PT-2025-29512

Name of the Vulnerable Software and Affected Versions: AIOHTTP versions prior to 3.12.14 Description: AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, contains an issue where the Python parser does not correctly parse trailer sections of an HTTP request. This can allo...

PT-2025-29425 · Unknown · Zavy86 Wikidocs

Name of the Vulnerable Software and Affected Versions: Zavy86 WikiDocs versions through 1.0.77 Description: A critical issue exists in Zavy86 WikiDocs that allows for path traversal. The vulnerability is located in the image drop upload ajax/image delete ajax function within the submit.php file...

PT-2025-29528 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions 9.0.0 through 11.8.99 Description: Directus is a real-time API and App dashboard for managing SQL database content. The exact Directus version number is exposed by the /server/specs/oas endpoint without authentication in...

PT-2025-29523 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 5.4.5 through 14.9 Description: XWiki Rendering, a system for converting textual input into different syntaxes, contains a flaw. Prior to version 14.10, the XHTML syntax relied on the xdom+xml/current syntax, enabling the...

PT-2025-29476 · Snap7-Rs · Snap7-Rs

Name of the Vulnerable Software and Affected Versions: snap7-rs versions up to 1.142.1 Description: A critical issue exists in snap7-rs related to memory corruption. The pthread cond destroy function within the Public API component is affected. The exploit for this issue has been publicly...

PT-2025-29442 · Phpgurukul · Phpgurukul Dairy Farm Shop Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Dairy Farm Shop Management System version 1.3 Description: A critical issue exists in PHPGurukul Dairy Farm Shop Management System 1.3, specifically within the edit-company.php file. Manipulation of the companyname argument results...

CVE-2025-7552 Dromara Northstar Path AuthorizationInterceptor.java preHandle access control

A vulnerability was found in Dromara Northstar up to 7.3.5. It has been rated as critical. Affected by this issue is the function preHandle of the file northstar-main/src/main/java/org/dromara/northstar/web/interceptor/AuthorizationInterceptor.java of the component Path Handler. The manipulation ...

CVE-2025-7552

Dromara Northstar up to version 7.3.5 contains a vulnerability in the preHandle function of AuthorizationInterceptor.java (Path Handler) where the Request parameter can be manipulated to bypass access controls. The issue may be exploitable remotely and affects how unauthorized access to restricte...

PT-2025-29374 · Job Diary · Job Diary

Name of the Vulnerable Software and Affected Versions: Job Diary version 1.0 Description: A critical issue exists in Job Diary due to a SQL injection vulnerability. The vulnerability is located in the processing of the /view-details.php file. Manipulation of the job id argument can lead to SQL...

PT-2025-29353 · Unknown · Modern Bag

Name of the Vulnerable Software and Affected Versions: Modern Bag version 1.0 Description: A critical issue exists in Modern Bag 1.0, allowing for SQL injection through manipulation of the namepro argument in the /admin/productadd back.php file. The attack can be initiated remotely. The exploit h...

Apache Zeppelin exposes server resources to unauthenticated attackers

The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue by removin...

CVE-2024-41169

The CVE concerns Apache Zeppelin (versions 0.10.1–0.12.0) where an unauthenticated raft server protocol can expose server resources, including directories and files. Root cause details in connected data indicate the raft-enabled components allow unauthenticated access, enabling an attacker to vie...

CVE-2025-7464 osrg GoBGP rtr.go SplitRTR out-of-bounds

A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The...

CVE-2025-7462 Artifex GhostPDL New Output File Open Error gdevpdf.c pdf_ferror null pointer dereference

A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdfferror of the file devices/vector/gdevpdf.c of the component New Output File Open Error Handler. The manipulation leads to null pointer...

CVE-2025-7462 Artifex GhostPDL New Output File Open Error gdevpdf.c pdf_ferror null pointer dereference

A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdfferror of the file devices/vector/gdevpdf.c of the component New Output File Open Error Handler. The manipulation leads to null pointer...

LLM-Stackelberg Games: Conjectural Reasoning Equilibria and Their Applications to Spearphishing

We introduce the framework of LLM-Stackelberg games, a class of sequential decision-making models that integrate large language models LLMs into strategic interactions between a leader and a follower. Departing from classical Stackelberg assumptions of complete information and rational agents, ou...

PT-2025-29335 · Phpgurukul · Phpgurukul Vehicle Parking Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Vehicle Parking Management System version 1.13 Description: A critical issue exists in PHPGurukul Vehicle Parking Management System version 1.13 related to SQL injection. The vulnerability is located in the processing of the...

PT-2025-29332 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.10.1 through 0.12.0 Description: An attacker can utilize the raft server protocol without authentication, enabling access to server resources, including directories and files. Recommendations: Upgrade to version...

PT-2025-29291 · Ivanti · Ivanti Policy Secure

Name of the Vulnerable Software and Affected Versions: Ivanti Policy Secure versions prior to 22.6R1 Description: A vulnerability exists where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web request. Recommendations: Update Ivanti Policy Secure to...

PT-2025-29313 · WordPress · Friends Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Friends plugin for WordPress version 3.5.1 Description: The Friends plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input of the query vars parameter. This allows authenticated attackers with...