PT-2025-30145

Name of the Vulnerable Software and Affected Versions eslint-config-prettier versions 8.10.1 through 10.1.7 Description The eslint-config-prettier npm package was compromised through a supply chain attack resulting from a phishing attack on maintainers. Installation of affected versions executes ...

PT-2025-30066 · Microsoft · Azure Machine Learning

Name of the Vulnerable Software and Affected Versions: Azure Machine Learning affected versions not specified Description: Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. Recommendations: At the moment, there is no information abou...

PT-2025-30028

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.5.7 Mattermost versions 9.11.x through 9.11.16 Description Mattermost fails to negotiate a new token when accepting an invite. This allows a user who intercepts both the invite and the password to send...

PT-2025-30077 · Unknown · Agorum Core Open

Name of the Vulnerable Software and Affected Versions: Agorum core open versions 11.9.2 and 11.10.1 Description: The software stores credentials in plaintext. Recommendations: Apply necessary measures to prevent the storage of credentials in plaintext for Agorum core open version 11.9.2. Apply...

PT-2025-30041 · Unknown · File Manager

Name of the Vulnerable Software and Affected Versions: Filemanager version 2.3.0 Description: An arbitrary file upload vulnerability exists in the is allowed file type function. This allows attackers to execute arbitrary code by uploading a crafted PHP file. Recommendations: Filemanager version...

PT-2025-30081

Name of the Vulnerable Software and Affected Versions CrushFTP versions prior to 10.8.5 CrushFTP versions prior to 11.3.4 23 Description An authentication bypass issue exists in the web management interface of CrushFTP due to improper validation of the AS2 protocol Applicability Statement 2, a...

PT-2025-30063

Name of the Vulnerable Software and Affected Versions Splashin iOS version 2.0 Description The Splashin iOS application version 2.0 does not enforce server-side interval restrictions for location updates for free-tier users. Recommendations Update to a newer version that contains a fix for this...

PT-2025-30073

Name of the Vulnerable Software and Affected Versions Wasmtime versions 24.0.0 through 24.0.3 Wasmtime versions 33.0.0 through 33.0.1 Wasmtime versions 34.0.0 through 34.0.1 Description Wasmtime is a runtime for WebAssembly. A bug in Wasmtime's implementation of the WASIp1 set of import functions...

PT-2025-30017

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.11.x through 9.11.16 Mattermost versions 10.5.x through 10.5.6 Mattermost versions 10.7.x through 10.7.3 Mattermost versions 10.8.x through 10.8.1 Description The software fails to verify authorization when retrieving...

PT-2025-30061

Name of the Vulnerable Software and Affected Versions form-data versions 2.5.4 form-data versions 3.0.0 through 3.0.3 form-data versions 4.0.0 through 4.0.3 Description A vulnerability exists in the form-data JavaScript library due to the use of insufficiently random values when generating bounda...

Leviton AcquiSuite and Energy Monitoring Hub

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to craft a malicious payload in URL parameters that would get executed in a client browser when accessed by a user, steal session tokens and control the service. 2. RECOMMENDED PRACTICES CISA recommends users...

PT-2025-29936 · Unknown · Nbcio-Boot

Name of the Vulnerable Software and Affected Versions: nbcio-boot version 1.0.3 Description: nbcio-boot version 1.0.3 contains a SQL injection issue via the userIds parameter at the /sys/user/deleteRecycleBin API endpoint. Recommendations: nbcio-boot version 1.0.3: Sanitize or validate the userId...

Protecting customers from Octo Tempest attacks across multiple industries

In recent weeks, Microsoft has observed Octo Tempest, also known as Scattered Spider, impacting the airlines sector, following previous activity impacting retail, food services, hospitality organizations, and insurance between April and July 2025. This aligns with Octo Tempest’s typical patterns ...

PT-2025-29737 · WordPress · Crocoblock Jettricks

Name of the Vulnerable Software and Affected Versions: Crocoblock JetTricks versions through 1.5.4.1 Description: The software contains a cross-site scripting XSS issue that allows for stored XSS attacks. This occurs due to improper neutralization of input during web page generation...

PT-2025-29708 · WordPress · Malcure Malware Scanner — #1 Toolset For Wordpress Malware Removal

Name of the Vulnerable Software and Affected Versions: Malcure Malware Scanner — 1 Toolset for WordPress Malware Removal plugin for WordPress versions through 16.8 Description: The Malcure Malware Scanner — 1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary Fi...

PT-2025-29790 · WordPress · Vergatheme Electrician

Name of the Vulnerable Software and Affected Versions: vergatheme Electrician - Electrical Service WordPress versions through 1.0 Description: The software contains a cross-site scripting issue due to improper neutralization of input during web page generation. This allows for reflected cross-sit...

PT-2025-29719

Name of the Vulnerable Software and Affected Versions Eclipse GlassFish versions 7.0.16 and earlier Description Eclipse GlassFish is susceptible to login brute-force attacks due to the absence of restrictions on the number of failed login attempts. Recommendations Apply a configuration to limit t...

PT-2025-29754 · Unknown · Gymbase Theme Classes

Name of the Vulnerable Software and Affected Versions: GymBase Theme Classes versions n/a through 1.4 Description: GymBase Theme Classes suffers from a SQL Injection issue due to improper neutralization of special elements used in an SQL command. This allows for potential SQL Injection attacks...

PT-2025-29837

Name of the Vulnerable Software and Affected Versions Unbound affected versions not specified Description A multi-vendor cache poisoning vulnerability, named 'Rebirthday Attack', has been discovered in caching resolvers that support EDNS Client Subnet ECS. Unbound is vulnerable when compiled with...

PT-2025-29824

Name of the Vulnerable Software and Affected Versions Plack-Middleware-Session versions prior to 0.35 Description The default session ID generator in Plack-Middleware-Session for Perl uses a SHA-1 hash seeded with the built-in rand function, the epoch time, and the process ID PID. The PID...