PT-2025-27934 · WordPress · Wp-Recall

Name of the Vulnerable Software and Affected Versions: WP-Recall versions through 16.26.14 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...

Google Chrome Security Update (stable-channel-update-for-desktop_30-2025-06) - Linux

Google Chrome is prone to a type confusion vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...

PT-2025-27510

Name of the Vulnerable Software and Affected Versions: ASR180x, ASR190x versions prior to v1536 Falcon Linux versions prior to v1536 Kestrel versions prior to v1536 Lapwing Linux versions prior to v1536 Description: The issue is related to a resource leak vulnerability in the con mgr component of...

PT-2025-27410 · WordPress · Wp Lightbox 2

Name of the Vulnerable Software and Affected Versions: WP Lightbox 2 versions prior to 3.0.6.8 Description: The issue concerns the incorrect sanitization of the title attribute in links, potentially allowing malicious users to conduct cross-site scripting XSS attacks. Recommendations: For version...

PT-2025-27411 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.11 Description: DataEase is an open source business intelligence and data visualization tool. There is a bypass vulnerability in DataEase's Redshift Data Source JDBC Connection Parameters. The sslfactory and...

PT-2025-27116 · Lifterlms · Lifterlms

Name of the Vulnerable Software and Affected Versions: LifterLMS versions n/a through 8.0.6 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

PT-2025-27052 · WordPress +1 · Responsive Lightbox & Gallery +1

Name of the Vulnerable Software and Affected Versions: Responsive Lightbox & Gallery WordPress plugin versions prior to 2.5.2 Description: The issue concerns the use of the Swipebox library in the Responsive Lightbox & Gallery WordPress plugin, which fails to validate and escape title attributes...

SUSE SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2025:01991-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01991-1 advisory. grafana was updated from version 10.4.15 to 11.5.5 jscPED-12918: - Security issues fixed: CVE-2025-4123: Fix cross-site scriptin...

PT-2025-26690 · Llama.Cpp · Llama.Cpp

Name of the Vulnerable Software and Affected Versions: llama.cpp version prior to b5721 Description: The issue is related to a signed vs. unsigned integer overflow in the llama vocab::tokenize function of llama.cpp's tokenizer implementation, resulting in unintended behavior during token copying...

PT-2025-26687 · Unknown · Sysmonelixir

Name of the Vulnerable Software and Affected Versions: SysmonElixir versions prior to 1.0.1 Description: The issue concerns SysmonElixir, a system monitor HTTP service in Elixir. Prior to version 1.0.1, the "/read" endpoint reads any file from the server's file system, including sensitive files...

PT-2025-26724

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: An attacker was able to bypass the connect-src directive of a Content Security Policy by manipulating subdocuments, which would have also hidden the connections from the Network tab in Devtools...

PT-2025-25769 · Lychee · Lychee

Name of the Vulnerable Software and Affected Versions: Lychee versions 6.6.6 through 6.6.9 Description: The issue affects Lychee, a free photo-management tool. An attacker can exploit a path traversal vulnerability in SecurePathController.php to leak local files, including environment variables,...

Apple MacOSX Security Update (HT122902)

Apple Mac OS X is prone to an unspecified vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 41 : wireshark (2025-8043d4cd71)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-8043d4cd71 advisory. New version 4.4.7 ---- Ignoring potential error when using udevadm in %post scriptlet Tenable has extracted the preceding description block directly...

Fedora 43 : caddy (2025-89401f2116)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-89401f2116 advisory. Update to version 2.10.0. Aside from the new upstream features, this update also refreshes many bundled dependencies, fixing a few CVEs...

Fedora 42 : caddy (2025-4518c12e2f)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4518c12e2f advisory. Update to version 2.10.0. Aside from the new upstream features, this update also refreshes many bundled dependencies, fixing a few CVEs...

Windows App Client Multiple Vulnerabilities (Jun 2025) - Windows

Windows App Client is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:microsoft:windowsapp";...

PT-2025-24820 · Erxes · Erxes

Name of the Vulnerable Software and Affected Versions: Erxes versions prior to 1.6.1 Description: The issue is related to Incorrect Access Control, allowing an attacker to bypass authentication. This can be achieved by providing a "User" HTTP header with any user, enabling access to any GraphQL...

PT-2025-25102 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: The issue is a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. When ...

CVE-2024-37394

A stored cross-site scripting XSS vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Dashboard title' and 'Dashboard content' text boxes. This can lead to the execution of malicious...