PT-2025-26781 · Komga · Komga

Name of the Vulnerable Software and Affected Versions: Komga versions 1.8.0 through 1.21.3 Description: A Cross-Site Scripting XSS issue has been found in Komga when serving EPUB resources. This allows an attacker to perform actions on the victim's behalf. If an admin user is targeted, it can be...

PT-2025-26729

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: The issue occurs when Multi-Account Containers is enabled, allowing DNS requests to bypass a SOCKS proxy under certain conditions, such as when the domain name is invalid or the SOCKS proxy is not...

PT-2025-26730

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: The issue arises when a user visits a webpage with an invalid TLS certificate and grants an exception. In this scenario, the webpage can provide a WebAuthn challenge that the user is prompted to...

PT-2025-26725

Name of the Vulnerable Software and Affected Versions: Firefox for Android versions prior to 140 Description: The issue allows an attacker to potentially lead to phishing attacks by following a provided URL in a link querystring parameter instead of the correct URL. This affects Firefox for...

PT-2025-26686 · Kanboard · Kanboard

Name of the Vulnerable Software and Affected Versions: Kanboard versions prior to 1.2.46 Description: Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Ho...

PT-2025-26773 · Control Id · Controlid Idsecure On-Premises

Name of the Vulnerable Software and Affected Versions: ControlID iDSecure On-premises versions 4.7.48.0 and prior Description: The issue is a Server-Side Request Forgery vulnerability that could allow an unauthenticated attacker to retrieve information from other servers. This vulnerability affec...

PT-2025-26776 · Unknown +1 · Xunit-Xml-Plugin +1

Name of the Vulnerable Software and Affected Versions: Allure 2 versions prior to 2.34.1 Description: A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2. The plugin fails to securely configure the XML parser DocumentBuilderFactory and allows external...

PT-2025-26784 · Risc Zero +1 · Risc Zero +1

Name of the Vulnerable Software and Affected Versions: RISC Zero versions prior to 2.1.1 and 2.2.0 Description: The issue concerns the Steel.validateCommitment Solidity library function, which returns true for a crafted commitment with a digest value of zero. This violates the function's semantic...

PT-2025-26735 · Oatpp · Oatpp

Name of the Vulnerable Software and Affected Versions: oatpp Oat++ versions up to 1.3.1 Description: A critical vulnerability has been found, affecting the deserializeArray function in the file src/oatpp/json/Deserializer.cpp. This issue leads to a stack-based buffer overflow and can be initiated...

PT-2025-26655 · Noyafa · Noyafa/Xiami Lf9 Pro

Name of the Vulnerable Software and Affected Versions: NOYAFA/Xiami LF9 Pro up to 20250611 Description: A problematic vulnerability was found in the RTSP Live Video Stream Endpoint component of the NOYAFA/Xiami LF9 Pro device. This issue leads to improper access controls, allowing for unauthorize...

PT-2025-26786 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 138.0.7204.49 Description: The issue is related to insufficient policy enforcement in the Loader component, allowing a remote attacker to bypass content security policy via a crafted HTML page. This could...

PT-2025-26669 · Fanwei · Fanwei E-Cology

Name of the Vulnerable Software and Affected Versions: Fanwei e-cology versions 8.0 and prior Description: A SQL injection issue exists, allowing unauthenticated attackers to execute arbitrary SQL queries via the "getdata.jsp" endpoint. The application passes unsanitized user input from the sql...

CVE-2025-32896

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

PT-2025-26594 · Brain2 · Brain2

Name of the Vulnerable Software and Affected Versions: BRAIN2 versions 0.0 through 3.05 Description: The configuration file for database access of the BRAIN2 application is not sufficiently secured, allowing standard Windows users to access and decrypt it. This issue is related to the storage of...

PT-2025-26603 · Ncr · Ncr Terminal Handler

Name of the Vulnerable Software and Affected Versions: NCR Terminal Handler version 1.5.1 Description: An issue allows a low-level privileged authenticated attacker to query the SOAP API endpoint to obtain information about all of the users of the application, including their usernames, roles,...

PT-2025-28021

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A problematic issue has been found in HDF5, affecting the function H5FL malloc of the file src/H5FL.c. This issue leads to a memory leak and requires local attacking to exploit. The exploit has been disclosed ...

PT-2025-26615 · Ncr · Ncr Terminal Handler

Name of the Vulnerable Software and Affected Versions: NCR Terminal Handler version 1.5.1 Description: The issue allows a remote attacker to escalate privileges via a crafted POST request to the "grantRolesToUsers", "grantRolesToGroups", and "grantRolesToOrganization" SOAP API component...

PT-2025-26634

Name of the Vulnerable Software and Affected Versions: pbkdf2 versions 3.0.10 through 3.1.2 Description: The issue is related to an Improper Input Validation vulnerability in pbkdf2, allowing Signature Spoofing by Improper Validation. This vulnerability is associated with program files...

PT-2025-26585 · Dragonfly · Dragonfly

Name of the Vulnerable Software and Affected Versions: dragonfly versions 1.28.18 through 1.30.1 Description: The issue is related to an Integer Overflow or Wraparound vulnerability in the dragonflydb dragonfly, specifically in the src/redis/lua/struct modules, associated with program files lua...

Important: perl-File-Find-Rule

Issue Overview: File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when grep encounters a crafted filename. A file handle is opened with the 2 argument form of open allowing an attacker controlled filename to provide the MODE parameter to open, turning the filename...