PT-2025-16163 · Apache · Apache Roller

Name of the Vulnerable Software and Affected Versions: Apache Roller versions prior to 6.1.5 Description: A session management vulnerability exists in Apache Roller where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the use...

PT-2025-15957 · Toast Plugins · Toast Plugins Internal Link Optimiser

Name of the Vulnerable Software and Affected Versions: Toast Plugins Internal Link Optimiser versions 5.1.2 and earlier Description: The issue is related to a Missing Authorization vulnerability in Toast Plugins Internal Link Optimiser, which allows exploiting incorrectly configured access contro...

PT-2025-15978 · Msi · Msi Center

Name of the Vulnerable Software and Affected Versions: MSI Center versions prior to 2.0.52.0 Description: The issue concerns missing PE signature validation. Recommendations: For versions prior to 2.0.52.0, update to version 2.0.52.0 or later to resolve the issue...

PT-2025-15923 · WordPress · Embedder

Name of the Vulnerable Software and Affected Versions: Embedder plugin for WordPress versions 1.3 to 1.3.5 Description: The issue allows unauthorized modification of data, leading to privilege escalation due to a missing capability check on the ajax set global option function. This enables...

PT-2025-15960 · Detheme · Dethemekit For Elementor

Name of the Vulnerable Software and Affected Versions: DethemeKit for Elementor versions n/d through 2.1.10 Description: The issue is related to a lack of authorization in Detheme DethemeKit for Elementor. This problem affects DethemeKit for Elementor from an unspecified start version up to versi...

PT-2025-15937 · Brizy · Brizy

Name of the Vulnerable Software and Affected Versions: Brizy versions n/a through 2.6.14 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for the injection of malicious scripts into web pages. No...

PT-2025-15980 · Silverstripe · Silverstripe Elemental

Name of the Vulnerable Software and Affected Versions: Silverstripe Elemental versions prior to 5.3.12 Description: The issue arises from the failure to cast input prior to including it in the grid field, allowing an elemental block to include an XSS payload. This payload can be executed when...

[SECURITY] [DSA 5898-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5898-1 [email protected] https://www.debian.org/security/ Andres Salomon April 09, 2025 https://www.debian.org/security/faq -...

CVE-2025-27391 Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log

Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: fro...

wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities

Impact wallabag versions prior to 2.6.11 were discovered to contain multiple Cross-Site Request Forgery CSRF vulnerabilities across several endpoints. An attacker could craft a malicious link or page that, if visited by a logged-in wallabag user, could trick the user's browser into performing...

CVE-2025-30677

Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs. This vulnerability can lead to unintended...

CVE-2025-31672 Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

CVE-2025-31672 Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

CVE-2017-20197

A vulnerability was found in propanetank Roommate-Bill-Tracking up to 288437f658fc9ee7d4b92a9da12557024d8bc55c. It has been declared as critical. This vulnerability affects unknown code of the file /includes/login.php. The manipulation of the argument Username leads to sql injection. The attack c...

CVE-2017-20197

CVE-2017-20197 affects propanetank Roommate-Bill-Tracking; vulnerable component is unknown code in /includes/login.php where manipulating the Username parameter leads to SQL injection. Attack can be remotely initiated. Patch name: b32bb1b940f82d38fb9310cd66ebe349e20a1d0a. Remediation: apply the p...

PT-2025-15844 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Junos OS versions 23.1R1 through 23.2R2-S3 Junos OS versions 23.4 through 23.4R2-S3 Junos OS versions 24.2 through 24.2R2 Description: A Buffer Access with Incorrect Length Value vulnerability in the jdhcpd daemon of Juniper Networks Junos OS...

PT-2025-20478

Name of the Vulnerable Software and Affected Versions ASUS DriverHub versions prior to 1.0.6.0 Description The issue resides in the data source validation mechanism within ASUS DriverHub. Insufficient validation allows unauthorized sources to interact with the software's features through crafted...

PT-2025-20479

Name of the Vulnerable Software and Affected Versions ASUS DriverHub versions prior to 1.0.6.0 Description An insufficient validation issue exists in ASUS DriverHub. This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints. The issue may allow...

PT-2025-15796 · WordPress · Ankit Singla Wordpress Spam Blocker

Name of the Vulnerable Software and Affected Versions: Ankit Singla WordPress Spam Blocker versions 2.0.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2025-15873

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 3.17.3 Description: A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue wa...