Vulnerabilities fixed in Splunk Enterprise and Splunk Cloud Platform

Splunk has fixed vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. The vulnerabilities in Splunk Enterprise and Splunk Cloud Platform allow both low-privileged and high-privileged users to perform unauthorized actions, such as suppressing alerts, executing remote commands, and causi...

PT-2025-28506

Name of the Vulnerable Software and Affected Versions: Remote Desktop Client affected versions not specified Description: The issue is related to insufficient UI warnings for dangerous operations in Remote Desktop Client, allowing an unauthorized attacker to perform spoofing over a network. This...

PT-2025-27892 · Unknown · Tony Zeoli Radio Station

Name of the Vulnerable Software and Affected Versions: Tony Zeoli Radio Station versions 2.5.12 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on the affected system. This vulnerability...

PT-2025-27893 · Woocommerce · Trust Payments Gateway For Woocommerce

Name of the Vulnerable Software and Affected Versions: Trust Payments Gateway for WooCommerce JavaScript Library versions 1.3.6 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which allows unauthorized actions to be performed on behalf of a user. This c...

CVE-2025-53108 HomeBox Missing User Authorization

HomeBox is a home inventory and organization system. Prior to 0.20.1, HomeBox contains a missing authorization check in the API endpoints responsible for updating and deleting inventory item attachments. This flaw allows authenticated users to perform unauthorized actions on inventory item...

Deserialization Of Untrusted Data

org.apache.seata, seata-config-core is vulnerable to Deserialization of untrusted data. The vulnerability is due to insecure handling of deserialized input, which allows attackers to exploit it by executing arbitrary code or performing unauthorized actions...

CVE-2025-53096

Summary: CVE-2025-53096 affects Sunshine, a self-hosted game stream host for Moonlight. The issue is a lack of Clickjacking protection in Sunshine’s web UI prior to version 2025.628.4510, allowing an attacker to embed the UI in a malicious page via an invisible or disguised iframe. If a user, whi...

Sunshine 安全漏洞

Sunshine is an open source self-service game streaming host for Moonlight by LizardByte. A security vulnerability exists in versions prior to Sunshine 2025.628.4510, which stems from a lack of clickjacking protection in the web UI and could lead to unauthorized actions...

CVE-2025-52991

The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data...

PT-2025-27179 · Unknown · Opicron Image Cleanup

Name of the Vulnerable Software and Affected Versions: opicron Image Cleanup versions 1.9.2 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the opicron Image Cleanup, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For opicron Image...

PT-2025-27180 · Unknown · Slickstream

Name of the Vulnerable Software and Affected Versions: Slickstream versions n/a through 2.0.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker tricks ...

PT-2025-27161 · Cyrlitera · Cyrlitera

Name of the Vulnerable Software and Affected Versions: Cyrlitera versions 1.2.0 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 1.2.0 and earlier, update to a...

PT-2025-27152 · Unknown · Burst Statistics

Name of the Vulnerable Software and Affected Versions: Burst Statistics versions n/a through 2.0.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker...

PT-2025-27157 · Edgarrojas · Woocommerce Pdf Invoice Builder

Name of the Vulnerable Software and Affected Versions: EDGARROJAS WooCommerce PDF Invoice Builder versions 1.2.148 and earlier Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed. This can lead to Cross Site Request Forgery. Recommendations: For versio...

PT-2025-27174 · Unknown · Hide Admin Bar From Front End

Name of the Vulnerable Software and Affected Versions: Hide Admin Bar From Front End versions 1.0.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where a...

CVE-2025-52991

CVE-2025-52991 affects Nix before 2.24.15, 2.26.4, 2.28.4, 2.29.1; Lix before 2.91.2, 2.92.2, 2.93.1; and Guix before 1.4.0-38.0e79d5b. The root cause is that temporary build directories are created in world-readable and world-writable locations, allowing local users to deceive the package manage...

PT-2025-27172 · Virusdie · Virusdie

Name of the Vulnerable Software and Affected Versions: Virusdie versions 1.1.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Virusdie versions 1.1.3 and...

CVE-2025-53073

In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions such as adding a comment without being a member of the project's team. A seven-digit issue ID must be known it is not treated as a secret and might be mentioned...

PT-2025-26959 · Unknown · Open Social

Name of the Vulnerable Software and Affected Versions: Open Social versions 0.0.0 through 12.3.13 Open Social versions 12.4.0 through 12.4.12 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. This issue ca...

CVE-2025-53073

In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions such as adding a comment without being a member of the project's team. A seven-digit issue ID must be known it is not treated as a secret and might be mentioned...