BELL-CVE-2025-38038

Bulletin has no description...

BELL-CVE-2025-38023

Bulletin has no description...

BELL-CVE-2025-38024

Bulletin has no description...

BELL-CVE-2025-38019

Bulletin has no description...

BELL-CVE-2025-38015

Bulletin has no description...

BELL-CVE-2025-38005

Bulletin has no description...

BELL-CVE-2025-38006

Bulletin has no description...

BELL-CVE-2025-38010

Bulletin has no description...

PT-2025-26495

Name of the Vulnerable Software and Affected Versions: wp-file-download WordPress plugin versions prior to 6.2.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the...

PT-2025-26525 · Unknown · Simple Online Hotel Reservation System

Name of the Vulnerable Software and Affected Versions: Simple Online Hotel Reservation System version 1.0 Description: A critical issue affects the processing of the file /admin/add account.php, where the manipulation of the admin id argument leads to SQL injection. This issue can be exploited...

PT-2025-26530 · Yealink · Yealink Ymcs Rps

Name of the Vulnerable Software and Affected Versions: Yealink YMCS RPS versions prior to 2025-05-26 Description: The certificate upload function in Yealink YMCS RPS does not properly validate certificate content, potentially allowing invalid certificates to be uploaded. Recommendations: For...

CVE-2025-48059 PowSyBl Core Contains a Polynomial ReDoS in RegexCriterion

PowSyBl Power System Blocks is a framework to build power system oriented software. In com.powsybl:powsybl-iidm-criteria versions 6.3.0 to before 6.7.2 and com.powsybl:powsybl-contingency-api versions 5.0.0 to before 6.3.0, there is a a potential polynomial Regular Expression Denial of Service...

CVE-2025-49967

Cross-Site Request Forgery CSRF vulnerability in marcusjansen Live Sports Streamthunder live-sports-streamthunder allows Cross Site Request Forgery.This issue affects Live Sports Streamthunder: from n/a through = 2.1...

BELL-CVE-2025-50181

Bulletin has no description...

Path Traversal

Liferay is vulnerable to path traversal. The vulnerability is due to improper validation of the comliferayserveradminwebportletServerAdminPortletjarName parameter, which allows remote attackers to add or execute arbitrary files...

OSV-2025-480 Stack-buffer-overflow in void glz::from<10000u, std::__1::__bit_reference<std::__1::vector<bool, std::__1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=425725152 Crash type: Stack-buffer-overflow READ 1 Crash state: void glz::from::op::opglz::optscsv10000u,...

PT-2025-26411 · Unknown · Virtual Moderator

Name of the Vulnerable Software and Affected Versions: Adnan Haque a11n Virtual Moderator versions 1.4 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Cross-Site Scripting XSS. This means an attacker could potentially trick a user into...

CVE-2025-45331

brplot v420.69.1 contains a Null Pointer Dereference NPD vulnerability in the brdagenshandleonce function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes...

PT-2025-26377 · Unknown · Nitin Yawalkar Rdfa Breadcrumb

Name of the Vulnerable Software and Affected Versions: Nitin Yawalkar RDFa Breadcrumb versions 2.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables attackers to injec...

PT-2025-26370 · Unknown · Csv Importer Improved

Name of the Vulnerable Software and Affected Versions: CSV Importer Improved versions 0.6.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...