PT-2025-9656 · Mozilla +10 · Firefox +10

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 136 Firefox ESR versions prior to 115.21 Firefox ESR versions prior to 128.8 Description: A use-after-free issue in the content process side of a WebTransport connection could lead to a potentially exploitable crash...

PT-2025-9682

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.12 Rack versions prior to 3.0.13 Rack versions prior to 3.1.11 Description The issue concerns the Rack::Sendfile middleware, which logs unsanitised header values from the X-Sendfile-Type header. An attacker can explo...

PT-2025-9653

Name of the Vulnerable Software and Affected Versions VMware ESXi VMware Workstation VMware Fusion VMware Cloud Foundation VMware Telco Cloud Platform VMware Telco Cloud Infrastructure versions prior to 8.0 Description The software contains an information disclosure issue due to an out-of-bounds...

PT-2025-9668

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 136 Thunderbird versions prior to 136 Description The issue is related to memory safety bugs that could potentially lead to memory corruption. It is presumed that with sufficient effort, some of these bugs could be...

PT-2025-9659 · Mozilla +10 · Firefox +10

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 136 Firefox ESR versions prior to 128.8 Description: A RegExp bailout processing issue allowed additional JavaScript execution, potentially triggering unexpected garbage collection. Recommendations: For Firefox...

PT-2025-9215 · Amd · Radeon Software For Linux

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values, potentially leading to loss of confidentiality...

PT-2025-9211 · Zj1983 Zz · Zj1983 Zz

Name of the Vulnerable Software and Affected Versions: zj1983 zz up to 2024-8 Description: A critical vulnerability was found in the function getUserList of the file src/main/java/com/futvan/z/system/zrole/ZroleAction.java. The manipulation of the argument roleid leads to SQL injection. The attac...

PT-2025-9201 · Formwork · Formwork

Name of the Vulnerable Software and Affected Versions: Formwork versions 2.x Description: The site title field at "/panel/options/site" allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a...

PT-2025-9179 · Ibm · Ibm Controller

Name of the Vulnerable Software and Affected Versions: IBM Controller versions 11.0.0 through 11.0.1 IBM Controller version 11.1.0 Description: The issue makes it easier for attackers to compromise user accounts because it does not require strong passwords by default. Recommendations: For IBM...

PT-2025-9155 · Cursor +1 · Cursor +1

Name of the Vulnerable Software and Affected Versions: ToDesktop versions prior to 2024-10-03 Description: The issue allows remote attackers to execute arbitrary commands on the build server, potentially reading secrets from the desktopify config.prod.json file and deploying updates to any app, v...

PT-2025-9168 · WordPress · The Better Messages

Name of the Vulnerable Software and Affected Versions: The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress versions up to, and including, 2.7.4 Description: The issue allows unauthenticated attackers to make web requests to arbitrary...

PT-2025-9178 · Unknown · Zorlan Skycaiji

Name of the Vulnerable Software and Affected Versions: Zorlan SkyCaiji version 2.9 Description: A critical vulnerability has been found in Zorlan SkyCaiji, affecting the fileAction function of the vendor/skycaiji/app/admin/controller/Tool.php file. The manipulation of the save data argument leads...

GHSA-V83Q-83HJ-RW38 ntpd NTS client denial of service via wrongly sized cookies

Two denial of service vulnerabilities were found in ntpd-rs related to the handling of NTS cookies in our client functionality. Whenever an NTS source is configured and the server behind that source is sending zero-sized cookies or cookies larger than what would fit in our buffer size, ntpd-rs...

PT-2025-9138 · 07Flycms · 07Flycms

Name of the Vulnerable Software and Affected Versions: 07FLYCMS version 1.3.9 Description: A Cross Site Request Forgery issue allows a remote attacker to execute arbitrary code via the id parameter of the "del.html" component. Recommendations: For 07FLYCMS version 1.3.9, consider restricting acce...

PT-2025-9106 · Wuzhicms · Wuzhi Cms

Name of the Vulnerable Software and Affected Versions: wuzhicms version 4.1.0 Description: The issue is a Cross Site Scripting XSS vulnerability in the del function located in coreframeappmemberadmingroup.php. This vulnerability can be exploited to execute malicious scripts on the victim's browse...

PT-2025-9047 · Ibm · Ibm Mq

Name of the Vulnerable Software and Affected Versions: IBM MQ versions 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD Description: The issue allows potentially sensitive information in trace files to be read by a local user when the web console trace is enabled. Recommendations: For IBM MQ versions 9.3 LTS...

PT-2025-9048 · Ibm · Ibm Cognos Analytics

Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.2.0 through 11.2.4 FP5 Description: The issue allows an attacker to access sensitive files by inserting path traversal payloads inside the deficon parameter, enabling local file inclusion. Recommendations: For...

PT-2025-9139 · Syspass · Syspass

Name of the Vulnerable Software and Affected Versions: SysPass versions 3.2.x Description: A stored cross-site scripting XSS vulnerability allows a malicious user with elevated privileges to execute arbitrary Javascript code by specifying a malicious XSS payload as a notification type or...

PT-2025-9140 · Syspass · Syspass

Name of the Vulnerable Software and Affected Versions: Syspass versions 3.2.x Description: The account file upload functionality in Syspass fails to properly handle special characters in filenames, leading to the disclosure of the web application's source code and exposing sensitive information...

PT-2025-9034 · Infoblox · Infoblox Nios

Name of the Vulnerable Software and Affected Versions: Infoblox NIOS versions 8.6.4 and earlier, 9.x through 9.0.3 Description: The issue is related to improper input validation. Recommendations: For Infoblox NIOS versions 8.6.4 and earlier, update to a version later than 8.6.4. For Infoblox NIOS...