PT-2025-29404 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU hardware to write to arbitrary physical memory pages. This could potentially corrup...

PT-2025-29528

Name of the Vulnerable Software and Affected Versions: Directus versions 9.0.0 through 11.8.99 Description: Directus is a real-time API and App dashboard for managing SQL database content. The exact Directus version number is exposed by the /server/specs/oas endpoint without authentication in...

PT-2025-29523 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 5.4.5 through 14.9 Description: XWiki Rendering, a system for converting textual input into different syntaxes, contains a flaw. Prior to version 14.10, the XHTML syntax relied on the xdom+xml/current syntax, enabling the...

PT-2025-29442 · Phpgurukul · Phpgurukul Dairy Farm Shop Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Dairy Farm Shop Management System version 1.3 Description: A critical issue exists in PHPGurukul Dairy Farm Shop Management System 1.3, specifically within the edit-company.php file. Manipulation of the companyname argument results...

PT-2025-29410 · Phpgurukul · Phpgurukul Online Fire Reporting System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Fire Reporting System version 1.2 Description: A critical vulnerability exists in PHPGurukul Online Fire Reporting System 1.2. The vulnerability is a SQL injection that can be exploited remotely through the manipulation of t...

PT-2025-29425 · Unknown · Zavy86 Wikidocs

Name of the Vulnerable Software and Affected Versions: Zavy86 WikiDocs versions through 1.0.77 Description: A critical issue exists in Zavy86 WikiDocs that allows for path traversal. The vulnerability is located in the image drop upload ajax/image delete ajax function within the submit.php file...

PT-2025-29476 · Snap7-Rs · Snap7-Rs

Name of the Vulnerable Software and Affected Versions: snap7-rs versions up to 1.142.1 Description: A critical issue exists in snap7-rs related to memory corruption. The pthread cond destroy function within the Public API component is affected. The exploit for this issue has been publicly...

PT-2025-29512

Name of the Vulnerable Software and Affected Versions: AIOHTTP versions prior to 3.12.14 Description: AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, contains an issue where the Python parser does not correctly parse trailer sections of an HTTP request. This can allo...

PT-2025-29500 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SemCms version 5.0 Description: SemCms version 5.0 contains a SQL injection vulnerability. The vulnerability is located in the lgid parameter at the SEMCMS Products.php file. Recommendations: As a temporary workaround, consider restricting...

CVE-2025-7552 Dromara Northstar Path AuthorizationInterceptor.java preHandle access control

A vulnerability was found in Dromara Northstar up to 7.3.5. It has been rated as critical. Affected by this issue is the function preHandle of the file northstar-main/src/main/java/org/dromara/northstar/web/interceptor/AuthorizationInterceptor.java of the component Path Handler. The manipulation ...

CVE-2025-7552

Dromara Northstar up to version 7.3.5 contains a vulnerability in the preHandle function of AuthorizationInterceptor.java (Path Handler) where the Request parameter can be manipulated to bypass access controls. The issue may be exploitable remotely and affects how unauthorized access to restricte...

PT-2025-29353 · Unknown · Modern Bag

Name of the Vulnerable Software and Affected Versions: Modern Bag version 1.0 Description: A critical issue exists in Modern Bag 1.0, allowing for SQL injection through manipulation of the namepro argument in the /admin/productadd back.php file. The attack can be initiated remotely. The exploit h...

PT-2025-29374 · Job Diary · Job Diary

Name of the Vulnerable Software and Affected Versions: Job Diary version 1.0 Description: A critical issue exists in Job Diary due to a SQL injection vulnerability. The vulnerability is located in the processing of the /view-details.php file. Manipulation of the job id argument can lead to SQL...

Apache Zeppelin exposes server resources to unauthenticated attackers

The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue by removin...

CVE-2024-41169

The CVE concerns Apache Zeppelin (versions 0.10.1–0.12.0) where an unauthenticated raft server protocol can expose server resources, including directories and files. Root cause details in connected data indicate the raft-enabled components allow unauthenticated access, enabling an attacker to vie...

CVE-2025-7464 osrg GoBGP rtr.go SplitRTR out-of-bounds

A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The...

CVE-2025-7462 Artifex GhostPDL New Output File Open Error gdevpdf.c pdf_ferror null pointer dereference

A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdfferror of the file devices/vector/gdevpdf.c of the component New Output File Open Error Handler. The manipulation leads to null pointer...

CVE-2025-7462 Artifex GhostPDL New Output File Open Error gdevpdf.c pdf_ferror null pointer dereference

A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdfferror of the file devices/vector/gdevpdf.c of the component New Output File Open Error Handler. The manipulation leads to null pointer...

LLM-Stackelberg Games: Conjectural Reasoning Equilibria and Their Applications to Spearphishing

We introduce the framework of LLM-Stackelberg games, a class of sequential decision-making models that integrate large language models LLMs into strategic interactions between a leader and a follower. Departing from classical Stackelberg assumptions of complete information and rational agents, ou...

PT-2025-29291 · Ivanti · Ivanti Policy Secure

Name of the Vulnerable Software and Affected Versions: Ivanti Policy Secure versions prior to 22.6R1 Description: A vulnerability exists where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web request. Recommendations: Update Ivanti Policy Secure to...