PT-2025-23559 · Unknown +1 · Kreatv Sdk +1

Name of the Vulnerable Software and Affected Versions: Arris VIP1113 devices with KreaTV SDK through 2025-05-30 Description: The issue allows file overwrite via TFTP because a remote filename with a space character enables an attacker to control the local filename. Recommendations: For Arris...

PT-2025-23463 · Unknown · Juzawebcms

Name of the Vulnerable Software and Affected Versions: juzaweb CMS versions up to 3.4.2 Description: A critical issue was found in the Plugins Page component, specifically affecting the /admin-cp/plugin/install file. This leads to improper access controls, allowing for remote attacks. The issue h...

PT-2025-23859 · Tenda · Tenda Ac18

Name of the Vulnerable Software and Affected Versions: Tenda AC18 version 15.03.05.05 Description: A critical vulnerability was found in the fromadvsetlanip function of the /goform/AdvSetLanip file. The manipulation of the lanMask argument leads to a buffer overflow. The attack can be launched...

PT-2025-23470 · Roundcube · Roundcube

Name of the Vulnerable Software and Affected Versions: Roundcube versions prior to 1.6.11 Description: The issue is related to a Post-Auth RCE via PHP Object Deserialization in Roundcube. It is estimated that over 53 million hosts are potentially affected. The bug has existed undetected for 10...

PT-2025-23446 · Unknown · Juzawebcms

Name of the Vulnerable Software and Affected Versions: juzaweb CMS versions up to 3.4.2 Description: A critical vulnerability has been found in the General Setting Page component of juzaweb CMS, affecting unknown code of the file /admin-cp/setting/system/general. This vulnerability leads to...

PT-2025-23493 · Arm · Valhall Gpu Kernel Driver +1

Name of the Vulnerable Software and Affected Versions: Valhall GPU Kernel Driver versions r53p0 through r53p0 Arm 5th Gen GPU Architecture Kernel Driver versions r53p0 through r53p0 Description: The issue allows a local non-privileged user process to perform improper GPU memory processing...

PT-2025-23555 · Hax · Hax Cms +1

Name of the Vulnerable Software and Affected Versions: HAX open-apis versions up to and including 10.0.2 Description: An unauthenticated information disclosure issue exists in the HAX content management system via the haxPsuUsage API endpoint. This allows any remote unauthenticated user to retrie...

PT-2025-23611

Name of the Vulnerable Software and Affected Versions Python versions 3.12 and later Description The issue allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data" when using the tarfile module to extract untrusted tar archives. This affects users o...

Debian dla-4203 : kitty - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4203 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4203-1 [email protected] https://www.debian.org/lts/security/...

CVE-2025-5412 Mist Community Edition Authentication Endpoint views.py login cross site scripting

A vulnerability classified as problematic has been found in Mist Community Edition up to 4.7.1. Affected is the function Login of the file src/mist/api/views.py of the component Authentication Endpoint. The manipulation of the argument returnto leads to cross site scripting. It is possible to...

CVE-2025-5411 Mist Community Edition views.py tag_resources cross site scripting

A vulnerability was found in Mist Community Edition up to 4.7.1. It has been rated as problematic. This issue affects the function tagresources of the file src/mist/api/tag/views.py. The manipulation of the argument tag leads to cross site scripting. The attack may be initiated remotely. The...

PT-2025-23437 · Unknown · Mist Community Edition

Name of the Vulnerable Software and Affected Versions: Mist Community Edition versions up to 4.7.1 Description: A vulnerability was found in the function session start response of the file src/mist/api/auth/middleware.py. This issue leads to cross-site request forgery and can be initiated remotel...

PT-2025-23436 · Unknown · Mist Community Edition

Name of the Vulnerable Software and Affected Versions: Mist Community Edition versions up to 4.7.1 Description: A critical issue has been found, affecting the create token function of the API Token Handler component. This leads to improper access controls, allowing remote attacks. The issue has...

PT-2025-23421 · Unknown · Chaitak-Gorai Blogbook

Name of the Vulnerable Software and Affected Versions: chaitak-gorai Blogbook versions up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513 Description: A critical vulnerability was found in chaitak-gorai Blogbook, affecting an unknown function of the file /user.php of the component GET Parameter...

Debian dla-4205 : fonts-opensymbol - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4205 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4205-1 [email protected]...

[SECURITY] [DLA 4201-1] libvpx security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4201-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk May 31, 2025 https://wiki.debian.org/LTS -...

CVE-2025-46823

openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions of the FHIR2 module prior to 2.5.0, privileges were not always correctly checked, which means that unauthorized users may have been able to add or edit data they were not...

PT-2025-23415 · Jeewms · Jeewms

Name of the Vulnerable Software and Affected Versions: JeeWMS up to 20250504 Description: A critical issue was found in the File Handler component, specifically affecting the filedeal function of the /systemController/filedeal.do file. This leads to improper access controls, allowing remote...

PT-2025-23380 · WordPress · The Borderless – Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Borderless – Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.7.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing...

PT-2025-23375 · WordPress · Proforti

Name of the Vulnerable Software and Affected Versions: Proforti plugin for WordPress versions 2.0.6.0 through 2.1.1.3 Description: The issue is related to a missing capability check on the "stocktend object" endpoint. This allows unauthenticated attackers to trigger the save object as user functi...