PT-2025-26472 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.06B01 Description: A critical issue affects the function formSetEmail of the file /goform/formSetEmail. The manipulation of the argument curTime/config.smtp email subject leads to stack-based buffer overflow. The...

PT-2025-26391 · Unknown · Anant Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Anant Addons for Elementor versions 1.2.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: F...

PT-2025-26351 · Joe Hoyle · Wpthumb

Name of the Vulnerable Software and Affected Versions: Joe Hoyle WPThumb versions 0.10 and earlier Description: A Server-Side Request Forgery SSRF issue affects Joe Hoyle WPThumb, allowing for Server Side Request Forgery. Recommendations: For Joe Hoyle WPThumb versions 0.10 and earlier, update to...

CVE-2025-6283

A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the file apps/dbagent/src/app/api/evals/route.ts. The manipulation of the argument passed leads to path traversal. Upgrading to version 0.3.1 is able to address this...

CVE-2025-6283

The CVE-2025-6283 entry concerns xataio Xata Agent up to version 0.3.0. A path traversal flaw in the GET handler of apps/dbagent/src/app/api/evals/route.ts arises from argument manipulation. Upgrading to version 0.3.1 mitigates the issue; the patch is named 03f27055e0cf5d4fa7e874d34ce8c74c7b9086c...

CVE-2025-6283 xataio Xata Agent route.ts GET path traversal

A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the file apps/dbagent/src/app/api/evals/route.ts. The manipulation of the argument passed leads to path traversal. Upgrading to version 0.3.1 is able to address this...

CVE-2025-32896

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

CVE-2025-32896 Apache SeaTunnel: Unauthenticated insecure access

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

CVE-2025-31698

ACL configured in ipallow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting proxy.config.acl.subjects to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol. This issue affects...

CVE-2025-49763 Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin

ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin --max-inclusion-depth to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5,...

CVE-2025-49763 Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin

ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin --max-inclusion-depth to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5,...

CVE-2025-49763

CVE-2025-49763 affects Apache Traffic Server via the ESI plugin. The vulnerability arises when ESI requests stack with no limit on inclusion depth, allowing memory exhaustion and potential DoS on ATS nodes. Affected versions are ATS 10.0.0–10.0.5 and 9.0.0–9.2.10. Remediation is to upgrade to 9.2...

[SECURITY] [DSA 5944-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5944-1 [email protected] https://www.debian.org/security/ Andres Salomon June 18, 2025 https://www.debian.org/security/faq -...

CVE-2024-45208

The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange High Availability HA information using a shared password. Affected versions of Versa Director bound to these ports o...

CVE-2025-23171

The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload permissions. The UI appears not to allow file uploads but uploads still succeed. In addition, the Versa Director discloses the full filenam...

PT-2025-26566 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R version 1.1.1-B20200824.0128 Description: A critical issue affects the function formRoute of the file /boafrm/formRoute. The manipulation of the argument subnet leads to a stack-based buffer overflow. This issue can be exploit...

PT-2025-26231 · Powsybl · Powsybl

Name of the Vulnerable Software and Affected Versions: PowSyBl versions prior to 6.7.2 Description: The issue concerns an XML external entity XXE attack and a server-side request forgery SSRF attack in certain places of powsybl-core XML parsing. This allows an attacker to elevate their privileges...

PT-2025-26255 · Powsybl · Powsybl

Name of the Vulnerable Software and Affected Versions: PowSyBl versions prior to 6.7.2 Description: The issue is a potential polynomial Regular Expression Denial of Service ReDoS vulnerability in the PowSyBl's DataSource mechanism. This vulnerability can be exploited when the listNamesString rege...

PT-2025-26242 · Upsonic · Upsonic

Name of the Vulnerable Software and Affected Versions: Upsonic versions up to 0.55.6 Description: A critical issue has been found in Upsonic, affecting the cloudpickle.loads function of the file /tools/add tool within the Pickle Handler component. The manipulation leads to deserialization. The...

PT-2025-26241 · Ubiquiti · Unifi Network Application

Name of the Vulnerable Software and Affected Versions: UniFi Network versions 9.1.120 and earlier Description: A misconfigured query in UniFi Network could allow users to authenticate to Enterprise WiFi or VPN Server l2tp and OpenVPN using a device’s MAC address from 802.1X or MAC Authentication,...