PT-2025-25416 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: The issue is related to hardcoded credentials for the Service Account. Recommendations: For OpenC3 COSMOS version 6.0.0, consider changing the hardcoded credentials for the Service Account to unique,...

PT-2025-25411 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: A cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter. Recommendations: For OpenC3 COSMOS version...

PT-2025-25378 · WordPress · Wp2Html

Name of the Vulnerable Software and Affected Versions: WP2HTML plugin for WordPress versions prior to 1.0.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save function. This allows unauthenticated attackers to update plugin...

PT-2025-25423 · Unknown · Cookies Consent Management

Name of the Vulnerable Software and Affected Versions: COOKiES Consent Management versions 0.0.0 through 1.2.14 Description: The issue affects the COOKiES Consent Management module, allowing for Cross-Site Scripting XSS due to improper neutralization of input during web page generation...

PT-2025-25444 · Unknown · Conda-Forge-Ci-Setup

Name of the Vulnerable Software and Affected Versions: conda-forge-ci-setup versions prior to 4.15.0 Description: The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An...

PT-2025-25418 · Tenable · Tenable Agent

Name of the Vulnerable Software and Affected Versions: Tenable Agent versions prior to 10.8.5 Description: A non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege on a Windows host. Recommendations: For Tenable Agent versions prior to 10.8.5,...

PT-2025-27961 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.15.0-rc1 Description: A vulnerability in the Linux kernel has been resolved, related to the bnxt en driver. The issue arises from the double invocation of bnxt ulp stop and bnxt ulp start functions, which can...

CVE-2025-47849

A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role type in the same domain. This operation is not appropriately restricted and...

CVE-2025-22829

The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for...

PT-2025-25310

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious JavaScript code into the Transform Function which will...

PT-2025-25349 · Aveva · Aveva Pi Web Api

Name of the Vulnerable Software and Affected Versions: AVEVA PI Web API versions 2023 SP1 and prior Description: A cross-site scripting issue exists that could allow an authenticated attacker with privileges to create or update annotations, or upload media files, to persist arbitrary JavaScript...

PT-2025-25328

Name of the Vulnerable Software and Affected Versions go-pg pg version 10.13.0 Description A SQL injection issue was discovered in the component /types/append value.go. This allows for potential SQL injection attacks. Recommendations For go-pg pg version 10.13.0, consider restricting access to th...

PT-2025-25351 · Aveva · Aveva Pi Connector For Cygnet

Name of the Vulnerable Software and Affected Versions: AVEVA PI Connector for CygNet versions 1.6.14 and prior Description: An improper validation of integrity check value issue exists that, if exploited, could allow a miscreant with elevated privileges to modify local data files in a way that...

PT-2025-25322 · Sick Ag · Sick Field Analytics

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A service supports the use of a deprecated and unsafe TLS version. This could be exploited to expose sensitive information, modify data in unexpected ways or spoof identities of other users ...

PT-2025-25275 · Unknown · Kicode111 Like-Girl

Name of the Vulnerable Software and Affected Versions: kiCode111 like-girl version 5.2.0 Description: A critical vulnerability was found in the kiCode111 like-girl software, affecting unknown code in the /admin/aboutPost.php file. The manipulation of the argument...

PT-2025-25330 · Unknown · Pg-Promise

Name of the Vulnerable Software and Affected Versions: pg-promise versions prior to 11.5.5 Description: The issue is related to SQL Injection due to improper handling of negative numbers. Recommendations: For versions prior to 11.5.5, update to version 11.5.5 or later to resolve the issue...

PT-2025-25341 · Vantage6 · Vantage6

Name of the Vulnerable Software and Affected Versions: vantage6 versions prior to 4.11 Description: The issue concerns an open-source framework designed for privacy-enhancing technologies such as Federated Learning and Multi-Party Computation. If an attacker gains access to an authenticated...

PT-2025-25343 · Vantage6 · Vantage6

Name of the Vulnerable Software and Affected Versions: vantage6 versions prior to 4.11.0 Description: The vantage6 server has a predictable JWT secret key generation issue. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This issue...

PT-2025-25337 · Euroinformation · Euroinformation Moneticopaiement

Name of the Vulnerable Software and Affected Versions: EuroInformation MoneticoPaiement module for PrestaShop version 1.1.1 and earlier Description: The issue allows remote attackers to execute arbitrary SQL commands via the TPE, societe, MAC, reference, or aliascb parameter to "transaction.php",...

PT-2025-25297 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns an information disclosure in the Apache HTTP Server. No specific details about the estimated number of potentially affected devices worldwide or real-world...