Network Thermostat X-Series WiFi Thermostats

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain full administrative access to the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network...

Medtronic MyCareLink Patient Monitor (Update A)

RISK EVALUATION Successful exploitation of these vulnerabilities could lead to system compromise, unauthorized access to sensitive data, and manipulation of the monitor's functionality. 2. RECOMMENDED PRACTICES CISA reminds organizations to perform proper impact analysis and risk assessment...

PT-2025-30642 · Unknown +1 · Beaver Builder +1

Name of the Vulnerable Software and Affected Versions: Supreme Addons for Beaver Builder plugin for WordPress versions up to and including 1.0.9 Description: The Supreme Addons for Beaver Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting through the auto qrcodesabb...

PT-2025-30970 · Tenda +1 · Tenda Ac18 +1

Name of the Vulnerable Software and Affected Versions: Tenda AC18 version 15.03.05.19 Description: A vulnerability exists in the Tenda AC18 device due to weak password requirements. The issue affects unknown code within the /etc ro/smb.conf file of the Samba component and can be exploited remotel...

PT-2025-30651 · WordPress · Voltax Video Player

Name of the Vulnerable Software and Affected Versions: Voltax Video Player versions prior to 1.6.6 Description: The Voltax Video Player plugin for WordPress is susceptible to Stored Cross-Site Scripting through the id parameter. Insufficient input sanitization and output escaping allow...

PT-2025-30650 · WordPress · Webinarignition

Name of the Vulnerable Software and Affected Versions: WebinarIgnition plugin for WordPress versions up to and including 4.03.31 Description: The WebinarIgnition plugin for WordPress is susceptible to unauthenticated login token generation due to a missing capability check on the webinarignition...

PT-2025-30644 · WordPress · Post Grid Master

Name of the Vulnerable Software and Affected Versions: Post Grid Master versions prior to 3.4.14 Description: The Post Grid Master plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attacker...

Debian dla-4250 : firefox-esr - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4250 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4250-1 [email protected]...

WordPress WebinarIgnition plugin <= 4.03.32 - Unauthenticated Login Token Generation to Authentication Bypass vulnerability

Unauthenticated Login Token Generation to Authentication Bypass vulnerability discovered by kr0d in WordPress Plugin WebinarIgnition versions = 4.03.32...

CVE-2025-54090 Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue...

PT-2025-30516 · WordPress · Fleetwire Fleet Management

Name of the Vulnerable Software and Affected Versions: Fleetwire Fleet Management versions prior to 1.0.20 Description: The Fleetwire Fleet Management plugin for WordPress is susceptible to stored cross-site scripting through the fleetwire list shortcode due to insufficient input sanitization and...

PT-2025-30529 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: An unrestricted file upload of dangerous file types in Samsung Electronics MagicINFO 9 Server allows for code injection. Recommendations: MagicINFO 9 Server versions prior to...

PT-2025-30580 · Httpdasm · Httpdasm

Name of the Vulnerable Software and Affected Versions: httpdasm version 0.92 Description: A path traversal issue exists in httpdasm that allows unauthenticated attackers to read arbitrary files on the host system. An attacker can escape the web root and access sensitive files outside of the...

PT-2025-30572 · Microsoft +1 · Windows +2

Name of the Vulnerable Software and Affected Versions: Imprivata Enterprise Access Management versions 5.3 through 24.2 Description: A flaw in Imprivata Enterprise Access Management formerly Imprivata OneSign allows bypassing the login screen on shared kiosk workstations, potentially granting...

Apache 2.4.x < 2.4.65

The version of Apache httpd installed on the remote host is prior to 2.4.65. It is, therefore, affected by a vulnerability as referenced in the 2.4.65 advisory. - A bug in Apache HTTP Server 2.4.64 results in all RewriteCond expr ... tests evaluating as true. Users are recommended to upgrade to...

PT-2025-30511 · WordPress · The Featured Image Plus – Quick & Bulk Edit With Unsplash

Name of the Vulnerable Software and Affected Versions: Featured Image Plus – Quick & Bulk Edit with Unsplash versions prior to 1.6.4 Description: The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is susceptible to Server-Side Request Forgery via the fip get image...

RHEL 8 / 9 : OpenShift Container Platform 4.15.55 (RHSA-2025:11352)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:11352 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private...

CVE-2025-54072

yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...

Schneider Electric EcoStruxure Power Operation (Update A)

RISK EVALUATION Successful exploitation of these vulnerabilities could result in the loss of system functionality or unauthorized access to system functions. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA...

DuraComm DP-10iN-100-MU

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information or cause a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities,...