16949 matches found
CVE-2025-47748
Netwrix Directory Manager v.11.0.0.0 and before & after v.11.1.25134.03 contains a hardcoded password...
PT-2025-23296 · Unknown · Vanquish Woocommerce Orders & Customers Exporter
Name of the Vulnerable Software and Affected Versions: Vanquish WooCommerce Orders & Customers Exporter versions n/a through 5.0 Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: For versions n/a...
PT-2025-23241 · Unknown · Project Ai
Name of the Vulnerable Software and Affected Versions: Project AI versions prior to pre-beta Description: The issue concerns a hardcoded API key present in the source code of Project AI, a platform for creating AI agents. This problem has been resolved in the pre-beta version. Recommendations: Fo...
PT-2025-23299 · Unknown · Project Portfolio Manager
Name of the Vulnerable Software and Affected Versions: Project Portfolio Manager versions 3DEXPERIENCE R2022x through 3DEXPERIENCE R2025x Description: A stored Cross-site Scripting XSS issue affects Risk Management in Project Portfolio Manager, allowing an attacker to execute arbitrary script cod...
PT-2025-23303 · Ds Systemes · Change Governance In Product Manager
Name of the Vulnerable Software and Affected Versions: Change Governance in Product Manager versions 3DEXPERIENCE R2022x through 3DEXPERIENCE R2025x Description: A stored Cross-site Scripting XSS issue allows an attacker to execute arbitrary script code in a user's browser session. This affects...
PT-2025-23424 · Ibm · Ibm Planning Analytics Local
Name of the Vulnerable Software and Affected Versions: IBM Planning Analytics Local versions 2.0 through 2.1 Description: The issue allows an authenticated user to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure...
CVE-2025-44905
hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Zfilterscaleoffset function...
PT-2025-23309 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.7.x through 10.7.0 Mattermost versions 10.5.x through 10.5.3 Mattermost versions 9.11.x through 9.11.12 Description: The issue is related to the failure of Mattermost to properly enforce access control restrictions for...
Dassault Systèmes Project Portfolio Manager 跨站脚本漏洞
Dassault Systèmes Project Portfolio Manager is an application from Dassault Systèmes, France. It is responsible for developing and implementing the project portfolio management process. A cross-site scripting vulnerability exists in Dassault Systèmes Project Portfolio Manager 3DEXPERIENCE R2022x...
CVE-2025-46570 vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel
vLLM is an inference and serving engine for large language models LLMs. Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT Time to First Token. These timing differences...
CVE-2025-5334
CVE-2025-5334 affects Devolutions Remote Desktop Manager across Windows, macOS, Android, and iOS. The issue is a private information exposure in the user vaults component where, under certain conditions, entries edited by their owners can be moved from user vaults to shared vaults, making private...
Unauthorized Access
com.ritense.valtimo:object-management and com.ritense.valtimo:objecten-api is vulnerable to Unauthorized Access. The vulnerability is due to improper access control and the lack of enforcement of object-management configurations, allowing unauthorized users to list, view, edit, create, or delete...
CVE-2025-37993 can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe
In the Linux kernel, the following vulnerability has been resolved: can: mcan: mcanclassallocatedev: initialize spin lock on device probe The spin lock txhandlingspinlock in struct mcanclassdev is not being initialized. This leads the following spinlock bad magic complaint from the kernel, eg. wh...
MINI-JV9G-4RCV-W7J7
Bulletin has no description...
PT-2025-23220
Name of the Vulnerable Software and Affected Versions Fabio versions prior to 1.6.6 Description Fabio is an HTTPS and TCP router for deploying applications managed by consul. A vulnerability in how it processes hop-by-hop headers allows clients to remove X-Forwarded headers except X-Forwarded-For...
MAL-2025-4561 Malicious code in halodoc (npm)
The package communicates with a domain associated with malicious activity...
BIT-GITLAB-2024-7803 Allocation of Resources Without Limits or Throttling in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A Discord webhook integration may cause DoS...
BIT-VARNISH-2025-47905
Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries...
Out-of-Bounds Read
libassimp.so is vulnerable to Out-of-bounds Read. The vulnerability is due to improper input validation due to insufficient bounds checking in the LWOImporter::CountVertsAndFacesLWO2 function, which may allow local attackers to read unintended memory content...