PT-2025-29936 · Unknown · Nbcio-Boot

Name of the Vulnerable Software and Affected Versions: nbcio-boot version 1.0.3 Description: nbcio-boot version 1.0.3 contains a SQL injection issue via the userIds parameter at the /sys/user/deleteRecycleBin API endpoint. Recommendations: nbcio-boot version 1.0.3: Sanitize or validate the userId...

Protecting customers from Octo Tempest attacks across multiple industries

In recent weeks, Microsoft has observed Octo Tempest, also known as Scattered Spider, impacting the airlines sector, following previous activity impacting retail, food services, hospitality organizations, and insurance between April and July 2025. This aligns with Octo Tempest’s typical patterns ...

PT-2025-29754 · Unknown · Gymbase Theme Classes

Name of the Vulnerable Software and Affected Versions: GymBase Theme Classes versions n/a through 1.4 Description: GymBase Theme Classes suffers from a SQL Injection issue due to improper neutralization of special elements used in an SQL command. This allows for potential SQL Injection attacks...

PT-2025-29790 · WordPress · Vergatheme Electrician

Name of the Vulnerable Software and Affected Versions: vergatheme Electrician - Electrical Service WordPress versions through 1.0 Description: The software contains a cross-site scripting issue due to improper neutralization of input during web page generation. This allows for reflected cross-sit...

PT-2025-29752 · WordPress · Wp Delicious

Name of the Vulnerable Software and Affected Versions: WP Delicious versions through 1.8.4 Description: WP Delicious is susceptible to a DOM-Based Cross-site Scripting issue due to improper neutralization of input during web page generation. This allows for potential malicious code execution with...

PT-2025-29824

Name of the Vulnerable Software and Affected Versions Plack-Middleware-Session versions prior to 0.35 Description The default session ID generator in Plack-Middleware-Session for Perl uses a SHA-1 hash seeded with the built-in rand function, the epoch time, and the process ID PID. The PID...

PT-2025-29837 · Nlnet +7 · Unbound +7

Name of the Vulnerable Software and Affected Versions: Unbound affected versions not specified Description: A multi-vendor cache poisoning vulnerability, named 'Rebirthday Attack', has been discovered in caching resolvers that support EDNS Client Subnet ECS. Unbound is vulnerable when compiled wi...

PT-2025-29719

Name of the Vulnerable Software and Affected Versions Eclipse GlassFish versions 7.0.16 and earlier Description Eclipse GlassFish is susceptible to login brute-force attacks due to the absence of restrictions on the number of failed login attempts. Recommendations Apply a configuration to limit t...

PT-2025-29737 · WordPress · Crocoblock Jettricks

Name of the Vulnerable Software and Affected Versions: Crocoblock JetTricks versions through 1.5.4.1 Description: The software contains a cross-site scripting XSS issue that allows for stored XSS attacks. This occurs due to improper neutralization of input during web page generation...

PT-2025-29708 · WordPress · Malcure Malware Scanner — #1 Toolset For Wordpress Malware Removal

Name of the Vulnerable Software and Affected Versions: Malcure Malware Scanner — 1 Toolset for WordPress Malware Removal plugin for WordPress versions through 16.8 Description: The Malcure Malware Scanner — 1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary Fi...

Security Bulletin: Apache Commons FileUpload used by IBM InfoSphere Identity Insight has a potential vulnerability (CVE-2025-48976))

Summary Apache Commons FileUpload used by IBM InforSphere Identity Insight provided a hard-coded limit of 10kB for the size of the headers associated with a multipart request. A specially crafted request that used a large number of parts with large headers could trigger excessive memory usage...

DSpace is vulnerable to Path Traversal attacks when importing packages using Simple Archive Format

Impact A path traversal vulnerability is possible during the import of an archive in Simple Archive Format, either from command-line ./dspace import command or from the "Batch Import Zip" user interface feature. This vulnerability likely impacts all versions of DSpace 1.x = 7.6.3, 8.0 = 8.1, and...

LITEON IC48A and IC80A EV Chargers

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access sensitive information when accessing the Liteon EV chargers. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:...

PT-2025-29627 · Oracle · Oracle Weblogic Server

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 12.2.1.4.0 Oracle WebLogic Server versions 14.1.1.0.0 Oracle WebLogic Server versions 14.1.2.0.0 Description: An easily exploitable issue exists in the Oracle WebLogic Server Core component, allowing an...

PT-2025-29650

Name of the Vulnerable Software and Affected Versions Oracle MySQL Server versions 8.0.0 through 8.0.42 Oracle MySQL Server versions 8.4.0 through 8.4.5 Oracle MySQL Server versions 9.0.0 through 9.3.0 Description A vulnerability exists in the Oracle MySQL Server component Server: Security:...

PT-2025-29562 · Apache · Apache Cxf

Name of the Vulnerable Software and Affected Versions: Apache CXF versions prior to 3.5.11 Apache CXF versions prior to 3.6.6 Apache CXF versions prior to 4.0.7 Apache CXF versions prior to 4.1.1 Description: Apache CXF improperly handles large stream-based messages, storing them as temporary fil...

PT-2025-29554 · Riverbed Technology · Riverbed Steelcentral Netprofiler +1

Name of the Vulnerable Software and Affected Versions: Riverbed SteelCentral NetProfiler and NetExpress version 10.8.7 Description: An authenticated multi-stage remote code execution issue exists. A SQL injection vulnerability in the /api/common/1.0/login endpoint can be exploited to create a new...

PT-2025-29557 · Ipfire · Ipfire

Name of the Vulnerable Software and Affected Versions: IPFire versions prior to 2.19 Core Update 101 Description: A remote command execution issue exists in IPFire due to a flaw in the proxy.cgi CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in...

PT-2025-29671

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 9.0.0 through 9.1.0 Description A flaw exists in the Optimizer component of Oracle MySQL Server that allows a high-privileged attacker with network access to cause a denial-of-service DOS condition, resulting in a hang or...

PT-2025-29674

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u451 and 8u451-perf Oracle Java SE version 11.0.27 Oracle GraalVM Enterprise Edition version 21.3.14 Description A difficult-to-exploit issue exists in the Scripting component of Oracle Java SE and Oracle GraalVM...