PT-2025-21705 · Unknown · Scripteo Ads Pro Plugin

Name of the Vulnerable Software and Affected Versions: scripteo Ads Pro Plugin versions n/a through 4.88 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS in the scripteo Ads Pro Plugin...

PT-2025-21642 · Seaweedfs · Seaweedfs

Name of the Vulnerable Software and Affected Versions: seaweedfs version 3.68 Description: A SQL injection issue was discovered in the component /abstract sql/abstract sql store.go. This issue affects seaweedfs and can be exploited via the vulnerable component. Recommendations: For seaweedfs...

PT-2025-21725 · Unknown · Mapsvg Lite

Name of the Vulnerable Software and Affected Versions: MapSVG Lite versions n/a through 8.6.4 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', which affects MapSVG Lite. This allows for Code Injection. Recommendations: For versions n/...

PT-2025-21658

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop versions prior to 3.15 Description: The issue affects Nextcloud Desktop, allowing 3rd party applications to create link shares for almost all data via the socket API. These shares can then be sent to an external service...

PT-2025-21690 · Themovation · Themovation Quickcal

Name of the Vulnerable Software and Affected Versions: Themovation QuickCal versions 1.0.0 through 1.0.15 Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For Themovation...

CVE-2025-4727

A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file packages/ddp-server/livedataserver.js. The manipulation of the argument forwardedFor leads to inefficient regular expression complexity. The attack may be...

CVE-2025-4727 Meteor livedata_server.js Object.assign redos

A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file packages/ddp-server/livedataserver.js. The manipulation of the argument forwardedFor leads to inefficient regular expression complexity. The attack may be...

Security Bulletin: Astronomer with IBM is vulnerable to arbitrary code execution due to the LangChain package (CVE-2023-38896).

Summary LangChain is used by Astronomer with IBM as part of LLM processing. Vulnerability Details CVEID:CVE-2023-38896 DESCRIPTION: LangChain could allow a remote attacker to execute arbitrary code on the system, caused by improper neutralization of user supplied-input by the frommathprompt and...

CVE-2025-47287

Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs,...

Security Bulletin: Vulnerability in commons-compress affects IBM Integrated Analytics System (Sailfish) [CVE-2024-25710, CVE-2024-26308]

Summary The commons-compress package is used by IBM Integrated Analytics System . IBM Integrated Analytics System has addressed the applicable CVECVE-2024-25710, CVE-2024-26308. Vulnerability Details CVEID:CVE-2024-25710 DESCRIPTION: Loop with Unreachable Exit Condition 'Infinite Loop'...

CVE-2025-27696

Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue...

PT-2025-21488

Name of the Vulnerable Software and Affected Versions: wccp-pro WordPress plugin versions prior to 15.3 Description: The issue concerns an open-redirect flaw via the referrer parameter, allowing the redirection of users to external sites. Recommendations: For versions prior to 15.3, update to...

PT-2025-21545 · WordPress · Posts Filter +4

Name of the Vulnerable Software and Affected Versions: Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin versions prior to 2.2.93 Description: The issue concerns the WordPress plugin's failure to validate and escape some of its block options before outputting the...

PT-2025-21334 · National Instruments · Ni Circuit Design Suite

Name of the Vulnerable Software and Affected Versions: NI Circuit Design Suite versions 14.3.0 and prior versions Description: The issue is due to a memory corruption vulnerability caused by an out of bounds write in Library!DecodeBase64 when using the SymbolEditor. This may result in information...

PT-2025-21410 · WordPress · Jsfiddle Shortcode

Name of the Vulnerable Software and Affected Versions: JSFiddle Shortcode plugin for WordPress versions prior to 1.1.3 Description: The issue concerns the JSFiddle Shortcode plugin for WordPress, where it fails to validate and escape some of its shortcode attributes before outputting them back in...

PT-2025-21490 · WordPress · User Profile Builder

Name of the Vulnerable Software and Affected Versions: The User Profile Builder WordPress plugin versions prior to 3.12.2 Description: The issue allows Admin+ users to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape some parameters before outputting its...

PT-2025-21506 · WordPress · Sensei Lms

Name of the Vulnerable Software and Affected Versions: The Sensei LMS WordPress plugin versions prior to 4.20.0 Description: The issue allows disclosure of all users of the blog, including their email addresses, to teachers on the students page. Recommendations: For versions prior to 4.20.0, upda...

PT-2025-21260 · WordPress · Weluka Lite

Name of the Vulnerable Software and Affected Versions: Weluka Lite plugin for WordPress versions up to, and including, 1.0.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'weluka-map' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-21350 · Fluxbb · Fluxbb

Name of the Vulnerable Software and Affected Versions: FluxBB version 1.5.11 Description: The issue is related to Cross Site Scripting XSS via the Forum Description Field in admin forums.php. This allows for potential malicious script execution. No information is provided about the estimated numb...

PT-2025-21276 · Esignal · Esignal

Name of the Vulnerable Software and Affected Versions: eSigna versions 1.0 through 1.5 Description: The issue is related to an Insecure Direct Object Reference IDOR vulnerability in the eSignaViewer component. This vulnerability allows an unauthenticated attacker to access arbitrary files in the...