PT-2025-23677 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions 1.46.0 through 2.1.6 Description: The issue affects AES-256-GCM and AES-128-GCM in Deno, where the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks...

PT-2025-23656 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS versions up to 2.7.3 Description: A vulnerability was found in the function gmm state authentication/emm state authentication of the component AMF/MME. The manipulation leads to reachable assertion. It is possible to launch the attack...

CVE-2025-48957 AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in...

PT-2025-23465 · Unknown · Assamlook Cms

Name of the Vulnerable Software and Affected Versions: AssamLook CMS version 1.0 Description: A critical issue was found in the software. It affects an unknown function of the file /department-profile.php. The manipulation of the ID argument leads to SQL injection. This issue can be exploited...

PT-2025-23475 · Unknown · Aem Solutions Cms

Name of the Vulnerable Software and Affected Versions: Aem Solutions CMS versions up to 1.0 Description: A critical issue affects an unknown part of the file /page.php. The manipulation of the ID argument leads to sql injection. It is possible to initiate the attack remotely. The vendor was...

PT-2025-23471 · Unknown · Assamlook Cms

Name of the Vulnerable Software and Affected Versions: AssamLook CMS version 1.0 Description: A critical issue has been found in the software, affecting an unknown functionality of the file /view tender.php. The manipulation of the ID argument leads to SQL injection. This issue can be exploited...

PT-2025-23368 · Unknown · Phpgurukul Daily Expense Tracker System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Daily Expense Tracker System version 1.1 Description: A critical issue affects some unknown processing of the file /expense-yearwise-reports-detailed.php. The manipulation of the argument todate leads to SQL injection. The attack m...

PT-2025-23409 · Jeewms · Jeewms

Name of the Vulnerable Software and Affected Versions: JeeWMS versions up to 20250504 Description: A critical issue affects the doAdd function of the /cgformTemplateController.do?doAdd API endpoint, leading to path traversal. This can be initiated remotely. Recommendations: For versions up to...

PT-2025-23408 · Jeewms · Jeewms

Name of the Vulnerable Software and Affected Versions: JeeWMS versions up to 20250504 Description: A critical issue was found, affecting the function CgAutoListController of the file "/cgAutoListController.do?datagrid". This issue leads to sql injection and can be initiated remotely. The product...

PT-2025-23336 · Campcodes · Campcodes Online Hospital Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Hospital Management System version 1.0 Description: A critical issue has been discovered, affecting the /appointment-history.php file. The manipulation of the ID argument leads to SQL injection. This issue can be exploited...

PT-2025-23238

Name of the Vulnerable Software and Affected Versions hdf5 version 1.14.6 Description A heap buffer overflow was discovered via the H5Z filter scaleoffset function. Recommendations For version 1.14.6, consider disabling the H5Z filter scaleoffset function as a temporary workaround until a patch i...

PT-2025-23344 · Unknown · Campcodes Online Hospital Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Hospital Management System version 1.0 Description: A critical issue was found in the system, affecting an unknown function of the file /admin/doctor-specilization.php. The manipulation of the doctorspecilization argument lea...

thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link

The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment message/rfc822 and setting its content type to...

thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link

The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment message/rfc822 and setting its content type to...

PT-2025-23164 · Yasm +2 · Yasm +2

Name of the Vulnerable Software and Affected Versions: yasm version 9defefae Description: A NULL pointer dereference was discovered via the yasm section bcs append function at section.c. Recommendations: For version 9defefae, consider disabling the yasm section bcs append function as a temporary...

PT-2025-23169 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.12 Mattermost versions 10.5.x through 10.5.3 Mattermost versions 10.6.x through 10.6.2 Mattermost versions 10.7.x through 10.7.0 Description: The issue is related to the improper validation of permissio...

PT-2025-23201 · Unknown · Chshcms Mccms

Name of the Vulnerable Software and Affected Versions: chshcms mccms version 2.7 Description: A critical issue affects the function index of the file sys/apps/controllers/api/Gf.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack...

PT-2025-23161

Name of the Vulnerable Software and Affected Versions gradio-app gradio versions up to 5.29.1 Description A problematic vulnerability has been found in the CORS Handler component, specifically affecting the is valid origin function. The issue arises from the manipulation of the localhost aliases...

PT-2025-23195 · Discourse · Discourse Policy Plugin

Name of the Vulnerable Software and Affected Versions: Discourse Policy plugin versions prior to 0.1.1 Description: The issue concerns the Discourse Policy plugin, which allows confirming users have seen or done something. Prior to version 0.1.1, if a policy was posted to a public topic tied to a...

CVE-2025-3864

Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote attackers can exploit this to exhaust connection pools, causing denial of service in applications using the library. Fix for this issue has been included in 1.24.0 release...