PT-2025-2261 · WordPress · Skt Blocks

Name of the Vulnerable Software and Affected Versions: SKT Blocks – Gutenberg Based Page Builder plugin for WordPress versions up to, and including, 1.7 Description: The issue is related to Stored Cross-Site Scripting via the plugin's skt-blocks/post-carousel block due to insufficient input...

PT-2025-2011

Name of the Vulnerable Software and Affected Versions WP Projects Portfolio with Client Testimonials WordPress plugin versions 3.0 and earlier Description The issue is related to a Reflected Cross-Site Scripting that could be used against high privilege users such as admin, due to a parameter not...

PT-2025-4122

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 135 Firefox ESR versions prior to 115.20 Firefox ESR versions prior to 128.7 Thunderbird versions prior to 128.7 Thunderbird versions prior to 135 Description An attacker could have caused a use-after-free via crafted...

PT-2025-5268 · Unknown · Tuleap Community Edition +1

Name of the Vulnerable Software and Affected Versions: Tuleap Community Edition versions prior to 16.3.99.1737562605 Tuleap Enterprise Edition versions prior to 16.3-5 Tuleap Enterprise Edition versions prior to 16.2-7 Description: Tuleap is an Open Source Suite to improve management of software...

PT-2025-4628 · Unknown · Contest Gallery

Name of the Vulnerable Software and Affected Versions: Contest Gallery versions prior to 25.1.0 Description: The issue is related to improper neutralization of special elements used in an SQL command, which allows SQL injection. This means that an attacker could potentially inject malicious SQL...

CGA-2HGP-458J-7V84

Bulletin has no description...

PT-2025-2683 · Ibm · Ibm Sterling B2B Integrator

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator versions 6.0.0.0 through 6.1.2.5 IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.3 Description: The issue allows an authenticated user to obtain sensitive filename information due to an observable...

PT-2025-23045 · Ibm · Ibm Security Guardium

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium version 12.0 Description: The issue allows a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against t...

PT-2025-1685 · Grafana +2 · Grafana +2

Name of the Vulnerable Software and Affected Versions: Grafana versions prior to 10.4.15 Grafana versions prior to 11.0.11 Grafana versions prior to 11.1.11 Grafana versions prior to 11.2.6 Grafana versions prior to 11.3.3 Grafana versions prior to 11.4.1 Grafana versions prior to 11.5.0...

PT-2025-2010

Name of the Vulnerable Software and Affected Versions WP MediaTagger WordPress plugin versions 4.1.1 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This coul...

PT-2025-2778 · Ssh Communications Security · Ssh Communication Security Privx

Name of the Vulnerable Software and Affected Versions: SSH Communication Security PrivX versions 18.0 through 36.0 Description: The issue is related to insufficient validation of public key signatures in SSH connections via a proxy port. This allows an existing account to impersonate another...

PT-2025-2073

Name of the Vulnerable Software and Affected Versions Privacy Policy Genius WordPress plugin versions through 2.0.4 Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This...

Rockwell Automation KEPServer

RISK EVALUATION Successful exploitation of this vulnerability could cause the device to crash. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices...

New Rock Technologies Cloud Connected Devices

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker full control of the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all...

Rockwell Automation FactoryTalk AssetCentre

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to extract passwords, access, credentials, or impersonate other users. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities,...

PT-2025-1932 · WordPress · Bulk Me Now!

Name of the Vulnerable Software and Affected Versions: Bulk Me Now! WordPress plugin versions 2.0 and earlier Description: The issue is related to the lack of CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks. Recommendations...

PT-2025-1585 · WordPress · Tracking Code Manager

Name of the Vulnerable Software and Affected Versions: Tracking Code Manager WordPress plugin version 2.4.0 and earlier Description: The issue allows users with a role as low as Contributor to perform Cross-Site Scripting attacks due to the plugin not sanitizing and escaping some of its metabox...

RCE (Remote Code Execution) org.apache.avro:avro Dependency in Bitbucket Data Center and Server

This High severity org.apache.avro:avro Dependency vulnerability was introduced in versions 8.6.0, 8.7.0, 8.8.0, 8.9.0, 8.10.0, 8.11.0, 8.12.0, 8.13.0, 8.14.0, 8.15.0, 8.16.0, 8.17.0, 8.18.0, 8.19.0, 9.0.0, 9.1.0, and 9.2.0 of Bitbucket Data Center and Server. This org.apache.avro:avro Dependency...

PT-2025-3444 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RuoYi version 4.8.0 Description: A SQL injection issue was found in RuoYi via the orderby parameter at the "/monitor/online/list" API endpoint. Recommendations: For RuoYi version 4.8.0, as a temporary workaround, consider restricting access t...

PT-2025-1306 · Devdojo · Devdojo Voyager

Name of the Vulnerable Software and Affected Versions: DevDojo Voyager versions 1.8.0 and earlier Description: The issue allows an authenticated user to bypass file type verification when uploading a file via the "/admin/media/upload" endpoint. This can lead to the upload of a web shell, resultin...