PT-2025-21354 · Dell · Dell Powerscale Insightiq

Name of the Vulnerable Software and Affected Versions: Dell PowerScale InsightIQ versions 5.0 through 5.2 Description: The issue is related to improper privilege management. An unauthenticated attacker with remote access could potentially exploit this, leading to elevation of privileges...

PT-2025-21431 · WordPress · Twitter Bootstrap Collapse Aka Accordian Shortcode

Name of the Vulnerable Software and Affected Versions: Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin versions 1.0 and earlier Description: The issue concerns the Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin, which does not properly validate and escape...

PT-2025-21442 · WordPress · Buddyboss Platform

Name of the Vulnerable Software and Affected Versions: buddyboss-platform versions prior to 2.7.60 Description: The issue is related to improper access controls in the buddyboss-platform WordPress plugin, allowing a logged-in user to view comments on private posts. Recommendations: For versions...

PT-2025-21456 · WordPress · Rbs Image Gallery

Name of the Vulnerable Software and Affected Versions: Rbs Image Gallery WordPress plugin versions prior to 3.2.24 Description: The issue concerns the Rbs Image Gallery WordPress plugin, where some settings are not properly sanitized and escaped. This could allow high-privilege users, such as...

GHSA-RF73-97J8-9VQH Jenkins Cadence vManager Plugin is Missing Permission Checks

Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a740ba48 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password...

GHSA-PWM3-776C-8Q7Q BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager on Windows, MacOS, Linux XML parsing components modules allows Data Serialization External Entities Blowup. This vulnerability is associated with program files...

WordPress UiPress lite plugin <= 3.5.07 - Authenticated (Subscriber+) Remote Code Execution vulnerability

Authenticated Subscriber+ Remote Code Execution vulnerability discovered by WordFence in WordPress Plugin UiPress lite versions = 3.5.07...

WordPress Weluka Lite plugin <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Chuck in WordPress Plugin Weluka Lite versions = 1.0.3...

CVE-2025-47708

Cross-Site Request Forgery CSRF vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0...

CVE-2025-47777 5ire Client Vulnerable to Cross-Site Scripting (XSS) and Remote Code Execution (RCE)

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Versions prior to 0.11.1 are vulnerable to stored cross-site scripting in chatbot responses due to insufficient sanitization. This, in turn, can lead to Remote Code Execution RCE via unsafe...

CVE-2025-24785 iTop dashboard vulnerable to denial of service

iTop is an web based IT Service Management tool. In version 3.2.0, an attacker may send a URL to the server to trigger a PHP error. The next user trying to load this dashboard would encounter a crashed start page. Version 3.2.1 fixes the issue by checking the provided layoutclass before saving th...

CVE-2025-24026 iTop Inefficient Regular Expression Complexity vulnerability

iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service ReDoS that may, under some circumstances, affect iTop server. Version 3.2.1 doesn't use the affected variable in the regular expression. As a workaround, if iTop...

BELL-CVE-2025-46803

Bulletin has no description...

BELL-CVE-2025-26646

Bulletin has no description...

Denial Of Service (DoS)

org.apache.activemq, activemq-client is vulnerable to Denial Of Service DoS. The vulnerability is due to missing or insufficient validation of buffer size values during the unmarshalling of OpenWire commands, allows attackers to supply excessively large size values, leading to uncontrolled memory...

PT-2025-21247 · Oa System · Oa System

Name of the Vulnerable Software and Affected Versions: OA System versions prior to 2025.01.01 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at the...

PT-2025-21168 · Itop · Itop

Name of the Vulnerable Software and Affected Versions: iTop versions prior to 2.7.12 iTop versions prior to 3.1.3 iTop versions prior to 3.2.1 Description: The issue affects iTop, a web-based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having...

PT-2025-21192 · Unknown +1 · Klaro Cookie & Consent Management +1

Name of the Vulnerable Software and Affected Versions: Klaro Cookie & Consent Management versions 0.0.0 through 3.0.4 Description: The issue affects Drupal Klaro Cookie & Consent Management, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation...

Alibaba Cloud Linux 3 : 0069: libmicrohttpd (ALINUX3-SA-2024:0069)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0069 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2023-27371: GNU libmicrohttpd before 0.9.76...

Alibaba Cloud Linux 3 : 0090: spice and spice-gtk (ALINUX3-SA-2021:0090)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2021:0090 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2020-14355: Multiple buffer overflow...