PT-2025-22125

Name of the Vulnerable Software and Affected Versions: Rapid7 AppSpider Pro versions prior to 7.5.018 Description: The issue is related to a stored cross-site scripting vulnerability in the ScanName field. Although the application prevents the inclusion of special characters within the ScanName...

PT-2025-22172 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A NULL pointer dereference issue has been identified in the Linux kernel, specifically in the ptp: ocp module, related to Adva board SMA sysfs operations. The issue occurs when irig an...

Adobe Connect Cross-Site Scripting Vulnerability (CNVD-2025-10675)

Adobe Connect is a software for creating meeting environments from the American company Audobee Adobe. Adobe Connect suffers from a cross-site scripting vulnerability that can be exploited by an attacker to execute malicious JavaScript...

PT-2025-22150 · Schweitzer Engineering Laboratories · Sel-5056 Software-Defined Network Flow Controller

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue allows password guessing limits to be bypassed when using LDAP authentication. Recommendations: At the moment, there is no information about a newer version that contains a fix for...

PT-2025-22424

Name of the Vulnerable Software and Affected Versions Vertiv affected versions not specified Description The issue is a stack-based buffer overflow that could allow an attacker to gain code execution on the device. This can be exploited by an attacker to execute malicious code. Recommendations At...

PT-2025-22136 · Zalo · Zalo

Name of the Vulnerable Software and Affected Versions: Zalo version 23.09.01 Description: The issue allows attackers to obtain sensitive user information via a crafted GET request. Recommendations: For Zalo version 23.09.01, at the moment, there is no information about a newer version that contai...

PT-2025-22153 · Schweitzer Engineering Laboratories · Sel-5056 Software-Defined Network Flow Controller

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue is related to improper limitation of pathname in Circuit Provisioning and File Import applications, allowing modification and uploading of files. Recommendations: At the moment,...

PT-2025-28933 · Ооо "Вебсофт Девелопмент" · Websoft Hcm

Уязвимость программного обеспечения автоматизации HR-процессов Websoft HCM связана с несоответствием ответов на входящие запросы. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, раскрыть защищаемую информацию...

CVE-2025-47934

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. Startinf in version 5.0.1 and prior to versions 5.11.3 and 6.1.1, a maliciously modified message can be passed to either openpgp.verify or openpgp.decrypt, causing these functions to return a valid signature verification result...

GHSA-XWGG-M7FX-83WX Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation

A security vulnerability was discovered in Gardener that could allow a user with administrative privileges for a Gardener project or a user with administrative privileges for a shoot cluster, including administrative privileges for a single namespace of the shoot cluster, to obtain control over t...

DEBIAN-CVE-2025-4945

A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior,...

WordPress AutomatorWP plugin <= 5.2.1.3 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by RoyTdd in WordPress Plugin AutomatorWP versions = 5.2.1.3...

WordPress Rootspersona plugin <= 3.7.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by domiee13 Patchstack Alliance in WordPress Plugin Rootspersona versions = 3.7.5...

WordPress WP Mapa Politico España plugin <= 3.8.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross Site Request Forgery CSRF to Settings Change vulnerability discovered by Chu The Anh Blue Rock in WordPress Plugin WP Mapa Politico España versions = 3.8.0...

CVE-2025-26621 OpenCTI vulnerable to Denial of Service through web hook

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype...

CVE-2025-47756

The CVE-2025-47756 entry concerns Fuji Electric V-SFT (versions up to 6.2.5.0). The vulnerability is an out-of-bounds read in VS6EditData!CGamenDataRom::set_mr400_strc, triggered by specially crafted V7/V8 files, which may cause a crash, information disclosure, or arbitrary code execution. Docume...

CVE-2025-47749

V-SFT v6.2.5.0 and earlier contains an issue with free of pointer not at start of buffer in VS6EditData.dll!CWinFontInf::WinFontMsgCheck function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution...

CVE-2025-23165

In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uvfss.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory...

WordPress profilepro plugin <= 1.3 - Subscriber+ Stored Cross Site Scripting vulnerability

Subscriber+ Stored Cross Site Scripting vulnerability discovered by Vuln Seeker Cybersecurity Team in WordPress Plugin profilepro versions = 1.3...

WordPress Badgearoo plugin <= 1.0.14 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin Badgearoo versions = 1.0.14...