PT-2025-9136 · Minio · Minio

Name of the Vulnerable Software and Affected Versions: MinIO versions RELEASE.2024-06-06T09-36-42Z through RELEASE.2025-02-28T09-55-16Z Description: A bug in MinIO's evaluation of the trust of the SSH key used in an SFTP connection allows authentication bypass and unauthorized data access. This...

PT-2025-9102 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: OpenCart versions prior to 4.1.0 Description: The issue allows an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in "/account/login" API endpoint. This could potentially lead to...

PT-2025-9105 · Soteshop · Soteshop

Name of the Vulnerable Software and Affected Versions: Soteshop versions prior to 8.3.4 Description: A Cross-Site Scripting XSS issue exists, allowing remote attackers to execute arbitrary code via the query parameter in "/app-google-custom-search/searchResults". This can lead to the theft of...

PT-2025-9053 · WordPress · Comboblocks

Name of the Vulnerable Software and Affected Versions: The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress versions prior to 2.3.7 Description: The issue allows unauthenticated attackers to extract sensitive data, including emails and other user data, via the...

PT-2025-9101 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: OpenCart versions prior to 4.1.0 Description: The issue allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL using the search in the "/product/search" endpoint. This could be exploited to steal...

Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API

Impact An unauthenticated stack overflow crash, leading to a denial of service DoS, was identified in Rancher’s /v3-public/authproviders public API endpoint. A malicious user could submit data to the API which would cause the Rancher server to crash, but no malicious or incorrect data would...

PT-2025-9035 · Infoblox · Infoblox Nios

Name of the Vulnerable Software and Affected Versions: Infoblox NIOS versions prior to 8.6.5 Description: The issue is related to improper authentication for Grids, which could potentially allow unauthorized access. Recommendations: For versions prior to 8.6.5, update to version 8.6.5 or later to...

PT-2025-9027 · Xiq-Se · Xiq-Se

Name of the Vulnerable Software and Affected Versions: XIQ-SE versions prior to 24.2.11 Description: A low-privileged user may be able to access admin passwords, which could lead to privilege escalation. Recommendations: For versions prior to 24.2.11, update to version 24.2.11 or later to resolve...

PT-2025-8796 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been identified, specifically in the powerpc/pseries/iommu component. The issue arises when a user attempts to use the same vfio container used ...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in python-jose

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of python-jose. Vulnerability Details CVEID:CVE-2024-33664 DESCRIPTION: python-jose is vulnerable to a denial of service, caused by a flaw in the decode function. By sending a specially crafted JSON Web Encryption JWE token...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in python-jose

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of python-jose Vulnerability Details CVEID:CVE-2024-33663 DESCRIPTION: python-jose could allow a remote attacker to bypass security restrictions, caused by a flaw when the algorithm field is left unspecified when calling...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in jsonata-js JSONata

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of jsonata-js JSONata. Vulnerability Details CVEID:CVE-2024-27307 DESCRIPTION: jsonata-js JSONata could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in the JSONata...

CVE-2022-49255

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix missing free nid in f2fshandlefailedinode This patch fixes xfstests/generic/475 failure. 293.680694 F2FS-fs dm-1: May loss orphan inode, run fsck to fix. 293.685358 Buffer I/O error on dev dm-1, logical block 8388592,...

PT-2025-8670 · WordPress · Woocommerce Cart Count Shortcode

Name of the Vulnerable Software and Affected Versions: WooCommerce Cart Count Shortcode WordPress plugin versions prior to 1.1.0 Description: The issue concerns the lack of validation and escaping of certain shortcode attributes, which could allow users with the contributor role and above to...

PT-2025-7951 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.15.0-12267-gdebe436e77c7 Description: The issue is related to the powerpc/kasan component of the Linux kernel, where the shadow's page table is not updated correctly when PTE RPN SHIFT is 24 and PAGE SHIFT is...

PT-2025-21185

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 128.10.1 Thunderbird versions prior to 138.0.1 Description: The issue allows sender spoofing if the server permits an invalid From address. For example, if the From header contains an invalid value, Thunderbird...

PT-2025-8667 · WordPress · Suremembers

Name of the Vulnerable Software and Affected Versions: SureMembers plugin for WordPress versions up to and including 1.10.6 Description: The issue allows unauthenticated attackers to extract sensitive data, including restricted content, via the REST API. Recommendations: For versions up to and...

PT-2025-8329 · Linux +6 · Linux Kernel +6

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.18.0+ Description: The issue is related to an out-of-bounds read in LDT setup. The syscall stub data function expects the data count parameter to be the number of longs, not bytes. This can lead to a...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to improper privilege management due to Apache Kafka Client(CVE-2024-31141)

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to improper privilege management, allowing external parties access to files or directories due to Apache Kafka Client. Vulnerability Details CVEID:CVE-2024-31141 DESCRIPTION: Files or Directories Accessible to...

CVE-2024-11955 GLPI index.php redirect

A vulnerability was found in GLPI up to 10.0.17. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument redirect leads to open redirect. The attack can be launched remotely. The exploit has been...