PT-2025-22328 · WordPress · Affiliate Sales In Google Analytics/Other Tools

Name of the Vulnerable Software and Affected Versions: The Affiliate Sales in Google Analytics and other tools plugin for WordPress versions up to, and including, 1.4.9 Description: The issue is due to insufficient validation on the redirect url supplied via the afflink parameter. This makes it...

GHSA-6FRX-J292-C844 TYPO3 Allows Privilege Escalation to System Maintainer

Problem Administrator-level backend users without system maintainer privileges can escalate their privileges and gain system maintainer access. Exploiting this vulnerability requires a valid administrator account. Solution Update to TYPO3 versions 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, 13.4.12...

CVE-2025-47290 Containerd vulnerable to host filesystem access during image unpack

containerd is a container runtime. A time-of-check to time-of-use TOCTOU vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0...

CVE-2025-47939

TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restrictio...

CVE-2025-47937 TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handling

TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, when performing a database query involving multiple tables through the database abstraction layer DBAL, frontend...

RHSA-2025:7967 Red Hat Security Advisory: osbuild-composer security update

Bulletin has no description...

RHSA-2025:7893 Red Hat Security Advisory: grafana security update

Bulletin has no description...

PT-2025-22280 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2025.03.2 Description: The issue allows for stored XSS via GitHub Checks Webhook. Recommendations: For versions prior to 2025.03.2, update to version 2025.03.2 or later to resolve the issue...

PT-2025-22143 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions 12.x prior to 12.4.31 LTS TYPO3 versions 13.x prior to 13.4.2 LTS Description: The issue concerns the multifactor authentication MFA dialog presented during backend login, which can be bypassed due to insufficient enforcement o...

PT-2025-22276

Name of the Vulnerable Software and Affected Versions Langroid versions prior to 0.53.15 Description The issue concerns Langroid, a Python framework for building large language model LLM-powered applications. In versions prior to 0.53.15, the TableChatAgent uses pandas eval, which may be vulnerab...

PT-2025-22139 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions 9.0.0 through 9.5.50 ELTS TYPO3 versions 10.0.0 through 10.4.49 ELTS TYPO3 versions 11.0.0 through 11.5.43 ELTS TYPO3 versions 12.0.0 through 12.4.30 LTS TYPO3 versions 13.0.0 through 13.4.11 LTS Description: The issue affects...

PT-2025-22122 · WordPress · Motors

Name of the Vulnerable Software and Affected Versions: Motors WordPress theme versions prior to 5.6.68 Description: The Motors theme for WordPress is vulnerable to privilege escalation via account takeover. This is due to the theme not properly validating a user's identity prior to updating their...

PT-2025-22283 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2025.03.2 Description: The issue allows for an open redirect on the editing VCS Root page. Recommendations: For versions prior to 2025.03.2, update to version 2025.03.2 or later to resolve the issue...

DLA-4175-1 mongo-c-driver - security update

Bulletin has no description...

DLA-4174-1 openjdk-11 - security update

Bulletin has no description...

Advisory ROSA-SA-2025-2862

Software: kernel 4.18.0 OS: ROSA Virtualization 3.0 packageevrstring: kernel-4.18.0-553.40.1.el810 CVE-ID: CVE-2023-52864 BDU-ID: 2024-10416 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the wmicharopen function of the Linux operating system kernel is related to the driver not binding to a devi...

WordPress SKT Blocks plugin <= 2.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by zaim in WordPress Plugin SKT Blocks versions = 2.2...

RHSA-2025:7901 Red Hat Security Advisory: kernel security update

Bulletin has no description...

K000151398: PyTorch vulnerability CVE-2025-32434

Security Advisory Description PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution RCE vulnerability exists in PyTorch when loading a model...

PT-2025-22108 · Mojoomla · Wpams

Name of the Vulnerable Software and Affected Versions: mojoomla WPAMS versions prior to 44.0 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further exploitation and potential...