PT-2025-14073 · Unknown · Tla Media Gtm Kit

Name of the Vulnerable Software and Affected Versions: TLA Media GTM Kit versions n/a through 2.3.1 Description: The issue allows retrieval of embedded sensitive data due to debug messages revealing unnecessary information. Recommendations: For versions n/a through 2.3.1, update to a version that...

ASB-A-388480622

In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-382243530

In multiple functions of quirks.c, there is a possible way to free arbitrary memory due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-339532378

In multiple locations, there is a possible way to mislead a user into approving an authentication prompt for one app when its result will be used in another due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User...

ASB-A-382239029

In validateclockselector of clock.c, there is a possible out of bounds read due to memory corruption. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2025-14171 · Clearbit · Clearbit Reveal

Name of the Vulnerable Software and Affected Versions: Clearbit Reveal versions n/a through 1.0.6 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions n/a through 1.0.6, update t...

PT-2025-14256 · Unknown · Stylemix Pearl

Name of the Vulnerable Software and Affected Versions: Stylemix Pearl versions 1.3.9 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into...

PT-2025-14389 · Frizzly · Frizzly

Name of the Vulnerable Software and Affected Versions: Frizzly versions 1.1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For Frizzly versions 1.1.0 and...

PT-2025-14415 · Unknown · Notfound Nanosupport

Name of the Vulnerable Software and Affected Versions: NotFound NanoSupport versions 0.6.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

ASB-A-378900798

In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2025-14409 · WordPress · Wp Bookmarks

Name of the Vulnerable Software and Affected Versions: WP Bookmarks versions 1.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...

ASB-A-375623125

In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to a logic error in the code. This could lead to local denial of service until the phone reboots with no additional execution privileges needed. User...

ASB-A-333344157

In multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2025-14155 · Niteothemes · Clp – Custom Login Page

Name of the Vulnerable Software and Affected Versions: CLP – Custom Login Page by NiteoThemes versions 1.5.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into performing...

PUB-A-385736329

In n/a of n/a, there is a possible n/a due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-355411348

In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2025-29049

Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before fixed in 0.104.0 allows an attacker to execute arbitrary code via the MathLive function...

CVE-2025-3061

Vulnerability in Drupal Material Admin.This issue affects Material Admin:...

CVE-2025-31683 Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012

Cross-Site Request Forgery CSRF vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...

CVE-2025-31674 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...