PT-2025-26773 · Control Id · Controlid Idsecure On-Premises

Name of the Vulnerable Software and Affected Versions: ControlID iDSecure On-premises versions 4.7.48.0 and prior Description: The issue is a Server-Side Request Forgery vulnerability that could allow an unauthenticated attacker to retrieve information from other servers. This vulnerability affec...

PT-2025-26784 · Risc Zero +1 · Risc Zero +1

Name of the Vulnerable Software and Affected Versions: RISC Zero versions prior to 2.1.1 and 2.2.0 Description: The issue concerns the Steel.validateCommitment Solidity library function, which returns true for a crafted commitment with a digest value of zero. This violates the function's semantic...

PT-2025-26772 · Control Id · Control Id Idsecure

Name of the Vulnerable Software and Affected Versions: ControlID iDSecure On-premises versions 4.7.48.0 and prior Description: The issue is related to an Improper Authentication vulnerability, which could allow an attacker to bypass authentication and gain permissions in the product. This poses a...

PT-2025-26780

Name of the Vulnerable Software and Affected Versions: Hikka versions all Description: The issue affects all users on all versions of Hikka, a Telegram userbot. Two scenarios are possible: 1. If the web interface does not have an authenticated session, an attacker can use their own Telegram accou...

PT-2025-26786 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 138.0.7204.49 Description: The issue is related to insufficient policy enforcement in the Loader component, allowing a remote attacker to bypass content security policy via a crafted HTML page. This could...

PT-2025-26689 · Pdf.Js +1 · Pdf.Js +1

Name of the Vulnerable Software and Affected Versions: Gogs versions 0.14.0+dev and prior Description: Gogs is an open source self-hosted Git service. The issue is a stored cross-site scripting XSS vulnerability, which allows client-side Javascript code execution. This is caused by the usage of a...

PT-2025-26669 · Fanwei · Fanwei E-Cology

Name of the Vulnerable Software and Affected Versions: Fanwei e-cology versions 8.0 and prior Description: A SQL injection issue exists, allowing unauthenticated attackers to execute arbitrary SQL queries via the "getdata.jsp" endpoint. The application passes unsanitized user input from the sql...

PT-2025-26787 · Google +1 · Google Chrome +1

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 138.0.7204.49 Description: Insufficient data validation in DevTools in Google Chrome on Windows allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a...

PT-2025-26725

Name of the Vulnerable Software and Affected Versions: Firefox for Android versions prior to 140 Description: The issue allows an attacker to potentially lead to phishing attacks by following a provided URL in a link querystring parameter instead of the correct URL. This affects Firefox for...

PT-2025-26730

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: The issue arises when a user visits a webpage with an invalid TLS certificate and grants an exception. In this scenario, the webpage can provide a WebAuthn challenge that the user is prompted to...

PT-2025-26729

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: The issue occurs when Multi-Account Containers is enabled, allowing DNS requests to bypass a SOCKS proxy under certain conditions, such as when the domain name is invalid or the SOCKS proxy is not...

PT-2025-26732

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: The issue arises when a user saves a response from the Network tab in Devtools using the Save As context menu option. In this scenario, the saved file may not have the .download file extension,...

PT-2025-26731

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an...

PT-2025-26777 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 3.x through 3.11.18 Description: A session fixation issue allows unauthenticated attackers to hijack user sessions via the sesskey parameter. This parameter can be obtained without authentication and reused within the OAuth2...

CVE-2025-32896

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

PT-2025-26611 · Ncr · Ncr Terminal Handler

Name of the Vulnerable Software and Affected Versions: NCR Terminal Handler version 1.5.1 Description: A CSV injection issue allows attackers to execute arbitrary commands by injecting a crafted payload into any text field that accepts strings. Recommendations: For NCR Terminal Handler version...

PT-2025-26636 · Mitel · Mitel Openscape Xpressions

Name of the Vulnerable Software and Affected Versions: Mitel OpenScape Xpressions versions through V7R1 FR5 HF43 P913 Description: A vulnerability in the WebApl component could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful...

PT-2025-26607

Name of the Vulnerable Software and Affected Versions: MLflow versions prior to 3.1.0 Description: The issue is related to the gateway proxy handler in MLflow, which lacks gateway path validation. This could potentially lead to exploitation. Recommendations: For versions prior to 3.1.0, update to...

PT-2025-26615 · Ncr · Ncr Terminal Handler

Name of the Vulnerable Software and Affected Versions: NCR Terminal Handler version 1.5.1 Description: The issue allows a remote attacker to escalate privileges via a crafted POST request to the "grantRolesToUsers", "grantRolesToGroups", and "grantRolesToOrganization" SOAP API component...

PT-2025-26603 · Ncr · Ncr Terminal Handler

Name of the Vulnerable Software and Affected Versions: NCR Terminal Handler version 1.5.1 Description: An issue allows a low-level privileged authenticated attacker to query the SOAP API endpoint to obtain information about all of the users of the application, including their usernames, roles,...