PT-2025-14080 · Yayextra · Yayextra

Name of the Vulnerable Software and Affected Versions: YayExtra versions 1.5.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing the exploitation of incorrectly configured access control security levels. Recommendations: For YayExtra versions 1.5.2 a...

PT-2025-14027 · WordPress · Awesome Support

Name of the Vulnerable Software and Affected Versions: The Awesome Support – WordPress HelpDesk & Support Plugin versions up to, and including, 6.3.1 Description: The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/awesome-support...

PT-2025-14053 · Bit Apps · Bit Assist

Name of the Vulnerable Software and Affected Versions: Bit Assist versions 1.5.4 and earlier Description: The issue is a Path Traversal vulnerability in Bit Apps Bit Assist, allowing unauthorized access to files and directories. Recommendations: For versions 1.5.4 and earlier, update to a version...

PT-2025-14177 · Unknown · Piotnet Forms

Name of the Vulnerable Software and Affected Versions: Piotnet Forms versions 1.0.0 through 1.0.30 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-18652 · Totolink · Totolink Cpe Cp900

Name of the Vulnerable Software and Affected Versions: TOTOLINK CPE CP900 version 6.3c.1144 B20190715 Description: A command injection issue was found in the CloudSrvUserdataVersionCheck function, allowing attackers to execute arbitrary commands via a crafted request. This is possible through the...

PT-2025-14371 · Nagios · Nagios Network Analyzer

Name of the Vulnerable Software and Affected Versions: Nagios Network Analyzer version 2024R1.0.3 Description: A session management flaw allows an attacker to reuse session tokens even after a user logs out, leading to unauthorized access and account takeover. This occurs due to insufficient...

PT-2025-14049 · Unknown · Better Wishlist Api

Name of the Vulnerable Software and Affected Versions: Better WishList API versions 1.1.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS in the Better WishList API...

PT-2025-14116 · Mydumper +2 · Mydumper +2

Name of the Vulnerable Software and Affected Versions: MyDumper versions prior to 0.18.2-8 Description: The MySQL C client library allows authenticated remote actors to read arbitrary files from client systems via a crafted server response to a LOAD LOCAL INFILE query, leading to sensitive...

PT-2025-18653 · Totolink · Totolink Cpe Cp900

Name of the Vulnerable Software and Affected Versions: TOTOLINK CPE CP900 version 6.3c.1144 B20190715 Description: A command injection issue was discovered in the setUploadUserData function through the FileName parameter. This issue allows attackers to execute arbitrary commands via a manipulated...

PT-2025-18655 · Totolink · Totolink Cpe Cp900

Name of the Vulnerable Software and Affected Versions: TOTOLINK CPE CP900 version 6.3c.1144 B20190715 Description: A command injection issue was found in the setApRebootScheCfg function through the hour or minute parameters. This allows attackers to execute arbitrary commands via a manipulated...

PT-2025-14375

Name of the Vulnerable Software and Affected Versions Zabbix affected versions not specified Description A low privilege Zabbix user with API access can use a SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter...

PT-2025-14105

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 137 Firefox ESR versions prior to 128.9 Thunderbird versions prior to 137 Thunderbird ESR versions prior to 128.9 Description Memory safety bugs are present, showing evidence of memory corruption. It is presumed that...

PT-2025-14443

Name of the Vulnerable Software and Affected Versions Go-Guerrilla SMTP Daemon versions prior to 1.6.7 Description The issue allows a client to spoof its IP address when the proxy protocol is being used. This occurs because the PROXY command is accepted multiple times, with later invocations...

PT-2025-14103 · Mozilla +10 · Firefox +13

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 137 Firefox ESR versions prior to 115.22 Firefox ESR versions prior to 128.9 Thunderbird versions prior to 137 Thunderbird versions prior to 128.9 Description: The issue is related to a use-after-free error in the...

GHSA-PX37-JPQX-97Q9 AWS SAM CLI Path Traversal allows file copy to build container

Summary The AWS Serverless Application Model Command Line Interface AWS SAM CLI is an open-source CLI tool that helps Lambda developers to build and develop Lambda applications locally on their computers using Docker. When running the AWS SAM CLI build process with Docker and symlinks are include...

CGA-M9CC-R3C6-VJ93

Bulletin has no description...

CGA-C4VJ-F69G-P959

Bulletin has no description...

CGA-6GHH-HJ4P-3V8P

Bulletin has no description...

PT-2025-20754 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.7.6 macOS versions prior to 14.7.6 macOS versions prior to 15.4 Description: The issue allows a malicious app to potentially gain root privileges. This was addressed with additional permissions checks...

PT-2025-13797 · Tuleap · Tuleap

Name of the Vulnerable Software and Affected Versions: Tuleap versions prior to 16.5.99.1742392651 Tuleap Enterprise Edition versions prior to 16.5-5 and 16.4-8 Description: The issue concerns the lack of enforcement of read permissions on parent trackers in the REST API. This affects the...