PT-2025-17317 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify versions prior to 0.6.12 Description: A security issue was identified in Dify, an open-source LLM app development platform, where normal users are improperly granted permissions to edit app names, descriptions, and icons. This access...

PT-2025-17322 · Itel Electronics · Itel Electronics Ip Stream

Name of the Vulnerable Software and Affected Versions: Itel Electronics IP Stream version 1.7.0.6 Description: The issue is related to incorrect access control, allowing unauthorized attackers to execute arbitrary commands with Administrator privileges. Recommendations: For Itel Electronics IP...

PT-2025-17254 · Thimpress · Thimpress Ivy School

Name of the Vulnerable Software and Affected Versions: ThimPress Ivy School versions 1.6.0 and earlier Description: The issue is related to a Path Traversal vulnerability, specifically a '.../...//' vulnerability, which allows PHP Local File Inclusion in ThimPress Ivy School. Recommendations: For...

PT-2025-17253 · Unknown · Pantherius Modal Survey

Name of the Vulnerable Software and Affected Versions: Pantherius Modal Survey versions n/a through 2.0.2.0.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-22305 · Unknown · Fw-Wgs-804Hpt

Name of the Vulnerable Software and Affected Versions: FW-WGS-804HPT version 1.305b241111 Description: A stack overflow issue was discovered via the bindEditMACName parameter in the web acl bindEdit post function. Recommendations: For FW-WGS-804HPT version 1.305b241111, consider restricting acces...

Adobe After Effects Out-of-Bounds Write Vulnerability (CNVD-2025-07802)

Adobe After Effects is a set of visual effects and motion graphics production software from the American company Audobee Adobe. The software is mainly used for 2D and 3D synthesis, animation and visual effects production. An out-of-bounds write vulnerability exists in Adobe After Effects version...

PT-2025-17294 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify versions 0.6.8 and prior Description: A vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in "/export" should only allow administrator users to export DSL...

Rockwell Automation Arena Local Code Execution Vulnerability (CNVD-2025-21435)

Rockwell Automation Arena is a discrete-event simulation and automation software from Rockwell Automation USA. A local code execution vulnerability exists in Rockwell Automation Arena due to improper validation of user-supplied data. An attacker could exploit the vulnerability to disclose...

CVE-2025-29460

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation...

WordPress Gravity Forms CSS Themes with Fontawesome and Placeholders plugin <= 8.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nabil Irawan Patchstack Alliance in WordPress Plugin Gravity Forms CSS Themes with Fontawesome and Placeholders versions = 8.5...

WordPress WP Logger plugin <= 2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin WP Logger versions = 2.2...

WordPress Target Video Easy Publish plugin <= 3.8.9 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability discovered by Phan Trong Quan - VNPT Cyber Immunity in WordPress Plugin Target Video Easy Publish versions = 3.8.9...

BELL-CVE-2025-22109

Bulletin has no description...

BELL-CVE-2025-22125

Bulletin has no description...

BELL-CVE-2024-58092

Bulletin has no description...

BELL-CVE-2025-22022

Bulletin has no description...

MAL-2025-3252 Malicious code in helper-function-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf8d6cfb517715467379abc5d1adf9a80f10c786f6473f2d30c9961cba2445b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-17187 · Dashi · Dashi

Name of the Vulnerable Software and Affected Versions: Dashi versions 3.1.8 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions 3.1.8 and earlier, update to a...

PT-2025-17052 · Ays · Easy Form

Name of the Vulnerable Software and Affected Versions: Easy Form by AYS versions n/a through 2.6.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inje...

PT-2025-17107 · Unknown · Feedify – Web Push Notifications

Name of the Vulnerable Software and Affected Versions: Feedify – Web Push Notifications versions n/a through 2.4.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This means that ...