PT-2025-26923 · WordPress · Responsive Food/Drink Menu

Name of the Vulnerable Software and Affected Versions: The Responsive Food and Drink Menu plugin for WordPress versions up to, and including, 2.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's display pdf menus shortcode due to insufficient input sanitization an...

PT-2025-26934 · Snyk · Snyk Cli

Name of the Vulnerable Software and Affected Versions: snyk versions prior to 1.1297.3 Description: The issue allows for the insertion of sensitive information into log files through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line...

PT-2025-26924 · WordPress · Wp-Photonav

Name of the Vulnerable Software and Affected Versions: WP-PhotoNav plugin for WordPress versions up to, and including, 1.2.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's photonav shortcode due to insufficient input sanitization and output escaping on...

PT-2025-26920 · WordPress · Vg Wort Metis

Name of the Vulnerable Software and Affected Versions: VG WORT METIS plugin for WordPress versions prior to 2.0.0 Description: The issue is related to unauthorized modification of data due to a missing capability check on the gutenberg save post function. This allows authenticated attackers with...

PT-2016-7979 · Debian · Pdns

Name of the Vulnerable Software and Affected Versions: pdns versions prior to 3.3.1-1 Description: The issue arises from the pdns package in Debian, where the MySQL user is created with excessive privileges. Specifically, the maintainer scripts of pdns-backend-mysql grant too wide database...

PT-2025-27002 · Github · Octo-Sts

Name of the Vulnerable Software and Affected Versions: Octo-STS versions prior to v0.5.3 Description: Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. The issue allows for unauthenticated Server-Side Request Forgery SSRF by abusing fields in OpenID Connect...

PT-2025-27010

Name of the Vulnerable Software and Affected Versions: n8n versions prior to 1.98.0 Description: The issue is an Open Redirect vulnerability in the login flow, affecting authenticated users who can be redirected to untrusted domains after logging in. This is achieved by crafting malicious URLs wi...

PT-2025-26978

Name of the Vulnerable Software and Affected Versions: File Browser versions prior to 2.33.7 Description: The Markdown preview function of File Browser is vulnerable to Stored Cross-Site-Scripting XSS. Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the...

PT-2025-27005

Name of the Vulnerable Software and Affected Versions: Himmelblau versions 0.9.10 through 0.9.16 Description: A vulnerability in Himmelblau allows a user to authenticate to a Linux host using an invalid Linux Hello PIN when the host is offline. This issue arises from an incorrect assumption in th...

PT-2025-26969 · Oracle +1 · Java +1

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.11 Description: The issue concerns a feature in Java where certain characters are converted to their uppercase equivalents, potentially allowing a threat actor to craft a message that exploits this character...

PT-2025-26929 · WordPress · Homerunner

Name of the Vulnerable Software and Affected Versions: Homerunner plugin for WordPress versions prior to 1.0.30 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the main settings function. This allows unauthenticated attackers to upda...

PT-2025-27021

Name of the Vulnerable Software and Affected Versions: UTT HiPER 840G versions up to 3.1.1-190328 Description: A critical issue affects the function sub 484E40 of the file /goform/formP2PLimitConfig of the component API. The manipulation of the argument except leads to buffer overflow. The attack...

PT-2025-26918 · WordPress · Image Editor By Pixo

Name of the Vulnerable Software and Affected Versions: The Image Editor by Pixo plugin for WordPress versions up to, and including, 2.3.6 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attacker...

PT-2025-26991

Name of the Vulnerable Software and Affected Versions: Beward N100 IP Camera version M2.1.6.04C014 Description: An authenticated command injection issue exists via the ServerName and TimeZone parameters in the "servetest" CGI page. An attacker with web interface access can inject arbitrary system...

PT-2025-26987 · Unknown · Phpgurukul Pre-School Enrollment System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Pre-School Enrollment System Project version 1.0 Description: The issue concerns a Directory Traversal vulnerability in the manage-classes.php file. Recommendations: For PHPGurukul Pre-School Enrollment System Project version 1.0,...

CVE-2025-6669 gooaclok819 sublinkX jwt.go hard-coded key

A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file middlewares/jwt.go. The manipulation with the input sublink leads to use of hard-coded cryptographic key . The attack can be initiated remotely. Th...

CVE-2025-52479 HTTP.jl vulnerable to CR/LF Injection in URIs

HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers URIs. URIs.jl prior to version 1.6.0 and HTTP.jl prior to version 1.10.17 allows the construction of URIs containing CR/LF characters. If user input was not otherwise...

PT-2025-26807 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue allows a remote attacker to send specially crafted SQL statements, which could enable the attacker to view, add, modify, or delete information in the back-end database. Thi...

PT-2025-26856 · Microsens · Microsens Nmp Web+

Name of the Vulnerable Software and Affected Versions: MICROSENS NMP Web+ affected versions not specified Description: The issue concerns JSON Web Tokens JWT that do not expire in MICROSENS NMP Web+, potentially allowing an attacker to gain access to the system. Recommendations: At the moment,...

PT-2025-26858 · Unknown · Registrator

Name of the Vulnerable Software and Affected Versions: Registrator versions prior to 1.9.5 Description: The issue concerns a GitHub app that automates creation of registration pull requests for julia packages. If the clone URL returned by GitHub is malicious, an argument injection is possible in...