PT-2025-30733 · WordPress · Droip

Name of the Vulnerable Software and Affected Versions: Droip versions prior to 2.2.1 Description: The Droip plugin for WordPress is susceptible to arbitrary file uploads due to missing file type validation in the make google font offline function. This allows authenticated attackers with...

PT-2025-30779

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 6.16.0-rc3 and earlier Description A warning occurred when reconnecting a channel in the SMB2 protocol. Specifically, a dummy tcon was passed to smb2 reconnect with an uninitialized query interface, leading to an issue wh...

PT-2025-30814 · Jhipster · Jhipster

Name of the Vulnerable Software and Affected Versions: JHipster versions prior to 8.9.0 Description: JHipster versions prior to 8.9.0 are susceptible to privilege escalation through manipulation of the authorities parameter. After registering and logging in as a standard user, the authorities...

PT-2025-30882 · Silicon · Siwx91X

Name of the Vulnerable Software and Affected Versions: Silicon Labs SiWx91x versions prior to 3.4.0 Description: The APIs sl si91x aes, sl si91x gcm, sl si91x ccm, and sl si91x sha did not validate the size of the output buffer provided by the caller. This could result in data corruption on the...

PT-2025-30920 · Unknown · Food Review System

Name of the Vulnerable Software and Affected Versions: Food Review System version 1.0 Description: A critical issue exists due to SQL injection. The vulnerability is related to the processing of the /admin/approve reservation.php file. Manipulation of the occasion argument can lead to SQL...

PT-2025-30819 · WordPress · Apwide Golive Jira Plugin

Name of the Vulnerable Software and Affected Versions: Apwide Golive Jira plugin version 10.2.0 Description: The Apwide Golive Jira plugin contains a Server-Side Request Forgery SSRF issue. This issue is related to the test webhook function, which allows for potential exploitation through...

PT-2025-30729 · Chancms · Chancms

Name of the Vulnerable Software and Affected Versions: ChanCMS versions up to 3.1.2 Description: A critical issue exists in ChanCMS that allows for server-side request forgery. The getArticle function within the app/modules/api/service/gather.js file is susceptible to manipulation via the targetU...

PT-2025-30743

Name of the Vulnerable Software and Affected Versions Kron PAM versions prior to 3.7 Description Kron PAM is susceptible to a denial-of-service DoS attack due to unrestricted resource allocation. This allows an attacker to exhaust system resources via HTTP requests. Recommendations Update Kron PA...

PT-2025-30931 · Grav · Grav

Name of the Vulnerable Software and Affected Versions: grav versions 1.7.46 through 1.7.48 Description: A Cross Site Scripting issue exists in grav that allows an attacker to execute arbitrary code via the onerror attribute of the img element. Recommendations: Update grav to a version later than...

PT-2025-30728 · Chancms · Chancms

Name of the Vulnerable Software and Affected Versions: yanyutao0402 ChanCMS versions up to 3.1.2 Description: A path traversal issue exists in the delfile function of the app/extend/utils.js file. This issue may be exploited remotely. The exploit has been publicly disclosed. Recommendations:...

PT-2025-30937

Name of the Vulnerable Software and Affected Versions Linkify versions 4.3.1 through 4.3.2 Description The software contains an improperly controlled modification of object prototype attributes 'Prototype Pollution' issue. This can lead to cross-site scripting XSS attacks targeting HTML attribute...

NewStart CGSL MAIN 7.02 : binutils Vulnerability (NS-SA-2025-0113)

The remote NewStart CGSL host, running version MAIN 7.02, has binutils packages installed that are affected by a vulnerability: - A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemblebytes of the file binutils/objdump.c...

CVE-2025-22165

This Medium severity ACE Arbitrary Code Execution vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE Arbitrary Code Execution vulnerability, with a CVSS Score of 5.9, allows a locally authenticated attacker to execute arbitrary code which has high impact to...

CVE-2025-7949

A vulnerability was found in Sanluan PublicCMS up to 5.202506.a. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file publiccms-parent/publiccms/src/main/resources/templates/admin/cmsDiy/preview.html. The manipulation of the argument url lead...

PT-2025-30660 · WordPress · Get Youtube Subs

Name of the Vulnerable Software and Affected Versions: Get Youtube Subs plugin for WordPress versions up to and including 3.5 Description: The Get Youtube Subs plugin for WordPress is susceptible to Stored Cross-Site Scripting through the channel, layout, and subs count parameters. Insufficient...

PT-2025-30630 · Medtronic · Mycarelink Patient Monitor

Name of the Vulnerable Software and Affected Versions: Medtronic MyCareLink Patient Monitor models 24950 and 24952 before June 25, 2025 Description: The Medtronic MyCareLink Patient Monitor contains a built-in user account with no password. This allows an attacker with physical access to log in...

PT-2025-30640 · WordPress · The Security Ninja – Wordpress Security Plugin & Firewall

Name of the Vulnerable Software and Affected Versions: The Security Ninja – WordPress Security Plugin & Firewall versions prior to 5.243 Description: The Security Ninja – WordPress Security Plugin & Firewall plugin for WordPress is susceptible to an arbitrary file read issue. This allows...

PT-2025-30654 · WordPress · Affiliate Plus

Name of the Vulnerable Software and Affected Versions: Affiliate Plus plugin for WordPress versions up to and including 1.3.2 Description: The Affiliate Plus plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the affiplus settings pag...

PT-2025-30652 · WordPress · Funnelcockpit

Name of the Vulnerable Software and Affected Versions: FunnelCockpit plugin for WordPress versions up to and including 1.4.2 Description: The plugin is susceptible to Reflected Cross-Site Scripting via the error parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-30706 · Quiet · Quiet

Name of the Vulnerable Software and Affected Versions: Quiet versions 6.1.0-alpha.4 and below Description: Quiet’s API for backend/frontend communication used an insecure, not constant-time comparison function for token verification. This allowed for a potential timing attack where an attacker...