PT-2025-22440

Name of the Vulnerable Software and Affected Versions Versa Concerto versions 12.1.2 through 12.2.0 Description The Versa Concerto SD-WAN orchestration platform has an authentication bypass issue in the Traefik reverse proxy configuration. This allows an attacker to access administrative endpoint...

PT-2025-22384

Name of the Vulnerable Software and Affected Versions Valvesoftware Steam Client version 1738026274 Description The issue allows attackers to escalate privileges via a crafted executable or DLL. This can be achieved by manipulating a specifically crafted executable or DLL, which enables the...

PT-2025-22443 · Plane · Plane

Name of the Vulnerable Software and Affected Versions: Plane versions prior to 0.23 Description: The issue concerns insecure permissions in the UserSerializer that allow users to modify fields intended to be read-only, such as the email. This can potentially lead to account takeover when combined...

PT-2025-22459 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 17.10.7 GitLab CE/EE version 17.11 prior to 17.11.3 GitLab CE/EE version 18.0 prior to 18.0.1 Description: An issue has been discovered in GitLab CE/EE that could allow an authenticated attacker to cause a denia...

PT-2025-22381 · Cisco · Cisco Secure Network Analytics Manager +1

Name of the Vulnerable Software and Affected Versions: Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager affected versions not specified Description: A vulnerability in the API subsystem could allow an authenticated, remote attacker with low privileges to...

PT-2025-22435

Name of the Vulnerable Software and Affected Versions Vtiger CRM Open Source Edition version 8.3.0 Description A vulnerability in the software allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import functionality in the Module Import feature...

PT-2025-22668 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.1 through 17.10.6 GitLab CE/EE versions 17.11 through 17.11.2 GitLab CE/EE versions 18.0 through 18.0.0 Description: A business logic error in GitLab CE/EE allows an attacker to cause a branch name confusion in...

PT-2025-22417

Name of the Vulnerable Software and Affected Versions Jeppesen JetPlanner Pro version 1.6.2.20 Description The issue allows a remote attacker to execute arbitrary code through a Cross Site Scripting vulnerability. This enables remote code execution. Recommendations For Jeppesen JetPlanner Pro...

PT-2025-22398 · Unknown · Ackites Killwxapkg

Name of the Vulnerable Software and Affected Versions: Ackites KillWxapkg versions up to 2.4.1 Description: A critical issue affects the processFile function of the wxapkg File Parser component, located in the file internal/unpack/unpack.go. This issue leads to os command injection and can be...

PT-2025-22325

Name of the Vulnerable Software and Affected Versions Madara – Responsive and modern WordPress theme for manga sites versions 2.2.2 and earlier Description The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the template parameter, making it possibl...

ABUP IoT Cloud Platform

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access device profiles for which they are not authorized. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize...

PT-2025-22140 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions 9.0.0 through 9.5.50 ELTS TYPO3 versions 10.0.0 through 10.4.49 ELTS TYPO3 versions 11.0.0 through 11.5.43 ELTS TYPO3 versions 12.0.0 through 12.4.30 LTS TYPO3 versions 13.0.0 through 13.4.11 LTS Description: The backend user...

PT-2025-22577 · Opendcim · Opendcim

Name of the Vulnerable Software and Affected Versions: openDCIM versions prior to 23.05 Description: The issue allows SQL injection in people depts.php because prepared statements are not used. This could potentially lead to unauthorized access or manipulation of data. Recommendations: For openDC...

PT-2025-22277

Name of the Vulnerable Software and Affected Versions Langroid versions prior to 0.53.15 Description The issue concerns the use of pandas eval through the compute from docs function in the LanceDocChatAgent component. This allows an attacker to potentially run malicious commands, compromising the...

PT-2025-22296 · H3C · H3C R2+Prog

Name of the Vulnerable Software and Affected Versions: H3C R2+ProG versions up to 200R004 Description: A problematic issue was found in the HTTP POST Request Handler component, specifically in the function UpdateWanParams/AddMacList/EditMacList/AddWlanMacList/EditWlanMacList/Edit BasicSSID/Edit...

PT-2025-22074

Name of the Vulnerable Software and Affected Versions: Gardener versions prior to 1.116.4 Gardener versions prior to 1.117.5 Gardener versions prior to 1.118.2 Gardener versions prior to 1.119.0 Description: A security issue was discovered in Gardener that could allow a user with administrative...

PT-2025-21941 · Engenius · Engenius Enh500 Ap 2T2R

Name of the Vulnerable Software and Affected Versions: EnGenius ENH500 AP 2T2R version 3.0 FW3.7.22 Description: The issue concerns Incorrect Access Control via the password change function. The device fails to validate the current password, allowing an attacker to submit a password change reques...

PT-2025-22049 · Checkbot · Checkbot

Name of the Vulnerable Software and Affected Versions: CheckBot versions 1.05 and earlier Description: A Cross-Site Request Forgery CSRF issue in Ref CheckBot allows for Stored XSS. This means an attacker can execute malicious scripts on the victim's browser, potentially leading to unauthorized...

PT-2025-21986 · Unknown · Majestic Support

Name of the Vulnerable Software and Affected Versions: Majestic Support versions 1.1.0 and earlier Description: The issue is related to Missing Authorization, allowing the exploitation of incorrectly configured access control security levels. Recommendations: For Majestic Support versions 1.1.0 a...

PT-2025-21933 · Hugging Face · Transformers

Name of the Vulnerable Software and Affected Versions: huggingface/transformers version v4.48.3 Description: A vulnerability in the preprocess string function of the transformers.testing utils module allows for a Regular Expression Denial of Service ReDoS attack. The regular expression used to...