PT-2025-21658

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop versions prior to 3.15 Description: The issue affects Nextcloud Desktop, allowing 3rd party applications to create link shares for almost all data via the socket API. These shares can then be sent to an external service...

PT-2025-21690 · Themovation · Themovation Quickcal

Name of the Vulnerable Software and Affected Versions: Themovation QuickCal versions 1.0.0 through 1.0.15 Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For Themovation...

PT-2025-21710 · Romancode · Mapsvg

Name of the Vulnerable Software and Affected Versions: MapSVG versions n/a through 8.5.34 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', in RomanCode MapSVG, allowing Code Injection. Recommendations: For versions n/a through 8.5.34,...

PT-2025-21726 · WordPress · Steve Puddick Wp Notes Widget

Name of the Vulnerable Software and Affected Versions: Steve Puddick WP Notes Widget versions 1.0.0 through 1.0.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an...

PT-2025-21651

Name of the Vulnerable Software and Affected Versions Qt versions prior to 5.15.19 Qt versions 6.0.0 through 6.5.8 Qt versions 6.6.0 through 6.8.1 Description An improper link resolution issue exists in QFileSystemEngine within the Qt corelib module on Windows. This flaw arises from the use of th...

PT-2025-21687 · Lambertgroup · Lambertgroup Sticky Html5 Music Player

Name of the Vulnerable Software and Affected Versions: LambertGroup Sticky HTML5 Music Player versions 3.1.6 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

PT-2025-21637 · Syncpilot · Live Contract

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A path traversal vulnerability in the file download functionality allows unauthenticated users to download arbitrary files, in the context of the application server, from the Linux server...

PT-2025-21692 · WordPress · Lambertgroup Radio Player Shoutcast & Icecast Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: LambertGroup Radio Player Shoutcast & Icecast WordPress Plugin versions through 4.4.6 Description: The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command. This...

PT-2025-21706 · WordPress · Valvepress Wordpress Auto Spinner

Name of the Vulnerable Software and Affected Versions: ValvePress Wordpress Auto Spinner versions 3.25.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

PT-2025-21749 · Unknown · Phpgurukul Online Course Registration System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Course Registration version 3.1 Description: A critical issue has been found in the software, affecting an unknown functionality of the file /news.php. The manipulation of the newstitle argument leads to SQL injection. This...

PT-2025-21735 · Unknown · Berthaai Bertha Ai

Name of the Vulnerable Software and Affected Versions: berthaai BERTHA AI versions 1.12.11 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For versions...

PT-2025-21683 · Unknown · Lambertgroup Multimedia Responsive Carousel With Image Video Audio Support

Name of the Vulnerable Software and Affected Versions: LambertGroup Multimedia Responsive Carousel with Image Video Audio Support versions through 2.6.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command...

PT-2025-21618 · Hitachi · Hitachi Ops Center Analyzer

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Analyzer versions 10.0.0-00 through 11.0.4-00 Description: The issue is related to a Missing Authorization vulnerability in the Hitachi Ops Center Analyzer detail view component. This vulnerability affects the specified...

CVE-2025-4727

A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file packages/ddp-server/livedataserver.js. The manipulation of the argument forwardedFor leads to inefficient regular expression complexity. The attack may be...

CVE-2025-4727 Meteor livedata_server.js Object.assign redos

A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file packages/ddp-server/livedataserver.js. The manipulation of the argument forwardedFor leads to inefficient regular expression complexity. The attack may be...

Security Bulletin: Astronomer with IBM is vulnerable to arbitrary code execution due to the LangChain package (CVE-2023-38896).

Summary LangChain is used by Astronomer with IBM as part of LLM processing. Vulnerability Details CVEID:CVE-2023-38896 DESCRIPTION: LangChain could allow a remote attacker to execute arbitrary code on the system, caused by improper neutralization of user supplied-input by the frommathprompt and...

CVE-2025-47287

Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs,...

Security Bulletin: Vulnerability in commons-compress affects IBM Integrated Analytics System (Sailfish) [CVE-2024-25710, CVE-2024-26308]

Summary The commons-compress package is used by IBM Integrated Analytics System . IBM Integrated Analytics System has addressed the applicable CVECVE-2024-25710, CVE-2024-26308. Vulnerability Details CVEID:CVE-2024-25710 DESCRIPTION: Loop with Unreachable Exit Condition 'Infinite Loop'...

CVE-2025-27696

Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue...

PT-2025-21383 · WordPress · The Illi Link Party!

Name of the Vulnerable Software and Affected Versions: The illi Link Party! WordPress plugin version 1.0 Description: The issue allows unauthenticated visitors to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape some parameters. Recommendations: For The illi...