PT-2025-13377 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.2.0-rc2 Description: A vulnerability has been resolved in the Linux kernel related to the powerpc/imc-pmu code, which triggers a warning when running a thread imc event with CONFIG DEBUG ATOMIC SLEEP and CONFI...

PT-2025-13223 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.12.0-rc7+ Description: A vulnerability in the Linux kernel has been resolved, specifically in the RDMA/mlx5 component. The issue was related to an implicit ODP hang on parent deregistration. The problem occurr...

Security Bulletin: IBM Robotic Process Automation for Cloud Pak is vulnerable to cross site scripting (CVE-2022-38709)

Summary IBM Robotic Process Automation for Cloud Pak is vulnerable to cross site scripting through DOM manipulation. Vulnerability Details CVEID:CVE-2022-38709 DESCRIPTION: IBM Robotic Process Automation for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed...

PT-2025-13008 · Atop +2 · Atop +2

Name of the Vulnerable Software and Affected Versions: atop versions prior to 2.11.0 Description: The issue allows local users to cause a denial of service, such as an assertion failure and application exit, or possibly have unspecified other impact by running certain types of unprivileged...

PT-2025-14901

Name of the Vulnerable Software and Affected Versions TOTOLINK A6000R version 1.0.1-B20201211.2000 Description A critical issue was found in the apcli cancel wps function of the file /usr/lib/lua/luci/controller/mtkwifi.lua. This issue leads to command injection and can be exploited remotely...

PT-2025-12979 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2024.3.29 and earlier Devolutions Remote Desktop Manager versions 2025.1.24 through 2025.1.25 Description: The issue is a client-side access control bypass in the permission component. An...

PT-2025-12858 · WordPress · Booknetic

Name of the Vulnerable Software and Affected Versions: Booknetic WordPress plugin versions prior to 4.1.5 Description: The issue concerns a lack of CSRF check when creating Staff accounts, which could allow attackers to make logged-in admins add arbitrary Staff members via a CSRF attack. This cou...

PT-2025-12981 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2024.3.29 and earlier Devolutions Remote Desktop Manager versions 2025.1.24 through 2025.1.25 Description: The issue is related to insufficient logging in the autotyping feature, allowing an...

PT-2025-12870 · WordPress · Advanced Iframe

Name of the Vulnerable Software and Affected Versions: Advanced iFrame plugin for WordPress versions up to, and including, 2024.5 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes through the src attribute in the advanced iframe...

PT-2025-12809

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 14.91.0 and prior to 15.52.0 Description Frappe is a full-stack web application framework. A system user could create specific documents in a manner that allows for remote code execution. Recommendations Frappe version...

PT-2025-12743 · WordPress · The Slider By 10Web

Name of the Vulnerable Software and Affected Versions: The Slider by 10Web WordPress plugin versions prior to 1.2.62 Description: The issue concerns the Slider by 10Web WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high privilege users, such ...

PT-2025-12740 · WordPress · Stylish Price List

Name of the Vulnerable Software and Affected Versions: The Stylish Price List WordPress plugin versions prior to 7.1.12 Description: The issue allows high privilege users, such as contributors, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed,...

PT-2025-12801

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X versions 240126 and 240802 Description A command injection issue exists due to insufficient data sanitization at the control level. An authorized attacker can execute arbitrary commands on remote devices by sending a POST reque...

PT-2025-12810

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 14.89.0 Frappe versions prior to 15.51.0 Description The issue allows for information disclosure through crafted requests, potentially leading to account takeover. Recommendations For versions prior to 14.89.0, update ...

PT-2025-12747 · Pirateforms · Contact Form & Smtp Plugin

Name of the Vulnerable Software and Affected Versions: The Contact Form & SMTP Plugin for WordPress by PirateForms versions prior to 2.6.0 Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admins, ...

PT-2025-12756 · WordPress · Aoa-Downloadable

Name of the Vulnerable Software and Affected Versions: aoa-downloadable WordPress plugin version 0.1.0 Description: The issue concerns the aoa-downloadable WordPress plugin, which fails to validate a parameter in its download function. This allows unauthenticated attackers to download arbitrary...

PT-2025-12806 · Glpi +1 · Glpi Inventory Plugin +1

Name of the Vulnerable Software and Affected Versions: GLPI Inventory Plugin versions prior to 1.5.0 Description: The GLPI Inventory Plugin handles various tasks for GLPI agents, including network discovery and inventory, software deployment, and data collection. It has an improper access control...

Ubuntu: Security Advisory (USN-7348-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 4090-1] ruby-rack security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4090-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk March 24, 2025 https://wiki.debian.org/LTS -...

GHSA-FC83-9JWQ-GC2M Web Push Denial of Service via malicious Web Push endpoint

Prior to version 0.10.3, the built-in clients of the web-push crate eagerly allocated memory based on the Content-Length header returned by the Web Push endpoint. Malicious Web Push endpoints could return a large Content-Length without ever having to send as much data, leading to denial of servic...