PT-2025-25731 · Metagauss · Metagauss Profilegrid

Name of the Vulnerable Software and Affected Versions: Metagauss ProfileGrid versions through 5.9.5.2 Description: The issue is a Server-Side Request Forgery SSRF vulnerability that allows Server Side Request Forgery. Recommendations: For Metagauss ProfileGrid versions through 5.9.5.2, update to ...

PT-2025-25737 · Unknown · Miliaris Amigdala

Name of the Vulnerable Software and Affected Versions: Miliaris Amigdala version 2.2.6 Description: A cross-site scripting XSS issue in the e-mail manager function allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload. This could potentially lead to...

PT-2025-25751

Name of the Vulnerable Software and Affected Versions: Sitecore PowerShell Extensions versions through 7.0 Description: Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager XM and Experience Platform XP, is vulnerable to an unrestricted file upload issue. A remote, authenticat...

PT-2025-25757 · Llama.Cpp · Llama.Cpp

Name of the Vulnerable Software and Affected Versions: llama.cpp versions prior to b5662 Description: The issue is related to a buffer overflow in the vocabulary-loading code of llama.cpp. An attacker-supplied GGUF model vocabulary can trigger this overflow. Specifically, the helper function toke...

PT-2025-25666 · Wpcrm · Wp-Crm

Name of the Vulnerable Software and Affected Versions: WPCRM - CRM for Contact form CF7 & WooCommerce versions through 3.2.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

PT-2025-25683 · Yith · Yith Paypal Express Checkout For Woocommerce

Name of the Vulnerable Software and Affected Versions: YITH PayPal Express Checkout for WooCommerce versions 1.49.0 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions. Recommendations: For YITH PayPal Express Checkout for WooCommer...

PT-2025-25701 · Unknown · Thembay Hara

Name of the Vulnerable Software and Affected Versions: thembay Hara versions 1.2.10 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability, which allows PHP Local File...

PT-2025-25694 · Unknown · Thembay Besa

Name of the Vulnerable Software and Affected Versions: thembay Besa versions n/a through 2.3.8 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This...

PT-2025-25642

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload for Contact Form 7 versions 1.3.8.9 and earlier Description The issue is related to insufficient file type validation, allowing unauthenticated attackers to bypass the plugin's blacklist and upload dangerous...

PT-2025-25626 · Themanojdesai · Python-A2A

Name of the Vulnerable Software and Affected Versions: themanojdesai python-a2a versions up to 0.5.5 Description: A critical vulnerability has been found in themanojdesai python-a2a. The create workflow function of the file python a2a/agent flow/server/api.py is affected, leading to path traversa...

PT-2025-26173 · Quiche · Quiche

Name of the Vulnerable Software and Affected Versions: quiche versions prior to 0.24.4 Description: The issue is related to incorrect congestion window growth, which could cause quiche to send data at a rate faster than the path might actually support. An unauthenticated remote attacker can explo...

CVE-2025-6140

A vulnerability, which was classified as problematic, was found in spdlog up to 1.15.1. This affects the function scopedpadder in the library include/spdlog/patternformatter-inl.h. The manipulation leads to resource consumption. It is possible to launch the attack on the local host. The exploit h...

UBUNTU-CVE-2025-6141

A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocesstermcap of the file tinfo/parseentry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to...

Brute Force

Overview Affected versions of this package are vulnerable to Brute Force via the second factor verification process. An attacker can bypass authentication controls by automating OTP guessing attempts. Remediation Upgrade Weblate to version 5.12.1 or higher. References - GitHub Commit - GitHub PR ...

CVE-2025-6141 GNU ncurses parse_entry.c postprocess_termcap stack-based overflow

A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocesstermcap of the file tinfo/parseentry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to...

CVE-2025-6141 GNU ncurses parse_entry.c postprocess_termcap stack-based overflow

A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocesstermcap of the file tinfo/parseentry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to...

GHSA-8CQV-PJ7F-PWPC Teleport allows remote authentication bypass

Impact A full technical disclosure and open-source patch will be published after the embargo period, ending on June 30th, to allow all users to upgrade. Teleport security engineers identified a critical security vulnerability that could allow remote authentication bypass of Teleport. Teleport Clo...

GHSA-VV7R-C36W-3PRJ Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fi...

CVE-2025-4565

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashin...

CVE-2025-48976 Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fi...