PT-2025-20599 · Unknown · Code-Server

Name of the Vulnerable Software and Affected Versions: code-server versions prior to 4.99.4 Description: The issue allows an attacker to gain access to the session token through a maliciously crafted URL using the proxy subpath. This can result in the attacker proxying to an arbitrary domain,...

PT-2025-20595 · Eclipse +4 · Eclipse Openj9 +4

Name of the Vulnerable Software and Affected Versions: Eclipse OpenJ9 versions up to 0.51 Description: A stack-based buffer overflow can occur when Eclipse OpenJ9 is used with OpenJDK version 8, by modifying a file on disk that is read when the JVM starts. Recommendations: For Eclipse OpenJ9...

PT-2025-20426 · Ibm · Ibm Cics Tx Standard +1

Name of the Vulnerable Software and Affected Versions: IBM CICS TX Standard versions 11.1 IBM CICS TX Advanced versions 10.1 through 11.1 Description: The issue is due to the failure to handle DNS return requests by the gethostbyname function, which could allow a local user to execute arbitrary...

PT-2025-20373 · WordPress · Nex-Forms

Name of the Vulnerable Software and Affected Versions: NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress versions up to, and including, 8.9.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output...

PT-2025-20385 · Rapid7 · Rapid7 Corporate Website

Name of the Vulnerable Software and Affected Versions: Rapid7 Corporate Website versions prior to May 2nd 2025 Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This vulnerability allows an attacker to redirect users to a...

PT-2025-23779 · Delta Electronics · Cncsoft

Name of the Vulnerable Software and Affected Versions: Delta Electronics CNCSoft affected versions not specified Description: The issue is related to the lack of proper validation of user-supplied files in Delta Electronics CNCSoft. If a user opens a malicious file, an attacker can execute code i...

PT-2025-20433 · Microsoft · Power Apps

Name of the Vulnerable Software and Affected Versions: Microsoft Power Apps affected versions not specified Description: The issue is related to Server-Side Request Forgery SSRF in Microsoft Power Apps, allowing an unauthorized attacker to disclose information over a network. No information is...

PT-2025-20416 · Totolink · Totolink A3100R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3100R version 5.9c.1527 Description: The issue is related to a Buffer Overflow that can be triggered through the comment parameter in the setIpPortFilterRules function. This allows for potential exploitation. Recommendations: For...

PT-2025-20397 · Openstack +1 · Openstack Ironic +1

Name of the Vulnerable Software and Affected Versions: OpenStack Ironic versions prior to 24.1.3 OpenStack Ironic versions prior to 26.1.1 OpenStack Ironic versions prior to 29.0.1 Description: The issue allows a malicious project assigned as a node owner to provide a path to any local file...

PT-2025-20382 · Telemessage · Telemessage Archiving Backend

Name of the Vulnerable Software and Affected Versions: TeleMessage archiving backend versions through 2025-05-05 Description: The issue concerns the acceptance of API calls from the TM SGNL aka Archive Signal app to request an authentication token, using hardcoded credentials. The credentials use...

PT-2025-20424 · Phplist · Phplist

Name of the Vulnerable Software and Affected Versions: phpList versions prior to 3.6.15 Description: The issue is related to Cross-Site Scripting XSS due to improper input sanitization in lt.php. This can be exploited when the application dynamically references internal paths and processes...

PT-2025-20365 · Halo · Halo

Name of the Vulnerable Software and Affected Versions: Halo versions up to 2.174.101 Halo versions 2.175.1 through 2.184.21 Description: The issue is related to improper input validation, specifically with the returnUrl parameter in Account Security Settings. This lack of validation allows...

PT-2025-20383

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 17.5, 16.9, 15.13, 14.18, and 13.21 Description The vulnerability is related to a buffer over-read in PostgreSQL's GB18030 encoding validation. This issue allows a database input provider to achieve temporary denia...

PT-2025-20389 · Phpjabbers · Phpjabbers Cleaning Business

Name of the Vulnerable Software and Affected Versions: PHPJabbers Cleaning Business Software version 1.0 Description: The issue concerns Multiple Stored Cross-Site Scripting XSS in the c name and name parameters. This allows for the injection of malicious scripts, potentially leading to...

PT-2025-20414 · D Link · Dns-320L +1

Name of the Vulnerable Software and Affected Versions: dlink DNS-320 version 1.00 dlink DNS-320LW version 1.01.0914.20212 Description: An issue allows an attacker to execute arbitrary code via the account mgr.cgi component, specifically through the cgi chg admin pw function. Recommendations: For...

PT-2025-20377 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions 2.1.0 through 2.3.0 Checkmk version 2.4.0b6 and earlier Description: The issue allows files to be deployed with agents to be accessible without authentication. This could enable an attacker to access files that may contain...

PT-2025-20376 · Unknown · Tagdiv Composer

Name of the Vulnerable Software and Affected Versions: tagDiv Composer plugin for WordPress versions up to, and including, 5.3 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to...

PT-2025-20437 · H3C · H3C Gr-1800Ax

Name of the Vulnerable Software and Affected Versions: H3C GR-1800AX versions up to 100R008 Description: A critical issue was found, affecting the function EnableIpv6 of the file "/goform/aspForm". The manipulation of the argument param leads to a buffer overflow. Access to the local network is...

PT-2025-20412

Name of the Vulnerable Software and Affected Versions: Erlang/OTP versions prior to OTP-27.3.4 Erlang/OTP versions prior to OTP-26.2.5.12 Erlang/OTP versions prior to OTP-25.3.2.21 Description: The issue concerns Erlang/OTP SSH failing to enforce strict KEX handshake hardening measures by allowin...

CVE-2025-27533

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service DoS by depleting process memor...