PT-2025-2778 · Ssh Communications Security · Ssh Communication Security Privx

Name of the Vulnerable Software and Affected Versions: SSH Communication Security PrivX versions 18.0 through 36.0 Description: The issue is related to insufficient validation of public key signatures in SSH connections via a proxy port. This allows an existing account to impersonate another...

PT-2025-2073

Name of the Vulnerable Software and Affected Versions Privacy Policy Genius WordPress plugin versions through 2.0.4 Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This...

New Rock Technologies Cloud Connected Devices

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker full control of the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all...

Rockwell Automation KEPServer

RISK EVALUATION Successful exploitation of this vulnerability could cause the device to crash. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices...

Rockwell Automation FactoryTalk AssetCentre

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to extract passwords, access, credentials, or impersonate other users. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities,...

PT-2025-1932 · WordPress · Bulk Me Now!

Name of the Vulnerable Software and Affected Versions: Bulk Me Now! WordPress plugin versions 2.0 and earlier Description: The issue is related to the lack of CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks. Recommendations...

PT-2025-1585 · WordPress · Tracking Code Manager

Name of the Vulnerable Software and Affected Versions: Tracking Code Manager WordPress plugin version 2.4.0 and earlier Description: The issue allows users with a role as low as Contributor to perform Cross-Site Scripting attacks due to the plugin not sanitizing and escaping some of its metabox...

RCE (Remote Code Execution) org.apache.avro:avro Dependency in Bitbucket Data Center and Server

This High severity org.apache.avro:avro Dependency vulnerability was introduced in versions 8.6.0, 8.7.0, 8.8.0, 8.9.0, 8.10.0, 8.11.0, 8.12.0, 8.13.0, 8.14.0, 8.15.0, 8.16.0, 8.17.0, 8.18.0, 8.19.0, 9.0.0, 9.1.0, and 9.2.0 of Bitbucket Data Center and Server. This org.apache.avro:avro Dependency...

PT-2025-3444 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RuoYi version 4.8.0 Description: A SQL injection issue was found in RuoYi via the orderby parameter at the "/monitor/online/list" API endpoint. Recommendations: For RuoYi version 4.8.0, as a temporary workaround, consider restricting access t...

PT-2025-1306 · Devdojo · Devdojo Voyager

Name of the Vulnerable Software and Affected Versions: DevDojo Voyager versions 1.8.0 and earlier Description: The issue allows an authenticated user to bypass file type verification when uploading a file via the "/admin/media/upload" endpoint. This can lead to the upload of a web shell, resultin...

PT-2025-5297 · Apple · Macos Ventura +9

Name of the Vulnerable Software and Affected Versions: iPadOS versions 17.7.4 and earlier macOS Ventura versions 13.7.3 and earlier macOS Sonoma versions 14.7.3 and earlier visionOS versions 2.3 and earlier iOS versions 18.3 and earlier iPadOS versions 18.3 and earlier macOS Sequoia versions 15.3...

PT-2025-1846 · WordPress · Wp Customer Area

Name of the Vulnerable Software and Affected Versions: WP Customer Area versions 8.2.4 and earlier Description: The issue is related to the lack of CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks. Recommendations: WP Custom...

PT-2025-5281 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.7.3 macOS versions prior to 14.7.3 macOS versions prior to 15.3 Description: The issue is related to insecure storage of confidential information in the MacOs operating system's Security component. It may allow an...

PT-2025-5589 · Apache · Apache Cassandra

Name of the Vulnerable Software and Affected Versions: Apache Cassandra versions 4.0.0 through 4.0.15 Apache Cassandra versions 4.1.0 through 4.1.7 Apache Cassandra versions 5.0.0 through 5.0.2 Description: The issue allows users to access a datacenter or IP/CIDR groups they should not be able to...

PT-2025-20740 · Apple · Ipados +5

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.3 visionOS versions prior to 2.3 iPadOS versions prior to 17.7.7 watchOS versions prior to 11.3 macOS Sonoma versions prior to 14.7.5 iOS versions prior to 18.3 iPadOS versions prior to 18.3 tvOS versions prior to...

PT-2025-5282 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iPadOS versions prior to 17.7.4 iOS versions prior to 18.3 iPadOS versions prior to 18.3 Description: The issue is related to the handling of symlinks, which could allow an attacker to modify protected system files by restoring a maliciously...

PT-2025-1300

Name of the Vulnerable Software and Affected Versions Apple products versions prior to visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, and tvOS 18.3. Description A use-after-free issue exists in the Core Media component of Apple products. This issue allows a malicious...

PT-2025-1721 · WordPress · Zox News

Name of the Vulnerable Software and Affected Versions: Zox News theme for WordPress versions up to, and including, 3.16.0 Description: The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the...

PT-2025-2884 · Sungrow · Sungrow Winet-Sv200

Name of the Vulnerable Software and Affected Versions: SunGrow WiNet-SV200 versions 0.001.00.P027 and earlier Description: The issue concerns hardcoded MQTT credentials in the affected software, allowing an attacker to send arbitrary commands to any inverter. Additionally, the lack of TLS to...

PT-2025-5474 · Unknown · Themefic Tourfic

Name of the Vulnerable Software and Affected Versions: Themefic Tourfic versions 2.15.3 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can lead to web shell attacks. Recommendations: For...