PT-2025-30554

Name of the Vulnerable Software and Affected Versions Invision Community versions prior to 4.7.20 Description The Invision Community software contains a SQL injection issue in the calendar/view.php file. The vulnerability resides in the IPScalendarmodulesfrontcalendarview::search method, where us...

CGA-C44C-87GQ-886C

Bulletin has no description...

WordPress Social Streams plugin <= 1.2.1 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Thanh Nam Tran in WordPress Plugin Social Streams versions = 1.0.1...

CVE-2025-54140 pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write

pyLoad is a free and open-source Download Manager written in pure Python. In version 0.5.0b3.dev89, an authenticated path traversal vulnerability exists in the /json/upload endpoint of pyLoad. By manipulating the filename of an uploaded file, an attacker can traverse out of the intended upload...

CVE-2025-54138 LibreNMS has Authenticated Local File Inclusion in ajax_form.php that Allows RCE

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajaxform.php endpoint that permits Remote File Inclusion base...

CVE-2025-8032

XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability affects Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1...

MINI-Q6RF-3HWF-298H

Bulletin has no description...

MINI-Q72F-W726-J258

Bulletin has no description...

MINI-J745-XHQ4-JVP5

Bulletin has no description...

MINI-HH35-Q429-38X6

Bulletin has no description...

MINI-HH8M-MV85-H7WW

Bulletin has no description...

MINI-7H48-XF4J-6434

Bulletin has no description...

MINI-8WX9-RQJ4-MR8M

Bulletin has no description...

MINI-6V6J-9RFF-R8FG

Bulletin has no description...

MINI-4445-G433-RHJ9

Bulletin has no description...

MAL-2025-6092 Malicious code in grammarly-editor-sdk (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f24713f82fc90957a8e5834da2735094adc919b65b81f569360b9b8b1c284873 Any computer that has this package installed or running should be considered...

MAL-2025-6076 Malicious code in chime-ci-helper (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 280ad6fead53ce916eb475c521931d23da0e7ef62e5a88845facf02492123707 Any computer that has this package installed or running should be considered...

MAL-2025-6079 Malicious code in chime-secrets (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cc6774ae4b544c6fe8a12fa6caac614e90dfc3e22551bd45e7e2ab1ec60bbfe Any computer that has this package installed or running should be considered...

MAL-2025-6078 Malicious code in chime-core-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb533ce212898abdb893a38eb8ade78a5a77d62616bb84b5e0cf00f93ffec6de Any computer that has this package installed or running should be considered...

CVE-2025-4285

CVE-2025-4285 is a SQL Injection vulnerability in Rolantis Information Technologies Agentis prior to version 4.32. The issue arises from improper neutralization of special elements in SQL commands, enabling an attacker to potentially perform unauthorized database operations. Impacted software is ...