PT-2025-16930 · Pear · Pear Http Request2

Name of the Vulnerable Software and Affected Versions: PEAR HTTP Request2 versions prior to 2.7.0 Description: The issue concerns multiple files in the tests directory of PEAR HTTP Request2, specifically tests/ network/getparameters.php and tests/ network/postparameters.php, which reflect any GET...

PT-2025-12973

Name of the Vulnerable Software and Affected Versions CrushFTP versions 10.0.0 through 10.8.3 CrushFTP versions 11.0.0 through 11.3.0 Description The vulnerability in CrushFTP is related to improper authentication, allowing remote and unauthenticated HTTP requests to gain unauthorized access. Thi...

PT-2025-11155 · WordPress · Limit Bio Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Limit Bio WordPress plugin versions 1.0 and earlier Description: The issue concerns a lack of CSRF check when updating settings in the Limit Bio WordPress plugin, along with missing sanitization and escaping. This could allow attackers to mak...

CVE-2025-29891 Apache Camel: Camel Message Header Injection through request parameters

Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is...

PT-2025-11153 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 12.3 through 17.7.6 GitLab EE versions 17.8 through 17.8.4 GitLab EE versions 17.9 through 17.9.1 Description: An issue exists in GitLab EE that may allow a remote attacker to cause a denial of service condition by...

PT-2025-11083

Apache Camel and Affected Versions Apache Camel versions 3.10.0 through 3.22.4 Apache Camel versions 4.8.0 through 4.8.6 Apache Camel versions 4.10.0 through 4.10.3 Description Apache Camel is susceptible to a bypass/injection flaw stemming from its default incoming header filter. This allows...

PT-2025-11127 · Ruby-Saml +3 · Ruby-Saml +3

Name of the Vulnerable Software and Affected Versions: ruby-saml versions prior to 1.12.4 and 1.18.0 Description: An authentication bypass vulnerability was found in ruby-saml due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different...

PT-2025-29159 · Honeywell · Experion Pks Hca +9

Name of the Vulnerable Software and Affected Versions: Honeywell Experion PKS versions prior to 520.2 TCU9 HF1 and versions prior to 530 TCU3 Honeywell OneWireless WDM versions 322.1 through 322.4 Honeywell OneWireless WDM versions 330.1 through 330.3 Honeywell Experion PKS C300, FIM4, FIM8, UOC,...

PT-2025-11089 · Unknown · Softether Vpn

Name of the Vulnerable Software and Affected Versions: SoftEther VPN version 5.02.5187 Description: The issue is related to a Buffer Overflow in the Command.c file, specifically via the PtMakeCert and PtMakeCert2048 functions. Recommendations: For SoftEther VPN version 5.02.5187, consider disabli...

PT-2025-11114

Name of the Vulnerable Software and Affected Versions graphql-ruby versions 1.11.5 through 1.11.7 graphql-ruby versions 1.12.0 through 1.12.24 graphql-ruby versions 1.13.0 through 1.13.23 graphql-ruby versions 2.0.0 through 2.0.31 graphql-ruby versions 2.1.0 through 2.1.13 graphql-ruby versions...

Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication, gain control over the products, or impersonate the web applications. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of...

Schneider Electric EcoStruxure Panel Server

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

PT-2025-10808 · Microsoft · Windows Telephony Service +1

Name of the Vulnerable Software and Affected Versions: Windows Telephony Server version 10.0.17763.0 Description: The issue is related to a heap-based buffer overflow in the Windows Telephony Server, which allows an unauthorized attacker to execute code over a network. This can enable remote...

PT-2025-10751 · Mrcms · Mrcms

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.2 Description: A vulnerability was found in the function list of the file "/admin/file/list.do" of the component org.marker.mushroom.controller.FileController. The manipulation of the path argument leads to cross-site...

PT-2025-10768 · Fortinet · Fortindr

Name of the Vulnerable Software and Affected Versions: Fortinet FortiNDR versions 7.1.0 through 7.1.1 Fortinet FortiNDR versions 7.2.0 through 7.2.1 Fortinet FortiNDR version 7.4.0 Fortinet FortiNDR versions prior to 7.0.5 Description: A cross-site request forgery vulnerability in Fortinet FortiN...

PT-2025-16456

Name of the Vulnerable Software and Affected Versions MySQL Client versions 8.0.0 through 8.0.41 MySQL Client versions 8.4.0 through 8.4.4 MySQL Client versions 9.0.0 through 9.2.0 Description The issue allows a low-privileged attacker with network access via multiple protocols to compromise the...

Siemens SCALANCE M-800 and SC-600 Families

SUMMARY SCALANCE M-800 and SC-600 families are affected by improper input validation in the OpenVPN authentication. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific...

Siemens SiPass integrated AC5102/ACC-G2 and ACC-AP

SUMMARY SiPass integrated ACC Advanced Central Controller devices contain multiple vulnerabilities that could allow attackers to execute commands on the devices with root privileges and access sensitive data. Siemens has released new versions for the affected products and recommends to update to...

PT-2025-16890 · Tp Link · Tp-Link M7450

Name of the Vulnerable Software and Affected Versions: TP-Link M7450 4G LTE Mobile Wi-Fi Router Firmware version 1.0.2 Build 170306 Rel.1015n Description: A SQL Injection vulnerability exists, allowing an unauthenticated attacker to inject malicious SQL statements via the username and password...

PT-2025-10821

Name of the Vulnerable Software and Affected Versions Microsoft Office versions prior to 2.3 Microsoft 365 Apps for Enterprise affected versions not specified Microsoft Word affected versions not specified Microsoft Office Long Term Servicing Channel affected versions not specified Description Th...