PT-2025-29568 · Unknown · Beiyuouo Arxiv-Daily

Name of the Vulnerable Software and Affected Versions: beiyuouo arxiv-daily versions through 2025-05-06 commit fad168770b0e68aef3e5acfa16bb2e7a7765d687 Description: A directory traversal vulnerability exists when parsing the topic.yml file in the generation logic within daily arxiv.py...

PT-2025-29573 · Dassault Systèmes · Solidworks Edrawings +1

Name of the Vulnerable Software and Affected Versions: SOLIDWORKS eDrawings versions prior to SOLIDWORKS Desktop 2025 Description: A use of uninitialized variable issue exists in the JT file reading procedure. This could allow an attacker to execute arbitrary code when opening a specially crafted...

PT-2025-29593 · Unknown · Scratch Channel

Name of the Vulnerable Software and Affected Versions: The Scratch Channel affected versions not specified Description: The application does not properly sanitize text box inputs in the /api/users.js file, potentially leading to cross-site scripting attacks. Recommendations: At the moment, there ...

PT-2025-29686

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.1.1551 Description Vim, an open-source command-line text editor, contains a path traversal issue within its zip.vim plugin. This issue allows overwriting of arbitrary files when opening specially crafted zip archives...

PT-2025-29643 · Oracle · Oracle Applications Framework +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.14 Description: A vulnerability exists within the Personalization component of the Oracle Applications Framework product of Oracle E-Business Suite. This issue is easily exploitable, allowi...

PT-2025-29656 · Oracle +1 · Mysql Server

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 9.0.0 through 9.3.0 Description: A vulnerability exists in the MySQL Server product of Oracle MySQL component: Server: Security: LDAP Auth. This difficult-to-exploit issue allows a high-privileged attacker with network...

PT-2025-29642 · Oracle +1 · Mysql Server

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 9.0.0 through 9.1.0 Description: A vulnerability exists in the Oracle MySQL Server component: Server: Optimizer. This issue allows a high-privileged attacker with network access via multiple protocols to compromise MySQL...

PT-2025-29550 · Unknown · Diskpulse Enterprise +1

Name of the Vulnerable Software and Affected Versions: Disk Pulse Enterprise version 9.0.34 Description: A stack-based buffer overflow exists in the login functionality. An attacker can send a specially crafted HTTP POST request to the /login endpoint with an overly long username parameter, causi...

PT-2025-29535

Name of the Vulnerable Software and Affected Versions Alone – Charity Multipurpose Non-profit WordPress Theme versions up to and including 7.8.3 Description The Alone – Charity Multipurpose Non-profit WordPress Theme is vulnerable to arbitrary file deletion due to insufficient file path validatio...

PT-2025-29545 · Wepresent · Wepresent Wipg-1000

Name of the Vulnerable Software and Affected Versions: WePresent WiPG-1000 versions prior to 2.2.3.0 Description: An unauthenticated command injection issue exists due to improper input handling in the /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a syst...

PT-2025-29561 · Ibm · Ibm Qradar Siem

Name of the Vulnerable Software and Affected Versions: IBM QRadar SIEM versions 7.5 through 7.5.0 UP12 IF02 Description: IBM QRadar SIEM is susceptible to a stored cross-site scripting issue. Authenticated users can embed arbitrary JavaScript code within the Web UI, potentially altering...

PT-2025-29549 · Winaxe · Winaxe Ftp Client

Name of the Vulnerable Software and Affected Versions: WinaXe FTP Client version 7.7 Description: A buffer overflow exists in the FTP banner parsing functionality within the WCMDPA10.dll component. When the client connects to a remote FTP server and receives an overly long '220 Server Ready'...

PT-2025-29565 · Nexxt Solutions · Nexxt Solutions Ncm-X1800 Mesh Router

Name of the Vulnerable Software and Affected Versions: Nexxt Solutions NCM-X1800 Mesh Router firmware versions prior to UV1.2.7 Description: Nexxt Solutions NCM-X1800 Mesh Router firmware contains an authenticated command injection issue in the firmware update feature. The /web/um fileName set.cg...

PT-2025-29536

Name of the Vulnerable Software and Affected Versions Alone – Charity Multipurpose Non-profit WordPress Theme versions 7.8.3 and earlier Description The Alone WordPress theme contains a critical vulnerability that allows unauthenticated attackers to upload malicious files, potentially leading to...

PT-2025-29618

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u451 and 8u451-perf Description An issue exists in the Oracle Java SE Install component that allows a low-privileged attacker with logon access to the infrastructure where Oracle Java SE executes to compromise the...

PT-2025-29576 · NetGear · Netgear Xr300

Name of the Vulnerable Software and Affected Versions: Netgear XR300 version 1.0.3.38 10.3.30 Description: A stack-based buffer overflow exists in the HTTPD service through the usb device.cgi endpoint when processing POST requests containing the usb folder parameter. Recommendations: Update to a...

PT-2025-29541 · Unknown · Crosseditor4

Name of the Vulnerable Software and Affected Versions: CrossEditor4 versions 4.0.0.01 through 4.6.0.23 Description: The improper default setting in the API modules of CrossEditor4 potentially allows Stored Cross-Site Scripting XSS. Stored XSS is a type of security issue where malicious scripts ar...

PT-2025-29685 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.18 GitHub Enterprise Server versions 3.14.15 GitHub Enterprise Server versions 3.15.10 GitHub Enterprise Server versions 3.16.6 GitHub Enterprise Server versions 3.17.3 Description: An incorrect...

CVE-2025-53640

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields such as ACLs could be misused to dump basic user details such ...

CVE-2025-53689

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...