PT-2025-23104

Name of the Vulnerable Software and Affected Versions Kea versions 2.4.0 through 2.4.1 Kea versions 2.6.0 through 2.6.2 Kea versions 2.7.0 through 2.7.8 Description Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave...

PT-2025-16016

Name of the Vulnerable Software and Affected Versions Arm Ltd Valhall GPU Kernel Driver versions r29p0 through r53p0 Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver versions r41p0 through r53p0 TP-Link Smart Hub versions prior to an unspecified fixed version Description A Use After Free issue ...

PT-2025-15988 · Unknown · Codeastro Internet Banking System

Name of the Vulnerable Software and Affected Versions: Code Astro Internet Banking System version 2.0.0 Description: A Remote Code Execution RCE vulnerability exists due to improper file upload validation in the profile pic parameter within pages view client.php. Recommendations: Code Astro...

WordPress Embedder plugin 1.3-1.3.5 - Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by kr0d in WordPress Plugin Embedder versions 1.3-1.3.5...

WordPress Checkout Mestres WP plugin <= 8.7.5 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by LVT-tholv2k in WordPress Plugin Checkout Mestres WP versions = 8.7.5...

WordPress Essential Breadcrumbs plugin <= 1.1.1 - CSRF to Privilege Escalation vulnerability

CSRF to Privilege Escalation vulnerability discovered by LVT-tholv2k in WordPress Plugin Essential Breadcrumbs versions = 1.1.1...

WordPress Advanced Tag Lists plugin <= 1.2 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin Advanced Tag Lists versions = 1.2...

WordPress Request Call Back plugin <= 1.4.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Request Call Back versions = 1.4.1...

WordPress Tournamatch plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Tournamatch versions = 4.7.0...

WordPress Twispay Credit Card Payments Plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Twispay Credit Card Payments versions = 2.1.2...

WordPress MultiMailer plugin <= 1.0.3 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin MultiMailer versions = 1.0.3...

WordPress MapSVG Lite plugin <= 8.6.4 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Anhchangmutrang in WordPress Plugin MapSVG versions = 8.6.4...

WordPress Error Log Viewer By WP Guru plugin <= 1.0.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Aiden Thái An in WordPress Plugin Error Log Viewer versions = 1.0.5...

xgrammar Vulnerable to Denial of Service (DoS) by abusing unbounded cache in memory

Summary Xgrammar includes a cache for compiled grammars to increase performance with repeated use of the same grammar. This cache is held in memory. Since the cache is unbounded, a system making use of xgrammar can be abused to fill up a host's memory and case a denial of service. For example,...

crud-query-parser SQL Injection vulnerability

Impact Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter. Versions 0.0.1, 0.0.2 and 0.0.3 are affected b...

BELL-CVE-2025-26682

Bulletin has no description...

BELL-CVE-2025-22010

Bulletin has no description...

BELL-CVE-2025-22009

Bulletin has no description...

ColdFusion Deserialization RCE

The vulnerability of the ColdFusion software platform is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

PT-2025-15819 · Unknown · Quantumcloud Seo Help

Name of the Vulnerable Software and Affected Versions: QuantumCloud SEO Help versions n/a through 6.6.0 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability, which allows for Server Side Request Forgery. Recommendations: For versions n/a through 6.6.0, update to a...