MAL-2025-5365 Malicious code in bar.app.bar_rights (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d42cf077f7eef742c0cd55680d97ae121015d7f7a43d7b81fc35ce75333b382 Any computer that has this package installed or running should be considered...

PT-2025-28078 · Belkin · Belkin F9K1122

Name of the Vulnerable Software and Affected Versions: Belkin F9K1122 version 1.00.33 Description: A critical vulnerability affects the function formWpsStart of the file "/goform/formWpsStart" in the component webs. The manipulation of the argument pinCode leads to a stack-based buffer overflow...

PT-2025-28081 · Belkin · Belkin F9K1122

Name of the Vulnerable Software and Affected Versions: Belkin F9K1122 version 1.00.33 Description: A critical vulnerability was found in the function formL2TPSetup of the file /goform/formL2TPSetup of the component webs. The manipulation of the argument L2TPUserName leads to a stack-based buffer...

PT-2025-26877 · Totolink · Totolink Ca300-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-PoE version 6.2c.884 Description: A critical issue has been found in the QuickSetting function of the file ap.so, allowing for os command injection through the manipulation of the hour/minute argument. This can be initiated...

PT-2025-26939 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.10 through 17.11.4 GitLab EE versions 18.0 through 18.0.2 GitLab EE versions 18.1 through 18.1.0 Description: An issue has been discovered that could have allowed authenticated users to assign unrelated compliance...

PT-2025-26827 · Sourcecodester · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Salon Management System version 1.0 Description: A critical issue was found in the system, affecting the /panel/edit-staff.php file. The manipulation of the editid argument leads to SQL injection. This issue can be exploit...

PT-2025-26907 · Unknown · Car Rental System

Name of the Vulnerable Software and Affected Versions: Car Rental System version 1.0 Description: A critical issue was found in the Car Rental System, affecting some unknown functionality of the file /admin/add cars.php. The manipulation of the image argument leads to unrestricted upload. This...

PT-2025-26834 · Sourcecodester · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Salon Management System version 1.0 Description: A critical issue has been found in the software, affecting an unknown functionality of the file /panel/edit-services.php. The manipulation of the editid argument leads to SQ...

PT-2025-26815 · Brother Industries +2 · Dcp-7090Dw +199

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: An unauthenticated attacker who can connect to TCP port 9100 can issue a Printer Job Language PJL command that will crash the target device. The device will reboot, after which the attacker...

PT-2025-26818 · Unknown +1 · Mountain Duck +1

Name of the Vulnerable Software and Affected Versions: Cyberduck versions through 9.1.6 Mountain Duck versions through 4.17.5 Description: The issue is related to improper handling of TLS certificate pinning for untrusted certificates, such as self-signed certificates, in Cyberduck and Mountain...

PT-2025-26836 · Cadclick · Cadclick

Name of the Vulnerable Software and Affected Versions: CADClick versions 1.13.0 and earlier Description: The issue allows remote attackers to inject arbitrary web script or HTML via the tree parameter, enabling Cross-Site Scripting XSS attacks. Recommendations: For CADClick versions 1.13.0 and...

PT-2025-26848 · Hexagon · Hexagon Hxgn Oncall Dispatch Advantage

Name of the Vulnerable Software and Affected Versions: Hexagon HxGN OnCall Dispatch Advantage Web version 10.2309.03.00264 Hexagon HxGN OnCall Dispatch Advantage Mobile version 10.2402 Description: The issue allows a remote authenticated attacker with access to the Broadcast Person functionality ...

PT-2025-26875 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 8.5 and 9.0 Description: The issue allows a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects. This poses a serious risk to enterprise Jav...

PT-2025-28080 · Belkin · Belkin F9K1122

Name of the Vulnerable Software and Affected Versions: Belkin F9K1122 version 1.00.33 Description: A critical vulnerability has been found in the function formPPTPSetup of the file /goform/formPPTPSetup of the component webs. The manipulation of the argument pptpUserName leads to a stack-based...

PT-2025-26863

Name of the Vulnerable Software and Affected Versions: Incus versions 6.12 and 6.13 Description: Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, it generates nftables rules that partially bypass security options security.mac filtering,...

PT-2025-26868 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.06B01 Description: A critical issue affects the function formAdvanceSetup of the file /goform/formAdvanceSetup. The manipulation of the argument webpage leads to stack-based buffer overflow. The attack may be initiat...

CGA-G9MJ-RQPV-9273

Bulletin has no description...

Delta Electronics CNCSoft

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to execute code within the context of the current process. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds...

PT-2025-26712 · WordPress · The Aiomatic

Name of the Vulnerable Software and Affected Versions: The Aiomatic - Automatic AI Content Writer & Editor plugin for WordPress versions up to, and including, 2.5.0 Description: The issue allows for arbitrary file uploads due to missing file type validation in the aiomatic image editor ajax submi...

PT-2025-26723

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Firefox ESR versions prior to 128.12 Description: The issue is related to the executable file warning not alerting users before opening files with the terminal extension. This problem specifically affects Firefox...