PT-2025-31855 · Unknown · Givanz Vvveb

Name of the Vulnerable Software and Affected Versions: givanz Vvveb versions up to 1.0.5 Description: A cross-site scripting issue exists due to unknown processing of the file /vadmin123/index.php?module=settings/post-types within the Add Type Handler component. The attack can be initiated...

Amazon Linux 2 : thunderbird (ALAS-2025-2949)

The version of thunderbird installed on the remote host is prior to 128.11.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2949 advisory. There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of...

PT-2025-31887 · Russh · Russh

Name of the Vulnerable Software and Affected Versions: Russh versions 0.54.0 and earlier Description: Russh is a Rust SSH client & server library. The implementation of the SSH protocol's channel window adjust message does not properly validate the incoming value, leading to a potential integer...

Debian dla-4263 : ruby-graphql - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4263 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-4263-1 [email protected] https://www.debian.org/lts/security/...

CVE-2025-50460

A remote code execution RCE vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using yaml.load from the PyYAML library versions = 5.3.1. If an attacker can control the content of the YAML configuration file passed to the --runconfig parameter,...

CVE-2024-52279

Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue...

CVE-2024-41177

Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin. This issue affects Apache Zeppelin: before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue...

CVE-2024-51775

CVE-2024-51775 describes a Missing Origin Validation in WebSockets vulnerability affecting Apache Zeppelin (versions 0.11.1 up to, but not including, 0.12.0). The issue allows a client from another origin to connect to Zeppelin’s WebSocket server and access internal information about paragraphs, ...

CVE-2024-51775 Apache Zeppelin: Command Injection via CSWSH

Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended...

CVE-2024-52279

CVE-2024-52279 affects Apache Zeppelin (0.11.1 before 0.12.0). The issue is an improper input validation in the JDBC URL handling that did not account for URL-encoded input, enabling an attack via a malicious JDBC connection string and potentially leading to arbitrary file read. The evidence link...

CVE-2025-8345

A vulnerability classified as critical was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. Affected by this vulnerability is the function deleteuser of the file crm/WeiXinApp/yunzhijia/yunzhijiaApi.php. The manipulation of the argument function leads to sql injection...

PT-2025-31708

Name of the Vulnerable Software and Affected Versions Files versions 0.16.9 and below Description The File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, potentially leading to Browser JS code execution in the context of the user’s session...

PT-2025-31701 · Cursor · Cursor

Name of the Vulnerable Software and Affected Versions: Cursor versions 1.17 through 1.2 Description: Cursor is a code editor built for programming with AI. A UI information disclosure exists in Cursor's MCP Model Context Protocol deeplink handler, enabling attackers to execute arbitrary system...

PT-2025-31703 · 1Panel · 1Panel

Name of the Vulnerable Software and Affected Versions: 1Panel versions 2.0.5 and below Description: 1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. The HTTPS protocol used for communication between the Core and Agent...

PT-2025-31603 · WordPress · Youtube +8

Name of the Vulnerable Software and Affected Versions: Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress versions prior to 26.1.0 Description: The WordPress plugin is susceptib...

PT-2025-31710

Name of the Vulnerable Software and Affected Versions Copyparty versions prior to 1.18.9 Description Copyparty is a portable file server. The filter parameter for the "Recent Uploads" page allows arbitrary Regular Expressions RegExes. If this feature is enabled by default, an attacker can craft a...

PT-2025-31698

Name of the Vulnerable Software and Affected Versions LibTIFF versions through 4.7.0 Description A vulnerability exists in LibTIFF due to a null pointer dereference in the t2p read tiff init function within the tools/tiff2pdf.c file of the fax2ps component. Exploitation requires local access and ...

PT-2025-31604 · Elementor +1 · Elementor +1

Name of the Vulnerable Software and Affected Versions: Stratum – Elementor Widgets versions up to and including 1.6.0 Description: The Stratum – Elementor Widgets plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Advanced Google Maps and Image Hotspot widgets...

PT-2025-31709

Name of the Vulnerable Software and Affected Versions Files versions 0.16.9 and below Description Files, a module for managing files inside spaces and user profiles, lacks logic to prevent the exploitation of backend SQL queries without direct output. This could potentially allow unauthorized dat...

PT-2025-31706 · Microsoft · Himmelblau +2

Name of the Vulnerable Software and Affected Versions: Himmelblau version 1.0.0 versions prior to 1.1.0 Description: Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. When debugging is enabled for Himmelblau, the himmelblaud tasks service leaks an Intune service...