PT-2025-29568 · Unknown · Beiyuouo Arxiv-Daily

Name of the Vulnerable Software and Affected Versions: beiyuouo arxiv-daily versions through 2025-05-06 commit fad168770b0e68aef3e5acfa16bb2e7a7765d687 Description: A directory traversal vulnerability exists when parsing the topic.yml file in the generation logic within daily arxiv.py...

PT-2025-29573 · Dassault Systèmes · Solidworks Edrawings +1

Name of the Vulnerable Software and Affected Versions: SOLIDWORKS eDrawings versions prior to SOLIDWORKS Desktop 2025 Description: A use of uninitialized variable issue exists in the JT file reading procedure. This could allow an attacker to execute arbitrary code when opening a specially crafted...

PT-2025-29686

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.1.1551 Description Vim, an open-source command-line text editor, contains a path traversal issue within its zip.vim plugin. This issue allows overwriting of arbitrary files when opening specially crafted zip archives...

PT-2025-29541 · Unknown · Crosseditor4

Name of the Vulnerable Software and Affected Versions: CrossEditor4 versions 4.0.0.01 through 4.6.0.23 Description: The improper default setting in the API modules of CrossEditor4 potentially allows Stored Cross-Site Scripting XSS. Stored XSS is a type of security issue where malicious scripts ar...

PT-2025-29550 · Unknown · Diskpulse Enterprise +1

Name of the Vulnerable Software and Affected Versions: Disk Pulse Enterprise version 9.0.34 Description: A stack-based buffer overflow exists in the login functionality. An attacker can send a specially crafted HTTP POST request to the /login endpoint with an overly long username parameter, causi...

PT-2025-29535

Name of the Vulnerable Software and Affected Versions Alone – Charity Multipurpose Non-profit WordPress Theme versions up to and including 7.8.3 Description The Alone – Charity Multipurpose Non-profit WordPress Theme is vulnerable to arbitrary file deletion due to insufficient file path validatio...

PT-2025-29576 · NetGear · Netgear Xr300

Name of the Vulnerable Software and Affected Versions: Netgear XR300 version 1.0.3.38 10.3.30 Description: A stack-based buffer overflow exists in the HTTPD service through the usb device.cgi endpoint when processing POST requests containing the usb folder parameter. Recommendations: Update to a...

PT-2025-29618

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u451 and 8u451-perf Description An issue exists in the Oracle Java SE Install component that allows a low-privileged attacker with logon access to the infrastructure where Oracle Java SE executes to compromise the...

PT-2025-29545 · Wepresent · Wepresent Wipg-1000

Name of the Vulnerable Software and Affected Versions: WePresent WiPG-1000 versions prior to 2.2.3.0 Description: An unauthenticated command injection issue exists due to improper input handling in the /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a syst...

PT-2025-29561 · Ibm · Ibm Qradar Siem

Name of the Vulnerable Software and Affected Versions: IBM QRadar SIEM versions 7.5 through 7.5.0 UP12 IF02 Description: IBM QRadar SIEM is susceptible to a stored cross-site scripting issue. Authenticated users can embed arbitrary JavaScript code within the Web UI, potentially altering...

PT-2025-29643 · Oracle · Oracle Applications Framework +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.14 Description: A vulnerability exists within the Personalization component of the Oracle Applications Framework product of Oracle E-Business Suite. This issue is easily exploitable, allowi...

PT-2025-29685 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.18 GitHub Enterprise Server versions 3.14.15 GitHub Enterprise Server versions 3.15.10 GitHub Enterprise Server versions 3.16.6 GitHub Enterprise Server versions 3.17.3 Description: An incorrect...

PT-2025-29593 · Unknown · Scratch Channel

Name of the Vulnerable Software and Affected Versions: The Scratch Channel affected versions not specified Description: The application does not properly sanitize text box inputs in the /api/users.js file, potentially leading to cross-site scripting attacks. Recommendations: At the moment, there ...

PT-2025-29565 · Nexxt Solutions · Nexxt Solutions Ncm-X1800 Mesh Router

Name of the Vulnerable Software and Affected Versions: Nexxt Solutions NCM-X1800 Mesh Router firmware versions prior to UV1.2.7 Description: Nexxt Solutions NCM-X1800 Mesh Router firmware contains an authenticated command injection issue in the firmware update feature. The /web/um fileName set.cg...

CVE-2025-53640

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields such as ACLs could be misused to dump basic user details such ...

CVE-2025-53689

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

CVE-2025-53689 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

CVE-2025-7464

A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The...

PT-2025-29521 · Caido · Caido

Name of the Vulnerable Software and Affected Versions: Caido versions prior to 0.49.0 Description: Caido is a web security auditing toolkit. A reflected cross-site scripting XSS issue exists in Caido’s toast UI component. Toast messages may reflect unsanitized user input in tools like Match&Repla...

PT-2025-29498 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SemCms version 5.0 Description: SemCms version 5.0 contains a SQL injection issue via the ID parameter at the SEMCMS InquiryView.php file. Recommendations: Address the SQL injection issue by sanitizing or validating the ID parameter within th...