PT-2025-17943 · Netscout · Netscout Ngeniusone

Name of the Vulnerable Software and Affected Versions: NETSCOUT nGeniusONE versions prior to 6.4.0 b2350 Description: The issue concerns hardcoded credentials in NETSCOUT nGeniusONE that can be obtained from JAR files. Recommendations: For versions prior to 6.4.0 b2350, update to version 6.4.0...

PT-2025-17928 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify versions prior to 0.6.12 Description: The issue concerns an access control flaw in Dify, an open-source LLM app development platform. This flaw allows non-admin users to make unauthorized access and changes to APPs, despite the web UI of...

PT-2025-17922 · Jetbrains · Jetbrains Rider

Name of the Vulnerable Software and Affected Versions: JetBrains Rider versions prior to 2025.1.2 Description: The issue allows arbitrary file overwrite during a remote debug session due to a custom archive unpacker. Recommendations: For versions prior to 2025.1.2, update to version 2025.1.2 or...

PT-2025-29162 · Honeywell · Onewireless Wdm +1

Name of the Vulnerable Software and Affected Versions: Honeywell Experion PKS versions 520.1 through 520.2 TCU9 Honeywell Experion PKS versions 530 through 530 TCU3 Honeywell OneWireless WDM versions 322.1 through 322.4 Honeywell OneWireless WDM versions 330.1 through 330.3 Description: The...

PT-2025-28381 · Unknown · Audio Service

Name of the Vulnerable Software and Affected Versions: LeAudioService versions prior to SMR Jul-2025 Release 1 Description: The issue is related to improper access control in LeAudioService, which allows local attackers to manipulate broadcasting Auracast. Recommendations: For versions prior to S...

CVE-2025-2185 ALBEDO Telecom Net.Time - PTP/NTP Clock Insufficient Session Expiration

ALBEDO Telecom Net.Time - PTP/NTP clock Serial No. NBC0081P software release 1.4.4 is vulnerable to an insufficient session expiration vulnerability, which could permit an attacker to transmit passwords over unencrypted connections, resulting in the product becoming vulnerable to interception...

WordPress Wp Custom CMS Block plugin <= 2.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin Wp Custom CMS Block versions = 2.1...

WordPress Hacklog Remote Attachment plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by johska in WordPress Plugin Hacklog Remote Attachment versions = 1.3.2...

CVE-2025-43855 tRPC 11 WebSocket DoS Vulnerability

tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to cras...

RUSTSEC-2025-0038 Out of bounds access in public safe API

Rows::rowunchecked allows out of bounds access to the underlying buffer without sufficient checks. The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead...

BIT-MOODLE-2024-43439 Moodle: reflected xss via h5p error message

A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting XSS risk...

BELL-CVE-2025-21605

Bulletin has no description...

Operation SyncHole: Lazarus APT goes back to the well

We have been tracking the latest attack campaign by the Lazarus group since last November, as it targeted organizations in South Korea with a sophisticated combination of a watering hole strategy and vulnerability exploitation within South Korean software. The campaign, dubbed "Operation SyncHole...

PYSEC-2025-34

The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.getservercertificate can exfiltrate data via DNS after deserialization...

PT-2025-17809 · Unknown · Josheli Simple Google Photos Grid

Name of the Vulnerable Software and Affected Versions: josheli Simple Google Photos Grid versions 1.5 and earlier Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability, which allows for Server Side Request Forgery. Recommendations: For versions 1.5 and earlier,...

PT-2025-17707 · WordPress · The Reales Wp

Name of the Vulnerable Software and Affected Versions: The Reales WP - Real Estate WordPress Theme versions up to, and including, 2.1.2 Description: The issue allows unauthorized modification and loss of data due to a missing capability check on the reales delete file, reales delete file plans,...

PT-2025-17777 · Unknown · Wp Custom Cms Block

Name of the Vulnerable Software and Affected Versions: Wp Custom CMS Block versions through 2.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-17834 · Unknown · Haris Zulfiqar Tooltip

Name of the Vulnerable Software and Affected Versions: Haris Zulfiqar Tooltip versions 1.0.1 and earlier Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows DOM-Based XSS. This enables potential...

PT-2025-17759 · Unknown · Habibur Rahman Razib Control Listings

Name of the Vulnerable Software and Affected Versions: Habibur Rahman Razib Control Listings versions 1.0.4.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means an...

PT-2025-17804 · Unknown · Navegg Analytics

Name of the Vulnerable Software and Affected Versions: Navegg Analytics versions n/a through 3.3.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in Navegg Analytics. Recommendations: For versions n/a through 3.3.3, update to a version that contai...