PT-2025-24078 · WordPress · Wp Posts Carousel

Name of the Vulnerable Software and Affected Versions: WP Posts Carousel versions 1.3.12 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection in WP Posts Carousel. Recommendations: For WP Posts Carousel versions 1.3.12 and earlier, upda...

DSA-5938-1 python-tornado - security update

Bulletin has no description...

RHSA-2025:8550 Red Hat Security Advisory: varnish security update

Bulletin has no description...

WordPress PayU India plugin < 3.8.8 - Account Takeover vulnerability

Account Takeover vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin PayU India versions 3.8.8...

BELL-CVE-2025-4138

Bulletin has no description...

BELL-CVE-2025-4517

Bulletin has no description...

BELL-CVE-2025-4435

Bulletin has no description...

WordPress BP Profile as Homepage plugin <= 1.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross Site Request Forgery CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin BP Profile as Homepage versions = 1.1...

WordPress AppBanners plugin <= 1.5.14 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin AppBanners versions = 1.5.14...

WordPress Booqable Rental plugin <= 2.4.21 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Booqable Rental versions = 2.4.21...

SignXML's signature verification with HMAC is vulnerable to a timing attack

When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., prior versions of SignXML are vulnerable to a potential timing attack. The verifier may leak information about the correct HMAC when comparing...

WordPress ShiftNav – Responsive Mobile Menu plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin ShiftNav – Responsive Mobile Menu versions = 1.8...

PT-2025-23953 · Code Projects · Patient Record Management System

Name of the Vulnerable Software and Affected Versions: code-projects Patient Record Management System version 1.0 Description: A critical issue was found in the Patient Record Management System, affecting some unknown functionality of the file urinalysis form.php. The manipulation of the urinalys...

PT-2025-23897 · Qt Company +1 · Qt +1

Name of the Vulnerable Software and Affected Versions: Qt versions 6.3.0 through 6.5.9 Qt versions 6.6.0 through 6.8.4 Qt version 6.9.0 Description: The issue occurs when a specifically crafted ICNS format image file is loaded in QImage, triggering a crash. Recommendations: For Qt versions 6.3.0...

PT-2025-23930 · Devolutions · Devolutions Server

Name of the Vulnerable Software and Affected Versions: Devolutions Server versions 2025.1.10.0 and earlier Description: The issue is related to improper access control in the Tor network blocking feature. This allows an authenticated user to bypass the Tor blocking feature when the Devolutions...

CVE-2025-48934 Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the Deno.env.toObject method ignores any variables listed in the --deny-env option of the deno run command. When looking at the documentation of the --deny-env option this might lead to a false...

CVE-2025-1701 Local Privilege Escalation in MIM Admin Service

CVE-2025-1701 is a high-severity vulnerability in the MIM Admin service. An attacker could exploit this vulnerability by sending a specially crafted request over the RMI interface to execute arbitrary code with the privileges of the MIM Admin service. The RMI interface is only accessible locally...

CVE-2025-49223

billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

PT-2025-23798 · Acronis · Acronis Cyber Protect Cloud Agent

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Cloud Agent Linux, macOS, Windows versions before build 40077 Description: The issue is related to a denial of service caused by improper handling of malformed input. Recommendations: For Acronis Cyber Protect Cloud Agen...

PT-2025-23841 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions prior to 2.1.13 and prior to 2.2.13 Description: The issue affects Deno, a JavaScript, TypeScript, and WebAssembly runtime. It involves the Deno.env.toObject method, which ignores variables listed in the --deny-env option of the...