CVE-2025-53818

GitHub Kanban MCP Server is a Model Context Protocol MCP server for managing GitHub issues in Kanban board format and streamlining LLM task management. Version 0.3.0 of the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Serv...

Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints

In Eclipse GlassFish version 6.2.5, it is possible to perform a Server Side Request Forgery attack using specific endpoints...

WordPress Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin plugin <= 4.48 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Mika in WordPress Plugin Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin versions = 4.48...

WordPress Animator plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Animator versions = 3.0.16...

WordPress JetSearch plugin <= 3.5.10.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by stealthcopter in WordPress Plugin JetSearch versions = 3.5.10.1...

CVE-2024-9408

In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints...

Information Disclosure

Indico is vulnerable to information disclosure. The vulnerability is due to an endpoint exposing user details such as name, affiliation, and email in bulk when listed in certain fields like ACLs, which allows an attacker to retrieve basic user information without proper authorization...

BIT-GITLAB-2025-6168 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests...

BIT-PHP-MIN-2025-6491 NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 when parsing XML data in SOAP extensions, overly large 2Gb XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server...

Arbitrary Code Execution (ACE)

job-iteration is vulnerable to Arbitrary Code Execution ACE. The vulnerability is due to improper handling of input in the CsvEnumerator class, which allows an attacker to execute arbitrary commands on the host system by exploiting unsanitized file paths or untrusted input...

BELL-CVE-2025-6965

Bulletin has no description...

BELL-CVE-2025-50106

Bulletin has no description...

BELL-CVE-2025-53905

Bulletin has no description...

PT-2025-29819 · Unity Business Technology Pty · The E-Commerce Erp

Name of the Vulnerable Software and Affected Versions: The E-Commerce ERP versions n/a through 2.1.1.3 Description: An incorrect privilege assignment issue exists in Unity Business Technology Pty Ltd The E-Commerce ERP, allowing privilege escalation. Recommendations: Update The E-Commerce ERP to ...

PT-2025-29767 · WordPress · Bplugins Lightbox Block

Name of the Vulnerable Software and Affected Versions: bPlugins LightBox Block versions through 1.1.30 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS. This can lead to the execution of...

PT-2025-29763 · WordPress · Wp Hide Post

Name of the Vulnerable Software and Affected Versions: xfinitysoft WP Post Hide versions n/a through 1.0.9 Description: A Cross-Site Request Forgery CSRF issue exists in xfinitysoft WP Post Hide, allowing attackers to perform actions on behalf of an authenticated user. Recommendations: Update...

PT-2025-29873

Name of the Vulnerable Software and Affected Versions BIND versions 9.20.0 through 9.20.10 BIND versions 9.21.0 through 9.21.9 BIND versions 9.20.9-S1 through 9.20.10-S1 Description If a named caching resolver is configured with serve-stale-enable set to yes, and with stale-answer-client-timeout...

PT-2025-29748 · Unknown · Kyle Gilman Videopack

Name of the Vulnerable Software and Affected Versions: Kyle Gilman Videopack versions through 4.10.3 Description: The software contains a DOM-Based Cross-site Scripting issue due to improper neutralization of input during web page generation. Recommendations: Update to a version later than 4.10.3...

PT-2025-29739 · Crocoblock · Jetpopup

Name of the Vulnerable Software and Affected Versions: Crocoblock JetPopup versions through 2.0.15.1 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, specifically a Stored Cross-site Scripting XSS flaw. This allows for the injection of...

PT-2025-29799 · Unknown · Infility Global

Name of the Vulnerable Software and Affected Versions: Infility Global versions through 2.13.4 Description: Infility Global is susceptible to a Reflected Cross-Site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update Infility Global to a...