PT-2025-23796 · Unknown · Airleader Master

Name of the Vulnerable Software and Affected Versions: airleader MASTER version 3.00571 Description: The issue is related to an Improper Authentication vulnerability that allows Authentication Bypass. This vulnerability affects the airleader MASTER device, potentially allowing unauthorized access...

PT-2025-23750

Name of the Vulnerable Software and Affected Versions Fingerprint trustlet versions prior to SMR May-2025 Release 1 Description The issue is an out-of-bounds read in the fingerprint trustlet, allowing local privileged attackers to read out-of-bounds memory. Recommendations For versions prior to S...

CVE-2025-24015 Deno's AES GCM authentication tags are not verified

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions 1.46.0 through 2.1.6 have an issue that affects AES-256-GCM and AES-128-GCM in Deno in which the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks the...

GO-2025-3728 Mattermost fails to properly enforce access control restrictions for System Manager roles in github.com/mattermost/mattermost-server

Mattermost fails to properly enforce access control restrictions for System Manager roles in github.com/mattermost/mattermost-server...

CVE-2025-25019 IBM QRadar Suite Software and IBM Cloud Pak for Security session fixation

IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session after a logout which could allow a user to impersonate another user on the system...

BIT-DRUPAL-2024-11942 Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002

A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...

BELL-CVE-2025-47808

Bulletin has no description...

BELL-CVE-2025-47806

Bulletin has no description...

PT-2025-23671

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.10 Description DataEase is an open source business intelligence and data visualization tool. The issue arises from a flaw in the patch that allows it to be bypassed due to case insensitivity, as INIT and RUNSCRI...

PT-2025-23630 · Ibm · Ibm Qradar Suite +1

Name of the Vulnerable Software and Affected Versions: IBM QRadar Suite Software versions 1.10.12.0 through 1.11.2.0 IBM Cloud Pak for Security versions 1.10.0.0 through 1.10.11.0 Description: The issue allows an unauthenticated user in the environment to obtain highly sensitive information in...

PT-2025-23599

Name of the Vulnerable Software and Affected Versions Parallels Desktop for Mac version 20.2.2 Description A directory traversal vulnerability exists in the PVMP package unpacking functionality. This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to...

GHSA-CP5V-2HMC-3VJX WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint

An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site. By...

CVE-2025-48941 MyBB may disclosure unviewable threads' titles in searches

MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to determine the existence of hidden draft, unapproved, or soft-deleted threads containing specified text in the title. The visibility state...

GHSA-8J8W-WWQC-X596 Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization...

PT-2025-23482 · Qt Company +3 · Qt +3

Name of the Vulnerable Software and Affected Versions: Qt versions 5.15.18 and earlier, 6.0.0 through 6.5.8, 6.6.0 through 6.8.3, and 6.9.0 Description: An issue was found in the private API function qDecodeDataUrl in QtCore, which is used in QTextDocument and QNetworkReply. If the function is...

PT-2025-23502 · Nekernal · Nekernal

Name of the Vulnerable Software and Affected Versions: NeKernal version 0.0.2 Description: NeKernal is a free and open-source operating system stack. It has a 1-byte heap overflow in the rt copy memory function, which unconditionally writes a null terminator at dstlen. When len equals the size of...

CVE-2025-45387

osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php...

SUSE: Security Advisory (SUSE-SU-2025:01783-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ASB-A-367274727

In addattr of sdpdiscovery.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-386346571

In ProtocolMiscCurrentLinkCapacityEstimate of protocolmiscadapter.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...