MAL-2025-23351 Malicious code in iq_delivery_recommendations (npm)

The package iqdeliveryrecommendations was found to contain malicious code...

CVE-2025-55668

Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 ...

CVE-2025-55668 Apache Tomcat: session fixation via rewrite valve

Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 ...

CVE-2025-48989 Apache Tomcat: h2 DoS - Made You Reset

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected...

PT-2025-32997

Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 6.9.13-27 ImageMagick versions prior to 7.1.2-1 Description: ImageMagick is free and open-source software used for editing and manipulating digital images. The magnified size calculations in the ReadOneMNGImage...

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions.

Summary Multiple vulnerabilities were addressed in IBM Business Automation Manager Open Editions 8.0.8. Vulnerability Details CVEID:CVE-2025-53506 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that...

CVE-2025-48913

A flaw was found in org.apache.cxf/cxf, where untrusted users can configure JMS to allow the specification of RMI or LDAP URLs, possibly leading to code execution. This vulnerability allows an attacker to provide malicious protocol URLs during JMS configuration. Mitigation To reduce risk,...

DoS (Denial of Service) Third-Party Dependency in Jira Software Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 9.12.0, 10.3.0, 10.6.0, and 10.7.1 of Jira Software Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allo...

PT-2025-32299 · Unknown · Hospital Management System

Name of the Vulnerable Software and Affected Versions: Hospital Management System version 4 Description: The Hospital Management System is susceptible to a SQL injection issue through the app contact parameter in the appsearch.php file. Recommendations: As a temporary workaround, consider...

PT-2025-32115 · Unknown · Usmartview

Name of the Vulnerable Software and Affected Versions: Smart View versions prior to Android 16 Description: The use of implicit intents for sensitive communication allows local attackers to access sensitive information. Recommendations: Update Smart View to Android 16 or later...

PT-2025-32198 · Marbella · Marbella Kr8S Dashcam Ff

Name of the Vulnerable Software and Affected Versions: Marbella KR8s Dashcam FF version 2.0.8 Description: An issue exists on Marbella KR8s Dashcam FF 2.0.8 devices where video recordings, containing sensitive data such as routes, conversations, and footage, are accessible for download. This is...

PT-2025-32082 · WordPress · Zakra

Name of the Vulnerable Software and Affected Versions: Zakra versions prior to 4.1.6 Description: The Zakra theme for WordPress is susceptible to unauthorized data modification due to a missing capability check on the welcome notice import handler function. This allows authenticated attackers wit...

PT-2025-32219 · Unknown · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Vedo Suite version 2024.17 Description: The application stores credentials in clear-text within the /api vedo/configuration/config.yml file. This file contains sensitive information, including credentials, secret keys, and database informatio...

PT-2025-32134 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: A memory corruption issue exists when processing an IOCTL command with an arbitrary address. Recommendations: At the moment, there is no information about a newer version that contains a fix for th...

PT-2025-32221 · Unknown · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Vedo Suite version 2024.17 Description: A local file inclusion vulnerability exists in Vedo Suite version 2024.17. This issue allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized readfile...

PT-2025-32135

Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: The software suffers from a memory corruption issue when processing DirectDraw Interface DDI command calls. Recommendations: At the moment, there is no information about a newer version that contai...

PT-2025-32043 · Kenwood · Kenwood Dmx958Xr

Name of the Vulnerable Software and Affected Versions: Kenwood DMX958XR affected versions not specified Description: This issue allows physically present attackers to execute arbitrary code on affected installations. Authentication is not required for exploitation. The flaw resides in the firmwar...

PT-2025-31942 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 4.2-milestone-3 through 16.4.7 XWiki Platform versions 16.5.0-rc-1 through 16.10.5 XWiki Platform versions 17.0.0-rc-1 through 17.2.2 Description: The platform contains reflected cross-site scripting XSS vulnerabilitie...

PT-2025-32005 · Risc Zero · Risc0-Zkvm +2

Name of the Vulnerable Software and Affected Versions: risc0-zkvm versions 2.0.0 through 2.1.0 risc0-circuit-rv32im versions 2.0.0 through 2.0.4 risc0-circuit-rv32im-sys versions 2.0.0 through 2.0.4 Description: RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARK...

PT-2025-31947 · Firstnum · Firstnum Jc21A-04

Name of the Vulnerable Software and Affected Versions: FIRSTNUM JC21A-04 devices versions through 2.01ME/FN Description: FIRSTNUM JC21A-04 devices enable the SSH service by default with the credentials root/admin. The graphical user interface GUI does not provide a method to disable this account...