PT-2025-27791 · Unknown · Flatboard Pro

Name of the Vulnerable Software and Affected Versions: Flatboard Pro versions prior to 3.2.2 Description: The issue is a Stored Cross-Site Scripting XSS vulnerability due to the lack of proper validation of user input. This occurs through the replace parameter in the "/config.php/tags" endpoint...

PT-2025-27800 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.16 multi Description: The issue is related to a Buffer Overflow in the SetSysTimeCfg function via the time parameter. Recommendations: For Tenda AC6 version 15.03.05.16 multi, consider restricting access to the...

PT-2025-27785 · Endress+Hauser · Endress+Hauser Meac300-Fnade4

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The login mechanism of the affected system does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to...

PT-2025-27797 · WordPress · Jkdevkit

Name of the Vulnerable Software and Affected Versions: JKDEVKIT plugin for WordPress versions up to, and including, 1.9.4 Description: The issue is related to insufficient file path validation in the font upload handler function, allowing authenticated attackers with Subscriber-level access and...

PT-2025-27768 · Opentext · Opentext Groupwise

Name of the Vulnerable Software and Affected Versions: OpenText GroupWise versions 7 through 17.5 OpenText GroupWise version 23.4 OpenText GroupWise version 24.1 OpenText GroupWise version 24.2 OpenText GroupWise version 24.3 OpenText GroupWise version 24.4 Description: The issue is related to an...

PT-2025-27821 · Mitsubishi · Melsec Iq-F Series Fx5-Cclgn-Ms +69

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric MELSEC iQ-F Series affected versions not specified Description: The software contains an overly restrictive account lockout mechanism. A remote, unauthenticated attacker can lockout legitimate users by repeatedly attemptin...

PT-2025-27799 · Plesk · Plesk Obsidian

Name of the Vulnerable Software and Affected Versions: Plesk Obsidian version 18.0.69 Description: The issue allows unauthenticated requests to the "/login up.php" API endpoint to reveal sensitive AWS credentials, including accessKeyId, secretAccessKey, region, and endpoint. Recommendations: For...

PT-2025-27804 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.16 multi Description: The issue is related to a Buffer Overflow in the fromSetRouteStatic function via the list parameter. This can be exploited by sending a malformed route list parameter. Recommendations: For Tend...

PT-2025-27605 · Red Hat · Red Hat Advanced Cluster Management

Name of the Vulnerable Software and Affected Versions: Red Hat Advanced Cluster Management versions 2.10 through 2.10.6 Red Hat Advanced Cluster Management versions 2.11 through 2.11.3 Red Hat Advanced Cluster Management versions 2.12 through 2.12.3 Description: A flaw in Red Hat Advanced Cluster...

PT-2025-27586 · WordPress · The Ads Pro Plugin

Name of the Vulnerable Software and Affected Versions: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager versions up to, and including, 4.89 Description: The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the bsa template parameter o...

PT-2025-27589 · WordPress · The Ads Pro Plugin

Name of the Vulnerable Software and Affected Versions: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager versions up to, and including, 4.89 Description: The issue is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an...

PT-2025-27620 · WordPress · Vikinger +1

Name of the Vulnerable Software and Affected Versions: Vikinger theme for WordPress versions up to, and including, 1.9.32 Description: The issue is related to insufficient file path validation in the vikinger delete activity media ajax function. This allows authenticated attackers with...

PT-2025-27614

Name of the Vulnerable Software and Affected Versions: Infinera G42 version R6.1.3 Description: The issue is related to a misconfiguration in the sudoers configuration of the operating system, which allows low-privileged OS users to read and write physical memory via the devmem command line tool...

PT-2025-27629 · Gfi · Gfi Kerio Control

Name of the Vulnerable Software and Affected Versions: GFI Kerio Control version 9.4.5 Description: A remote code execution issue allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .i...

PT-2025-27644 · Poppler +3 · Poppler +3

Name of the Vulnerable Software and Affected Versions: Poppler versions prior to 25.06.0 Description: The issue is related to the use of std::atomic int for reference counting in the Poppler PDF rendering library. Since std::atomic int is only 32 bits, it is possible to overflow the reference...

PT-2025-27641 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - TwoColConflict Extension versions 1.39.X through 1.39.12 Mediawiki - TwoColConflict Extension versions 1.42.X through 1.42.6 Mediawiki - TwoColConflict Extension versions 1.43.X through 1.43.1 Description: The issue is related to...

PT-2025-27582 · WordPress · Lead Form Data Collection To Crm

Name of the Vulnerable Software and Affected Versions: Lead Form Data Collection to CRM plugin for WordPress versions up to, and including, 3.1 Description: The issue allows unauthorized modification of data, leading to privilege escalation due to a missing capability check on the doFieldAjaxActi...

PT-2025-27607 · Nokia · Nokia Single Ran Baseband

Name of the Vulnerable Software and Affected Versions: Nokia Single RAN baseband software versions prior to 24R1-SR 1.0 MP Description: The issue arises when a crafted SOAP "provision" operation message archive field is sent within the Mobile Network Operator MNO internal Radio Access Network RAN...

PT-2025-27595 · WordPress · The Ads Pro Plugin

Name of the Vulnerable Software and Affected Versions: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin versions up to, and including, 4.89 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the bsaCreateAdTemplat...

Voltronic Power and PowerShield UPS monitoring software

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an unauthenticated attacker remotely to make configuration changes, resulting in shutting down UPS connected devices or execution of arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures...