PT-2025-9857

Name of the Vulnerable Software and Affected Versions Jinja versions prior to 3.1.6 Description Jinja is an extensible templating engine. An oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute...

CVE-2025-27647

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Addition of Partial Admin Users Without Authentication V-2024-002...

CVE-2024-41147

An out-of-bounds write vulnerability exists in the madrflacdecodesampleslpc functionality of Miniaudio miniaudio v0.11.21. A specially crafted .flac file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2025-1938

Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 13...

CVE-2025-1937

Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabilit...

CVE-2025-1931

It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerability affects Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8...

CVE-2025-27150

This CVE concerns Tuleap: the password used to connect to the Redis instance is not purged from the archives created by tuleap collect-system-data. The exposed password could be accessed by support teams who should not have it. Affected versions: Tuleap Community Edition prior to 16.4.99.17404928...

CVE-2025-1930

On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability affects Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8...

CVE-2025-1931

It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerability affects Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8...

CVE-2025-27220

A flaw was found in Ruby's CGI gem. The CGI::UtilescapeElement method is vulnerable to Regular expression Denial of Service ReDoS, allowing a specially crafted input to cause a high CPU consumption. Mitigation Mitigation for this issue is either not available or the currently available options do...

MAL-2025-2130 Malicious code in testaaa11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee9af0a167a9449542aeee6148dd5d89d3f9e387e437198cb1a5a3b99e074fd2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-27423

A flaw was found in the tar.vim plugin of Vim. This vulnerability allows arbitrary command execution via specially crafted tar archives that exploit the unsanitized :read ex command...

Unauthorized Channel Content Export

github.com/mattermost/mattermost-server is vulnerable to unauthorized channel content export. The vulnerability is due to improper access control due to failing to restrict channel export of archived channels when the "Allow users to view archived channels" setting is disabled...

CVE-2025-27221

A flaw was found in the URI ruby gem package, where userinfo leakage can occur in the uri gem. The methods URIjoin, URImerge, and URI+ retained userinfo, such as user:password, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using...

PT-2025-9737 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 134.0.6998.35 Description: The issue allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. Recommendations: For versions prior...

PT-2025-9718 · Sourcecodester · Sourcecodester Best Church Management

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Church Management Software version 1.1 Description: A critical vulnerability has been found in the software, affecting an unknown functionality of the file /admin/app/web crud.php. The manipulation of the encryption argume...

PT-2025-9710 · Unknown · Mysiteforme

Name of the Vulnerable Software and Affected Versions: mysiteforme versions prior to 2025.01.1 Description: A SQL injection issue exists. Recommendations: For versions prior to 2025.01.1, update to version 2025.01.1 or later to resolve the issue...

GO-2025-3482 Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server

Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server...

GO-2025-3466 Missing rate limit in MaysWind ezBookkeeping in github.com/mayswind/ezbookkeeping

Missing rate limit in MaysWind ezBookkeeping in github.com/mayswind/ezbookkeeping...

GO-2025-3484 Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome

Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome...