PT-2025-20139 · Unknown · Accept Donations With Paypal

Name of the Vulnerable Software and Affected Versions: Accept Donations with PayPal versions 1.4.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

CVE-2025-30165 Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration

vLLM is an inference and serving engine for large language models. In a multi-node vLLM deployment using the V0 engine, vLLM uses ZeroMQ for some multi-node communication purposes. The secondary vLLM hosts open a SUB ZeroMQ socket and connect to an XPUB socket on the primary vLLM host. When data ...

Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be...

CVE-2025-46762 Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be...

CVE-2025-46762 Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be...

PT-2025-19840 · Unknown · Real Estate Management System

Name of the Vulnerable Software and Affected Versions: Real Estate Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the message parameter at the "/contact.php" API endpoint. Recommendations: For Real Estate Management System...

PT-2025-19833 · Unknown · Sourcecodester Advanced Web Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Advanced Web Store version 1.0 Description: A critical vulnerability was found in SourceCodester Advanced Web Store. The issue affects an unknown function of the file /admin/admin addnew product.php. The manipulation of the...

PT-2025-19813 · Google +1 · Virglrenderer +1

Name of the Vulnerable Software and Affected Versions: Virglrenderer in ChromeOS version 16093.57.0 Description: The issue is an out-of-bounds read in Virglrenderer that allows a malicious guest VM to achieve arbitrary address access within the crosvm sandboxed process. This could potentially lea...

PT-2025-19983

Name of the Vulnerable Software and Affected Versions FastAPI Guard versions prior to 2.0.0 Description An HTTP header injection issue has been identified in FastAPI Guard. By manipulating the X-Forwarded-For header, an attacker can potentially inject arbitrary IP addresses into the request. This...

PT-2025-19824 · WordPress · Reales Wp Stpt

Name of the Vulnerable Software and Affected Versions: Reales WP STPT plugin for WordPress versions up to and including 2.1.2 Description: The issue arises from the plugin's failure to properly validate a user's identity before updating their details, such as the password. This allows authenticat...

PT-2025-19923 · Mrcms · Mrcms

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.2 Description: A vulnerability was found in MRCMS, classified as problematic, affecting an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has...

PT-2025-19869 · Unknown · Tensorflow

Name of the Vulnerable Software and Affected Versions: Tensorflow serving versions up to 2.18.0 Description: The issue is related to incorrect JSON input stringification in Tensorflow serving, which allows for potentially unbounded recursion. This can lead to a server crash. Recommendations: For...

PT-2025-19990 · Crestron · Crestron Automate Vx

Name of the Vulnerable Software and Affected Versions: Crestron Automate VX versions 5.6.8161.21536 through 6.4.0.49 Description: The issue allows for the cleartext transmission of sensitive information, such as user passwords, due to the device allowing Web UI and API access over non-secure...

PT-2025-19958

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.131 Liferay DXP versions 2024.Q1.1 through 2024.Q4.5 Description A reflected cross-site scripting XSS issue exists in Liferay Portal and DXP. This allows a remote, unauthenticated attacker to inject...

PT-2025-19948

Name of the Vulnerable Software and Affected Versions itsourcecode Gym Management System version 1.0 Description A critical vulnerability was found in the itsourcecode Gym Management System. The issue affects an unknown functionality of the file /ajax.php?action=delete member. The manipulation of...

PT-2025-20553

Name of the Vulnerable Software and Affected Versions: Unifi Protect Application versions 5.3.41 and earlier Description: The issue is related to a misconfigured access token mechanism in the Share Livestream feature of the Unifi Protect Application. This could allow an unauthorized user to...

PT-2025-19817

Name of the Vulnerable Software and Affected Versions cpp-httplib versions prior to 0.20.1 Description cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. The library fails to enforce configured size limits on incoming request bodies when Transfer-Encoding: chunked is used or...

PT-2025-19827 · Unknown · Phpgurukul Art Gallery Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Art Gallery Management System version 1.1 Description: A critical issue affects an unknown functionality of the file /admin/add-art-type.php. The manipulation of the arttype argument leads to SQL injection. This issue can be...

PT-2025-19901 · Finit +1 · Finit +1

Name of the Vulnerable Software and Affected Versions: Finit versions 4.2 through 4.11 Description: Finit's urandom plugin has a heap buffer overwrite vulnerability at boot, which can lead to random instabilities and undefined behavior. The urandom plugin is enabled by default. Recommendations: F...

PT-2025-19938 · D Link · D-Link Dir-600

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600L versions up to 2.07B01 Description: A critical issue affects the function formSetWanL2TP. The manipulation of the host argument leads to a buffer overflow, allowing remote attacks. This issue only affects products that are no...