PT-2025-45553

Name of the Vulnerable Software and Affected Versions WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales versions prior to 3.6.3 Description The WPFunnels plugin for WordPress is susceptible to unauthorized user registration. The plugin...

PT-2025-45563

Name of the Vulnerable Software and Affected Versions CYAN Backup plugin for WordPress versions through 2.5.4 Description The CYAN Backup plugin for WordPress has a flaw that allows authenticated attackers with Administrator-level access or higher to delete arbitrary files on the server. This is...

PT-2025-45546

Name of the Vulnerable Software and Affected Versions WP2Social Auto Publish versions through 2.4.7 Description The WP2Social Auto Publish plugin for WordPress is susceptible to Reflected Cross-Site Scripting via PostMessage due to inadequate input sanitization and output escaping. This allows...

PT-2025-45561

Name of the Vulnerable Software and Affected Versions Mail Mint plugin for WordPress versions prior to 1.18.11 Description The Mail Mint plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation within the process contact attribute import function. Th...

[SECURITY] [DSA 6050-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6050-1 [email protected] https://www.debian.org/security/ Andres Salomon November 07, 2025 https://www.debian.org/security/faq -...

PT-2025-45412

Name of the Vulnerable Software and Affected Versions archives version 1.0.0 Description archives is a Go library used for extracting archives such as tar and zip files. Version 1.0.0 does not adequately prevent a malicious user from providing a specially crafted archive that could lead to Remote...

PT-2025-45411

Name of the Vulnerable Software and Affected Versions conda Constructor versions 3.12.2 and below Description conda Constructor is a tool used to create installers for conda package collections. Versions 3.12.2 and earlier have a configuration where the installation directory receives permissions...

PT-2025-45420

Name of the Vulnerable Software and Affected Versions PaperWork versions 6.1.0.9390 through 6.1.0.9397 Description The software contains a flaw due to improper neutralization of special elements used in an SQL command, leading to a SQL injection issue. This impacts the application's ability to...

PT-2025-45474

Name of the Vulnerable Software and Affected Versions SourceCodester User Account Generator version 1.0 Description A Cross-Site Scripting XSS issue exists in SourceCodester User Account Generator version 1.0. This allows remote attackers to execute arbitrary JavaScript code within a user’s brows...

PT-2025-45407

Name of the Vulnerable Software and Affected Versions ClipBucket versions 5.5.2-146 and below Description ClipBucket is a video sharing platform. A stored Cross-site Scripting XSS issue exists in the Manage Photos feature. An authenticated regular user can upload a photo with a malicious Photo...

PT-2025-45426

Name of the Vulnerable Software and Affected Versions File Station 5 versions prior to 5.5.6.5018 Description A flaw exists in File Station 5 where unrestricted resource allocation can occur. If an attacker obtains a user account, they may be able to exhaust resources, potentially impacting other...

CVE-2025-12815

An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio RES on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots. To mitigate...

PT-2025-45094

Name of the Vulnerable Software and Affected Versions KiotViet Sync plugin for WordPress versions up to and including 1.8.5 Description The KiotViet Sync plugin for WordPress is susceptible to authorization bypass. This is caused by the use of a hardcoded password for authentication within the...

PT-2025-45155

Name of the Vulnerable Software and Affected Versions Quipux versions 4.0.1 through e1774ac Description The software allows for the enumeration of usernames and access to the Ecuadorean identification number for all registered users. This is achieved by manipulating the txt login parameter within...

PT-2025-45060

Name of the Vulnerable Software and Affected Versions Cursor versions 1.7.28 and below Description Cursor is a code editor designed for programming with AI. An input validation issue within Cursor’s MCP server installation allows maliciously crafted deep-links to circumvent standard security...

PT-2025-45386

Name of the Vulnerable Software and Affected Versions Jellysweep versions 0.12.1 and below Description Jellysweep is a cleanup tool for the Jellyfin media server. The /api/images/cache API endpoint accepts a URL parameter that is directly passed to a cache package, allowing the server to download...

PT-2025-44994

Name of the Vulnerable Software and Affected Versions Cursor versions 1.7.23 and below Description Cursor, a code editor built for programming with AI, contains a flaw where a malicious agent can access sensitive files that should be protected by the cursorignore mechanism. An attacker, having...

PT-2025-45013

Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.71.0 Description lakeFS is a tool that transforms object storage into Git-like repositories. Versions 1.69.0 and below lack authentication for the /api/v1/usage-report/summary endpoint, allowing unauthorized access t...

PT-2025-51003

Name of the Vulnerable Software and Affected Versions macOS versions prior to 26.1 Description An issue existed where an application could potentially escape its sandbox restrictions. This could allow an application to gain broader access to the system than intended. Recommendations Update to mac...

PT-2025-44851

Name of the Vulnerable Software and Affected Versions macOS versions prior to 14.8.2 macOS versions prior to 15.7.2 Description An application may be able to access user-sensitive data due to insufficient entitlement checks. The issue was resolved by implementing additional entitlement checks...