PT-2025-22310 · Linksys · Linksys Fgw3000-Hk +1

Name of the Vulnerable Software and Affected Versions: Linksys FGW3000-AH and FGW3000-HK versions up to 1.0.17.000000 Description: A critical issue affects the control panel sw function of the /cgi-bin/sysconf.cgi file in the HTTP POST Request Handler component. The manipulation of the filename...

CVE-2025-43715

Nullsoft Scriptable Install System NSIS before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition...

Updated haproxy packages fix security vulnerability

BUG/MEDIUM: sample: fix risk of overflow when replacing multiple regex back-refsAleandro Prudenzano of Doyensec and Edoardo Geraci of Codean Labs reported a bug in sampleconvregsub, which can cause replacements of multiple back-references to overflow the temporary trash buffer. The problem happen...

CVE-2025-32433

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution RCE. By exploiting a flaw in SSH protocol message handling, a malicious actor...

PT-2025-17942 · Unknown · Ngeniusone

Name of the Vulnerable Software and Affected Versions: nGeniusONE versions prior to 6.4.0 b2350 Description: The issue is related to Stored Cross-Site Scripting XSS that can be triggered via a certain POST parameter. This allows an attacker to inject malicious scripts into the application...

PT-2025-17872 · Unknown · Sherpa Orchestrator

Name of the Vulnerable Software and Affected Versions: Sherpa Orchestrator version 141851 Description: The issue allows an authenticated user to perform multiple time-based blind SQL injections. This affects several API endpoints, including "api/gui/asset/list", "api/gui/files/export/csv/",...

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird 128.9.2 bsc1241277 CVE-2025-3522: Leak of hashed Window credentials via crafted attachment URL CVE-2025-2830: Information Disclosure of /tmp directory listing CVE-2025-3523: User Interface UI Misrepresentation of...

PT-2025-18080 · Dell · Dell Powerprotect Data Manager Reporting

Name of the Vulnerable Software and Affected Versions: Dell PowerProtect Data Manager Reporting versions 19.17 through 19.18 Description: The issue is related to improper encoding or escaping of output, which could be exploited by an attacker with high privileges and local access to inject...

PT-2025-17795 · Unknown · Michael Cannon Flickr Shortcode Importer

Name of the Vulnerable Software and Affected Versions: Michael Cannon Flickr Shortcode Importer versions n/a through 2.2.3 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions n/a through 2.2.3, update to a version...

PT-2025-17848 · Vestel · Vestel Ac Charger

Name of the Vulnerable Software and Affected Versions: Vestel AC Charger version 3.75.0 Description: The issue allows an attacker to access files containing sensitive information, such as credentials, which could be used to further compromise the device. This vulnerability could enable remote...

PT-2025-17720 · WordPress · Buddypress Force Password Change

Name of the Vulnerable Software and Affected Versions: Buddypress Force Password Change plugin for WordPress versions up to, and including, 0.1 Description: The issue allows for authenticated account takeover due to improper validation of a user's identity prior to updating their password through...

PT-2025-17576 · Unknown · Cuba Rest Api Add-On

Name of the Vulnerable Software and Affected Versions: CUBA REST API add-on versions prior to 7.2.7 Description: The issue allows malicious JavaScript code to be executed in the browser by manipulating the input parameter, which consists of a file path and name, to return the Content-Type header...

Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

Prevent token leakage / privilege escalation MinIO Operator STS: A Quick Overview MinIO Operator STS is a native IAM Authentication for Kubernetes. MinIO Operator offers support for Secure Tokens a.k.a. STS which are a form of temporary access credentials for your MinIO Tenant. In essence, this...

GHSA-7M6V-Q233-Q9J9 Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

Prevent token leakage / privilege escalation MinIO Operator STS: A Quick Overview MinIO Operator STS is a native IAM Authentication for Kubernetes. MinIO Operator offers support for Secure Tokens a.k.a. STS which are a form of temporary access credentials for your MinIO Tenant. In essence, this...

PT-2025-22288 · Unknown · Fw-Wgs-804Hpt

Name of the Vulnerable Software and Affected Versions: FW-WGS-804HPT version 1.305b241111 Description: A stack overflow issue was discovered via the web sys infoContact post function. Recommendations: For FW-WGS-804HPT version 1.305b241111, as a temporary workaround, consider disabling the web sy...

PT-2025-22294

Name of the Vulnerable Software and Affected Versions FW-WGS-804HPT version 1.305b241111 Description A stack overflow issue was discovered via the ruleNamekey parameter in the web acl mgmt Rules Apply post function. Recommendations For FW-WGS-804HPT version 1.305b241111, as a temporary workaround...

PT-2025-17376 · Wcms · Wcms

Name of the Vulnerable Software and Affected Versions: WCMS version 11 Description: A critical vulnerability has been found in WCMS 11, affecting an unknown functionality of the file app/controllers/AnonymousController.php. The manipulation of the mobile phone argument leads to SQL injection. The...

PT-2025-17357 · WordPress · Insert Headers/Footers

Name of the Vulnerable Software and Affected Versions: Insert Headers And Footers plugin for WordPress versions up to, and including, 3.1.1 Description: The issue is due to missing or incorrect nonce validation on the custom plugin set option function, making it possible for unauthenticated...

PT-2025-17394

Name of the Vulnerable Software and Affected Versions cJSON version 1.7.15 Description The issue might allow a denial of service via a crafted JSON document. For example, a document such as "a": true, "b": null,9999999999999999999999999999999999999999999999912345678901234567 could be used...

CVE-2025-27599 Element X Android vulnerable to loading malicious web pages via received intent

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it...