CVE-2025-3017

TA-Lib up to version 0.6.4 is affected by an out-of-bounds write in the ta_regtest component (file src/tools/ta_regtest/ta_test_func/test_minmax.c, function setInputBuffer). The issue allows local exploitation and has public disclosure. A patch identifier is 5879180e9070ec35d52948f2f57519713256a0...

CVE-2025-3017 TA-Lib ta_regtest test_minmax.c setInputBuffer out-of-bounds write

A vulnerability, which was classified as critical, has been found in TA-Lib up to 0.6.4. This issue affects the function setInputBuffer of the file src/tools/taregtest/tatestfunc/testminmax.c of the component taregtest. The manipulation leads to out-of-bounds write. It is possible to launch the...

CVE-2025-3016

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument...

CVE-2025-3015 Open Asset Import Library Assimp ASE File ASELoader.cpp BuildUniqueRepresentation out-of-bounds

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/ASELoader.cpp of the component ASE File Handler. The manipulation of the argument mIndices leads ...

CGA-MHJW-7F5M-83JF

Bulletin has no description...

CVE-2025-3048 Path Traversal in AWS SAM CLI allows file copy to local cache

After completing a build with AWS Serverless Application Model Command Line Interface SAM CLI which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outsid...

CVE-2025-2402 Hard-coded password for object store of KNIME Business Hub

A hard-coded, non-random password for the object store minio of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the password to read and manipulate swapped jobs or read and manipulate in- and output data of active jobs. It...

PT-2025-13918 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.4 macOS versions prior to 14.7.5 Description: An access issue was addressed with additional sandbox restrictions. This issue allows an app to potentially access sensitive user data. Recommendations: For macOS versio...

PT-2025-13951

Name of the Vulnerable Software and Affected Versions macOS versions prior to Ventura 13.7.5 macOS versions prior to Sequoia 15.4 macOS versions prior to Sonoma 14.7.5 Description An issue was identified in the handling of directory paths, specifically a parsing problem. This was addressed throug...

PT-2025-13937

Name of the Vulnerable Software and Affected Versions visionOS versions prior to 2.4 iOS versions prior to 18.4 iPadOS versions prior to 18.4 macOS Sequoia versions prior to 15.4 Description An out-of-bounds write issue was addressed with improved input validation. This issue may allow an app to...

PT-2025-13941 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.4 Description: A privacy issue was addressed with improved private data redaction for log entries. A sandboxed app may be able to access sensitive user data in system logs. Recommendations: For versions prior to 15....

PT-2025-13715 · WordPress · Aphotrax Uptime Robot Plugin

Name of the Vulnerable Software and Affected Versions: Aphotrax Uptime Robot Plugin for WordPress versions n/a through 2.3 Description: The issue is related to an SQL Injection vulnerability, allowing attackers to manipulate database queries. This is due to the improper neutralization of special...

PT-2025-13710 · Unknown · Wphocus My Auctions Allegro

Name of the Vulnerable Software and Affected Versions: wphocus My auctions allegro versions 3.6.20 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically a Blind SQL Injection, which affects the wphocus My auctions allegro software. This type of vulnerabilit...

PT-2025-13761 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: Varnish WordPress versions 1.7 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions. The estimated number of potentially affected devices worldwide is not specified. There is no...

PT-2025-13862 · Drupal · Drupal Ai

Name of the Vulnerable Software and Affected Versions: Drupal AI Artificial Intelligence versions 0.0.0 through 1.0.4 Description: The issue is related to an OS Command Injection vulnerability due to improper neutralization of special elements used in an OS command. This allows for OS Command...

PT-2025-13877 · Apple · Macos Sonoma +3

Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.7.5 macOS Sequoia versions prior to 15.4 macOS Sonoma versions prior to 14.7.5 Description: A permissions issue was addressed with additional sandbox restrictions. The issue may cause the "Block All Remote...

Debian dla-4100 : libdata-entropy-perl - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4100 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4100-1 [email protected] https://www.debian.org/lts/security/...

CVE-2025-29928

authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage which is a non-default setting, deleting sessions via the Web Interface or the API would not revoke the session and the session holder wou...

CVE-2025-22398

Dell Unity, versions 5.4 and prior, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution as root...

CVE-2025-30067

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You are fine as long as the Kylin's system an...