PT-2025-27270 · Marvell · Marvell Qconvergeconsole

Name of the Vulnerable Software and Affected Versions: Marvell QConvergeConsole affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole. The specific flaw exists within the implementation of th...

PT-2025-27178 · Woocommerce · Additional Order Filters For Woocommerce

Name of the Vulnerable Software and Affected Versions: Additional Order Filters for WooCommerce versions 1.22 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on...

PT-2025-27238 · Unknown · Phpgurukul Medical Card Generation System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Medical Card Generation System version 1.0 Description: A Cross-Site Request Forgery CSRF issue exists in the Inquiry Management functionality, specifically at the "/mcgs/admin/readenq.php" endpoint. This allows an authenticated...

GHSA-9R64-3WMC-X8M8 Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the improper enforcement of resource limits in the nftables rules generation process for managed bridge networks. An attacker can exhaust the DHCP pool and disrupt network...

CVE-2025-52904 File Browser: Command Execution not Limited to Scope

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions of the web application on the 2.x branch, all users have a scope assigned, and they only have access to the files within that scope. The...

CVE-2025-52477

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

CVE-2025-52477 Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

MAL-2025-5284 Malicious code in meuhq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a603acb3997e3395851edc9bc2cb0812dff4a2eb9a5f0bf87aa6b5bc229a0097 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-26920 · WordPress · Vg Wort Metis

Name of the Vulnerable Software and Affected Versions: VG WORT METIS plugin for WordPress versions prior to 2.0.0 Description: The issue is related to unauthorized modification of data due to a missing capability check on the gutenberg save post function. This allows authenticated attackers with...

PT-2025-26923 · WordPress · Responsive Food/Drink Menu

Name of the Vulnerable Software and Affected Versions: The Responsive Food and Drink Menu plugin for WordPress versions up to, and including, 2.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's display pdf menus shortcode due to insufficient input sanitization an...

PT-2025-26924 · WordPress · Wp-Photonav

Name of the Vulnerable Software and Affected Versions: WP-PhotoNav plugin for WordPress versions up to, and including, 1.2.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's photonav shortcode due to insufficient input sanitization and output escaping on...

PT-2025-26934 · Snyk · Snyk Cli

Name of the Vulnerable Software and Affected Versions: snyk versions prior to 1.1297.3 Description: The issue allows for the insertion of sensitive information into log files through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line...

PT-2025-26947 · WordPress · Ultimate Addons For Contact Form 7

Name of the Vulnerable Software and Affected Versions: Ultra Addons for Contact Form 7 plugin for WordPress versions 3.5.11 through 3.5.19 Description: The issue is related to Stored Cross-Site Scripting via the Database module due to insufficient input sanitization and output escaping. The...

PT-2025-26978

Name of the Vulnerable Software and Affected Versions: File Browser versions prior to 2.33.7 Description: The Markdown preview function of File Browser is vulnerable to Stored Cross-Site-Scripting XSS. Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the...

PT-2016-7979 · Debian · Pdns

Name of the Vulnerable Software and Affected Versions: pdns versions prior to 3.3.1-1 Description: The issue arises from the pdns package in Debian, where the MySQL user is created with excessive privileges. Specifically, the maintainer scripts of pdns-backend-mysql grant too wide database...

PT-2025-27010

Name of the Vulnerable Software and Affected Versions: n8n versions prior to 1.98.0 Description: The issue is an Open Redirect vulnerability in the login flow, affecting authenticated users who can be redirected to untrusted domains after logging in. This is achieved by crafting malicious URLs wi...

PT-2025-27002 · Github · Octo-Sts

Name of the Vulnerable Software and Affected Versions: Octo-STS versions prior to v0.5.3 Description: Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. The issue allows for unauthenticated Server-Side Request Forgery SSRF by abusing fields in OpenID Connect...

PT-2025-26969 · Oracle +1 · Java +1

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.11 Description: The issue concerns a feature in Java where certain characters are converted to their uppercase equivalents, potentially allowing a threat actor to craft a message that exploits this character...

PT-2025-27005

Name of the Vulnerable Software and Affected Versions: Himmelblau versions 0.9.10 through 0.9.16 Description: A vulnerability in Himmelblau allows a user to authenticate to a Linux host using an invalid Linux Hello PIN when the host is offline. This issue arises from an incorrect assumption in th...