CVE-2025-54068 Livewire vulnerable to remote command execution during property update hydration

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is...

K000152614: Apache Commons vulnerability CVE-2025-48976

Security Advisory Description Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to...

CVE-2025-54064 rucio-server, rucio-ui, and rucio-webui vulnerable to insertion of X-Rucio-Auth-Token in apache access logfiles

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. The common Rucio helm-charts for the rucio-server, rucio-ui, and rucio-webui define the log format for the apache access log of these components...

PT-2025-29963 · Sophos · Intercept X For Windows

Name of the Vulnerable Software and Affected Versions: Intercept X for Windows versions prior to 1.22 Description: A local privilege escalation issue exists in the Intercept X for Windows installer. If the installer is executed with SYSTEM privileges, a local user may gain system-level access...

PT-2025-29913 · Hollo · Hollo

Name of the Vulnerable Software and Affected Versions: Hollo versions prior to 0.6.5 Description: Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Versions prior to 0.6.5 allow HTML form elements to be submitted, leading to a potential HTML...

PT-2025-29953 · Unknown +1 · Robot Operating System +1

Name of the Vulnerable Software and Affected Versions: Robot Operating System ROS versions prior to Noetic Ninjemys Description: A code injection issue exists in the rostopic command-line tool within the Robot Operating System ROS. The vulnerability is located in the echo verb, which utilizes the...

PT-2025-29977

Name of the Vulnerable Software and Affected Versions Brocade ASCG versions prior to 3.3.0 Description Brocade ASCG versions prior to 3.3.0 allow the use of medium strength cryptography algorithms on internal ports 9000 and 8036. Recommendations Update Brocade ASCG to version 3.3.0 or later...

Debian dsa-5963 : chromium - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5963 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5963-1 [email protected] https://www.debian.org/securit...

PT-2025-29947

Name of the Vulnerable Software and Affected Versions Livewire versions 3.0 through 3.6.3 Description An issue in the hydration process of component property updates allows unauthenticated attackers to achieve remote command execution RCE. The flaw occurs because the framework fails to verify...

K000152592: Apache Tomcat vulnerability CVE-2025-46701

Security Advisory Description Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1...

BIT-TOMCAT-2025-52520 Apache Tomcat: DoS via integer overflow in multipart file upload

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0 through 11.0.8, from 10.1.0 through 10.1.42, from 9.0.0 through 9.0.106. The following versions...

CVE-2025-7575

A vulnerability has been found in Zavy86 WikiDocs up to 1.0.77 and classified as critical. Affected by this vulnerability is the function imagedropuploadajax/imagedeleteajax of the file submit.php. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version...

PT-2025-29710 · Unknown +1 · Woocommerce +1

Name of the Vulnerable Software and Affected Versions: Counter live visitors for WooCommerce plugin for WordPress versions up to and including 1.3.6 Description: The Counter live visitors for WooCommerce plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path...

PT-2025-29873

Name of the Vulnerable Software and Affected Versions BIND versions 9.20.0 through 9.20.10 BIND versions 9.21.0 through 9.21.9 BIND versions 9.20.9-S1 through 9.20.10-S1 Description If a named caching resolver is configured with serve-stale-enable set to yes, and with stale-answer-client-timeout...

Oracle MySQL Server 8.0.0 - 8.0.41, 8.4.0 - 8.4.4, 9.0.0 - 9.2.0 Security Update (cpujul2025) - Linux

Oracle MySQL Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-29716 · WordPress · The Ultimate Wp Mail

Name of the Vulnerable Software and Affected Versions: The Ultimate WP Mail versions 1.0.17 through 1.3.6 Description: The plugin is susceptible to privilege escalation due to insufficient authorization within the get email log details AJAX handler. The handler retrieves email log post content,...

PT-2025-29868 · Voidbot · Voidbot

Name of the Vulnerable Software and Affected Versions: VoidBot Open-Source versions 0.0.1 through 0.8.1 Description: VoidBot Open-Source is a customizable Discord bot. A flaw exists in the command handler where permission checks are not properly enforced for certain administrative commands. This...

PT-2025-29831

Name of the Vulnerable Software and Affected Versions Authen::SASL::Perl::DIGEST MD5 versions 2.04 through 2.1800 Description The cnonce client nonce is generated insecurely from an MD5 hash of the PID, the epoch time, and the built-in rand function. The PID originates from a limited set of...

PT-2025-29727 · Unknown · Alexvtn Chatbox Manager

Name of the Vulnerable Software and Affected Versions: alexvtn Chatbox Manager versions through 1.2.5 Description: The software contains a missing authorization flaw due to incorrectly configured access control security levels. Recommendations: Update alexvtn Chatbox Manager to a version later th...

PT-2025-29717 · WordPress · Media Library Assistant

Name of the Vulnerable Software and Affected Versions: Media Library Assistant plugin for WordPress versions up to and including 3.26 Description: The Media Library Assistant plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s mla tag cloud and mla term list...