr ..." tests to incorrectly evaluate as "true" . This flaw can allow attackers to compromise the confidentiality, integrity, and accessibility of protected information by bypassing intended rewrite logic. Remote exploitation is possibl...

Security Bulletin: IBM OpenPages is affected by multiple security vulnerabilities of DB2 Database Server (May 2025)

Summary IBM® Db2® Database Server is shipped as a supporting program of IBM OpenPages. Information about security vulnerabilities affecting IBM Db2 Database Server has been published in multiple security bulletins. Vulnerability Details Refer to the security bulletins listed in the...

PT-2025-30512 · WordPress · Yanewsflash

Name of the Vulnerable Software and Affected Versions: YANewsflash plugin for WordPress versions prior to 1.0.4 Description: The YANewsflash plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the yanewsflash/yanewsflash.php page. This...

PT-2025-30515 · WordPress · Omnishop

Name of the Vulnerable Software and Affected Versions: Omnishop plugin for WordPress versions up to and including 1.0.9 Description: The Omnishop plugin for WordPress is susceptible to unauthenticated registration bypass. The /users/register API endpoint is publicly exposed and unconditionally...

PT-2025-30525 · Bun · Bun

Name of the Vulnerable Software and Affected Versions: bun versions prior to 0.0.12 Description: The package bun is susceptible to Improper Neutralization of Special Elements used in an OS Command OS Command Injection within the $shell API. This issue stems from inadequate neutralization of...

PT-2025-30530 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: A flaw exists in Samsung Electronics MagicINFO 9 Server that allows code injection through the unrestricted upload of files with dangerous types. Recommendations: Update MagicINFO 9...

PT-2025-30566 · Dj-Flyer · Dj-Flyer

Name of the Vulnerable Software and Affected Versions: DJ-Flyer versions 1.0 through 3.2 Description: A SQL injection issue exists in the DJ-Flyer component. The vulnerability allows privileged users to execute arbitrary SQL commands. Recommendations: Update DJ-Flyer to a version later than 3.2...