PT-2025-11530 · Dell · Os10

Name of the Vulnerable Software and Affected Versions: Dell SmartFabric OS10 Software versions 10.5.4.x through 10.6.0.x Description: The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as 'Command Injection'. This could allow a low-privileged...

PT-2025-9016 · Elestio · Elestio Memos

Name of the Vulnerable Software and Affected Versions: elestio memos version 0.23.0 Description: The issue is related to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks. This vulnerability allows attackers to...

PT-2025-8978 · Unknown · Zyx0814 Pichome

Name of the Vulnerable Software and Affected Versions: zyx0814 Pichome version 2.1.0 Description: A critical vulnerability was found in zyx0814 Pichome, affecting an unknown part of the file /index.php?mod=textviewer. The manipulation of the src argument leads to path traversal, allowing remote...

PT-2025-8981 · Unknown · Foogallery

Name of the Vulnerable Software and Affected Versions: FooGallery – Responsive Photo Gallery version 2.4.29 Description: The issue arises from the web application dynamically generating web content without validating the source of potentially untrusted data. This is specifically noted in the file...

PYSEC-2025-3 When using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server.

Published in 2019, the autodzee package is a Python library that bypasses Deezer API restrictions to download music. The package was found to exfiltrate user data to a hardcoded server, which could be used for malicious purposes...

Mautic allows Relative Path Traversal in assets file upload

Summary This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in python-jose

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of python-jose Vulnerability Details CVEID:CVE-2024-33663 DESCRIPTION: python-jose could allow a remote attacker to bypass security restrictions, caused by a flaw when the algorithm field is left unspecified when calling...

CVE-2022-49072 gpio: Restrict usage of GPIO chip irq members before initialization

In the Linux kernel, the following vulnerability has been resolved: gpio: Restrict usage of GPIO chip irq members before initialization GPIO chip irq members are exposed before they could be completely initialized and this leads to race conditions. One such issue was observed for the gc-irq.domai...

PT-2025-8669 · WordPress · Simple:Press Forum

Name of the Vulnerable Software and Affected Versions: Simple:Press Forum versions prior to 6.10.11 Description: The issue arises from the failure to sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting error. This allows malicious...

PT-2025-8681 · WordPress · Sync Posts

Name of the Vulnerable Software and Affected Versions: Post Sync WordPress plugin version 1.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This could be...

PT-2025-23488 · Run Llama +1 · Llama Index +1

Name of the Vulnerable Software and Affected Versions: run-llama/llama index version v0.12.19 Description: An SQL injection vulnerability exists in the delete function of DuckDBVectorStore. This vulnerability allows an attacker to manipulate the ref doc id parameter, enabling them to read and wri...

PT-2025-7803 · Benner · Benner Modernanet

Name of the Vulnerable Software and Affected Versions: Benner ModernaNet versions up to 1.1.0 Description: A critical issue affects some unknown functionality of the file /Home/JS CarregaCombo?formName=DADOS PESSOAIS PLANO&additionalCondition=&insideParameters=&elementToReturn=DADOS PESSOAIS...

PT-2025-7812 · WordPress · The Photo Gallery

Name of the Vulnerable Software and Affected Versions: The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 3.59.9 Description: The issue concerns the Photo Gallery, Sliders, Proofing and WordPress plugin, where some of its image settings are not properly sanitized and...

Siemens SIMATIC Devices Linux Kernel Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2022-3565)

A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function deltimer of the file drivers/isdn/mISDN/l1oipcore.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue...

CVE-2025-24526 Channel export permitted on archived channel when viewing archived channels is disabled

Mattermost versions 10.1.x = 10.1.3, 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access ...

PT-2025-7700

Name of the Vulnerable Software and Affected Versions vTiger CRM version 6.4.0 Description A problematic issue has been identified, affecting the /modules/Mobile/index.php file. The manipulation of the operation argument leads to cross-site scripting. This issue can be exploited remotely...

PT-2025-7689 · Sourcecodester · Sourcecodester Best Employee Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Employee Management System version 1.0 Description: A vulnerability was found in the Add Role Page component, specifically in the file /admin/Operations/Role.php. The issue is related to the manipulation of the assign...

CVE-2024-13818

The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3.9 through publicly exposed log files. This...

PT-2025-16809 · Unknown · Telecontrol Server Basic

Name of the Vulnerable Software and Affected Versions: TeleControl Server Basic versions prior to 3.1.2.2 Description: A SQL injection vulnerability has been identified in the affected application through the internally used Authenticate method. This could allow an unauthenticated remote attacker...

PT-2025-7623 · Unknown · Oxyno-Zeta/S3-Proxy

Name of the Vulnerable Software and Affected Versions: oxyno-zeta/s3-proxy versions prior to 4.18.1 Description: A Reflected Cross-site Scripting XSS vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session...