PT-2025-15720 · Squeeze · Squeeze

Name of the Vulnerable Software and Affected Versions: Bogdan Bendziukov Squeeze versions n/a through 1.6 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the use of malicious files. Recommendations: For versions n/a through 1.6, consider restricti...

PT-2025-15910

Name of the Vulnerable Software and Affected Versions OttoKit formerly SureTriggers versions 1.0.0 through 1.0.78 Description The vulnerability is related to an authentication bypass issue in the OttoKit WordPress plugin, which allows unauthenticated attackers to create administrator accounts on...

Gitlab -- Vulnerabilities

Gitlab reports: Denial of service via CI pipelines Unintentionally authorizing sensitive actions on users behalf IP Restriction Bypass through GraphQL Subscription Unauthorized users can list the number of confidential issues Debugging Information Disclosed...

CVE-2025-25013 Elastic Defend Insertion of Sensitive Information into Log Files

Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmission of unfiltered environment variables to the stack...

CVE-2024-50565

CVE-2024-50565 affects Fortinet FortiOS, FortiProxy, FortiManager, FortiAnalyzer, FortiVoice, and FortiWeb across multiple major versions, due to an improper restriction of the FGFM channel that permits an unauthenticated MITM attacker to impersonate the management device (FortiCloud/FortiManager...

CVE-2025-29986

Dell Common Event Enabler, versions CEE 9.0.0.0, contains an Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Common Anti-Virus Agent CAVA. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized...

CVE-2025-29986

Dell Common Event Enabler, versions CEE 9.0.0.0, contains an Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Common Anti-Virus Agent CAVA. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized...

CVE-2025-29986

Dell Common Event Enabler, versions CEE 9.0.0.0, contains an Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Common Anti-Virus Agent CAVA. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized...

CVE-2025-29986

Dell Common Event Enabler, versions CEE 9.0.0.0, contains an Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Common Anti-Virus Agent CAVA. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized...

CVE-2025-29986

CVE-2025-29986 affects Dell’s Common Event Enabler (CEE) , specifically version 9.0.0.0 , where the vulnerability lies in the Common Anti-Virus Agent (CAVA) . The root cause is an improper restriction of the communication channel to intended endpoints , which could allow an unauthenticated attack...

PT-2025-15354 · Unknown · Mymagicpower Aias

Name of the Vulnerable Software and Affected Versions: mymagicpower AIAS version 20250308 Description: A critical issue has been found in the processing of the file 3 api platform/api-platform/src/main/java/top/aias/platform/controller/AsrController.java. The manipulation of the url argument lead...

PT-2025-15332 · WordPress · Melhor Envio

Name of the Vulnerable Software and Affected Versions: Melhor Envio plugin for WordPress versions up to and including 2.15.9 Description: The issue allows unauthenticated attackers to extract sensitive data, including environment information, plugin tokens, shipping configurations, and limited...

PT-2025-15465 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 10.0.3 Description: The issue is related to the save function in HAXCMSFile.php, which allows for unrestricted file uploads due to a non-exhaustive denylist. This list only blocks files with .php, .sh, .js, and...

PT-2025-15318 · WordPress · Streamit

Name of the Vulnerable Software and Affected Versions: Streamit theme for WordPress versions prior to 4.0.3 Description: The issue allows for privilege escalation via account takeover due to improper validation of a user's identity prior to updating their details, such as email, in the st...

PT-2025-20391 · Totolink · Totolink Nr1800X

Name of the Vulnerable Software and Affected Versions: TOTOLINK NR1800X version 9.1.0u.6681 B20230703 Description: The issue is an authenticated stack overflow that occurs via the ssid5g parameter in the setWiFiEasyCfg function. This allows for potential exploitation. Recommendations: For TOTOLIN...

PT-2025-15340

Name of the Vulnerable Software and Affected Versions: Galaxy Watch versions prior to SMR Apr-2025 Release 1 Description: The issue is related to improper authorization in the wireless download protocol, allowing physical attackers to update the device unique identifier of Watch devices. This cou...

CVE-2025-29986: Improper Restriction of Communication Channel to Intended Endpoints

Dell Common Event Enabler, versions CEE 9.0.0.0, contains an Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Common Anti-Virus Agent CAVA. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized...

PT-2025-15442

Name of the Vulnerable Software and Affected Versions: IBM Personal Communications versions 14 through 15 Description: The issue allows any interactively logged-in users on the target computer to run commands with full privileges in the context of NT AUTHORITYSYSTEM. This enables a low-privileged...

PT-2025-15352

Name of the Vulnerable Software and Affected Versions: Nothings stb up to f056911 Description: A critical vulnerability has been found in Nothings stb, affecting the stb include string function. The manipulation of the path to includes argument leads to a stack-based buffer overflow. This issue c...

PT-2025-15338 · Unknown · Hdcp Trustlet

Name of the Vulnerable Software and Affected Versions: HDCP trustlet versions prior to SMR Apr-2025 Release 1 Description: The issue is related to improper access control in the HDCP trustlet, allowing local attackers with shell privilege to escalate their privileges to root. This can be exploite...