12582 matches found
PT-2025-16060 · Unknown · Sandeep Verma Html5 Video Player With Playlist
Name of the Vulnerable Software and Affected Versions: Sandeep Verma HTML5 Video Player with Playlist versions 2.50 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This enables...
OPENSUSE-SU-2025:14985-1 docker-27.5.1_ce-15.1 on GA media
These are all security issues fixed in the docker-27.5.1ce-15.1 package on the GA media of openSUSE Tumbleweed...
PT-2025-16038 · Tp Link · Deco Be65 Pro
Name of the Vulnerable Software and Affected Versions: Deco BE65 Pro versions prior to Deco BE65 ProJP V1 1.1.2 Build 20250123 Description: The issue is related to an OS command injection vulnerability. If exploited, it allows a user who can log in to the device to execute an arbitrary OS command...
PT-2025-16096 · Unknown · John Weissberg Print Science Designer
Name of the Vulnerable Software and Affected Versions: John Weissberg Print Science Designer versions 1.3.155 and earlier Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This allows for Path Traversal, which can...
PT-2025-16077 · Unknown · Woocommerce Pickupp
Name of the Vulnerable Software and Affected Versions: WooCommerce Pickupp versions 2.4.0 and earlier Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability. This allows for PHP Local File Inclusion, whic...
CVE-2025-32382 Snowflake credentials logged by the Metabase backend
Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase either updating a password or changing password to private key or vice versa, Metabase would not always purge older Snowflake connection details from the...
RHSA-2025:3773 Red Hat Security Advisory: delve and golang security update
Bulletin has no description...
SUSE-SU-2025:1193-1 Security update for apparmor
This update for apparmor fixes the following issue: - Allow dovecot-auth to execute unix check password from /sbin, not only from /usr/bin bsc1234452...
PT-2025-15971 · Videx · Videx Cyberaudit-Web
Name of the Vulnerable Software and Affected Versions: Videx CyberAudit-Web versions prior to 1.1.3 Description: A Server-Side Request Forgery SSRF vulnerability was discovered in the videx-legacy-ssl web service of Videx’s CyberAudit-Web. This issue could lead to unauthorized access to the...
PT-2025-15982 · Maxkb · Maxkb
Name of the Vulnerable Software and Affected Versions: MaxKB versions prior to 1.10.4-lts Description: A reverse shell vulnerability exists in the module of the function library, allowing privileged users to create a reverse shell. This issue is related to the function library module...
PT-2025-15981 · Silverstripe · Silverstripe/Framework
Name of the Vulnerable Software and Affected Versions: Silverstripe Framework versions prior to 5.3.23 Description: A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front e...
PT-2025-15949 · Elementor · Spider Elements – Addons For Elementor
Name of the Vulnerable Software and Affected Versions: Spider Elements – Addons for Elementor versions 1.6.2 and earlier Description: The issue is related to a lack of authorization in Spider Elements – Addons for Elementor, which allows the exploitation of incorrectly configured access control...
PT-2025-15925 · Unknown · Dyapress Erp/Crm
Name of the Vulnerable Software and Affected Versions: DyaPress ERP/CRM versions through 18.0.2.0 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal', which allows PHP Local File Inclusion. This enables potential acce...
PT-2025-15943 · Woocommerce · Total Processing Card Payments For Woocommerce
Name of the Vulnerable Software and Affected Versions: Total processing card payments for WooCommerce versions n/a through 7.1.5 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This allows for Pat...
PT-2025-15935 · Unknown · Athemes Addons For Elementor
Name of the Vulnerable Software and Affected Versions: aThemes Addons for Elementor versions 1.0.0 through 1.0.15 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion'. This is a type of...
CVE-2025-32034
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, a vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively...
2025-04 Cumulative Update for Windows 10 Version 1507 for x86-based Systems (KB5055547)
A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...
CVE-2025-32380 Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router's usage of Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively...
CVE-2025-32016 Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs
Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform formerly Azure AD v2.0 endpoint and AAD B2C. This vulnerability affects confidential client applications, including daemons, web...