CVE-2025-4091

Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 13...

BELL-CVE-2025-46646

Bulletin has no description...

CVE-2025-46329 Snowflake Connector for C/C++ inserts client-side encryption key in DEBUG logs

libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the target stage durin...

PT-2025-18210 · Yeswiki · Yeswiki

Name of the Vulnerable Software and Affected Versions: YesWiki versions prior to 4.5.4 Description: The issue allows a malicious user to create and download site backups without authentication. This could result in a malicious attacker making numerous requests to create archives and fill up the...

PT-2025-18213 · Unknown · Khc-Invitation-Automation

Name of the Vulnerable Software and Affected Versions: KHC-INVITATION-AUTOMATION version 1.2 Description: The issue concerns a GitHub automation script where user data, including email addresses and Discord usernames, were exposed in API responses without proper access controls. This allowed...

PT-2025-18209 · Auth0 · Auth0 Next.Js Sdk

Name of the Vulnerable Software and Affected Versions: Auth0 Next.js SDK versions 4.0.1 through 4.5.0 Description: The issue arises from the failure to invoke .setExpirationTime when generating a JWE token for the session in the Auth0 Next.js SDK. This results in the JWE not containing an interna...

PT-2025-18170 · Ibm · Ibm Operational Decision Manager

Name of the Vulnerable Software and Affected Versions: IBM Operational Decision Manager versions 8.11.0.1 through 9.0.0.1 Description: The issue allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to...

PT-2025-18164 · Unknown · Theater Seat Booking System

Name of the Vulnerable Software and Affected Versions: Theater Seat Booking System version 1.0 Description: A critical issue has been found in the Theater Seat Booking System, affecting the cancel function. The manipulation of the cancelcustomername argument leads to a stack-based buffer overflow...

Cross-site Scripting (XSS)

Laravel Starter is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient input sanitization that allowing users to inject malicious JavaScript code into the tag name field...

MAL-2025-3504 Malicious code in turbo-bike-inspector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b2b7e282a4f78a18dbc7c28f2200bea91788bc176c9f76173a34af8ead206dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-18034 · 104 · Ehrms

Name of the Vulnerable Software and Affected Versions: eHRMS from 104 Corporation affected versions not specified Description: The issue allows unauthenticated remote attackers to execute arbitrary JavaScript codes in a user's browser through phishing attacks. This is a Reflected Cross-site...

CVE-2025-2185

ALBEDO Telecom Net.Time - PTP/NTP clock Serial No. NBC0081P software release 1.4.4 is vulnerable to an insufficient session expiration vulnerability, which could permit an attacker to transmit passwords over unencrypted connections, resulting in the product becoming vulnerable to interception...

PT-2025-17969 · Nasa · Nasa Cryptolib

Name of the Vulnerable Software and Affected Versions: NASA CryptoLib versions prior to 1.3.2 Description: The issue is related to the OTAR crypto function in NASA CryptoLib, where the returned status is not checked, potentially leading to spacecraft hijacking. Recommendations: For NASA CryptoLib...

PT-2025-18006 · Unknown · Dazhouda Lecms

Name of the Vulnerable Software and Affected Versions: dazhouda lecms version 3.0.3 Description: A vulnerability was found in the software, which has been rated as problematic. It affects some unknown functionality of the file admin/view/default/user set.htm, leading to information disclosure. Th...

PT-2025-18011 · Nortikin · Sverchok

Name of the Vulnerable Software and Affected Versions: nortikin Sverchok version 1.3.0 Description: A problematic issue was found in the function SvSetPropNodeMK2 of the file sverchok/nodes/object nodes/getsetprop mk2.py of the component Set Property Mk2 Node. This issue leads to improperly...

PT-2025-17972 · Nasa · Nasa Cryptolib

Name of the Vulnerable Software and Affected Versions: NASA CryptoLib versions prior to 1.3.2 Description: The issue is related to the key state not being checked before use in NASA CryptoLib, potentially leading to spacecraft hijacking. Recommendations: For NASA CryptoLib versions prior to 1.3.2...

BIT-GITLAB-2024-12244 Missing Authorization in GitLab

An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1...

OSV-2025-298 Heap-buffer-overflow in i18n::phonenumbers::UnicodeText::const_iterator::operator--

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=413161357 Crash type: Heap-buffer-overflow READ 1 Crash state: i18n::phonenumbers::UnicodeText::constiterator::operator-- i18n::phonenumbers::UnicodeString::tempSubString...

CVE-2025-46656

python-markdownify aka markdownify before 0.14.1 allows large headline prefixes such as in addition to through . This causes memory consumption...

PT-2025-17962

Name of the Vulnerable Software and Affected Versions Formidable versions 2.1.0 through 3.x before 3.5.3 Description The issue relies on hexoid to prevent guessing of filenames for untrusted executable content. However, hexoid is documented as not cryptographically secure. There is a scenario in...