LibreOffice Improper Verification of Cryptographic Signature Vulnerability (Apr 2025) - Linux

LibreOffice is prone to an improper verification of cryptographic signature vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE ...

PT-2025-18056

Name of the Vulnerable Software and Affected Versions SeventhQueen Kleo versions prior to 5.4.4 Description The issue is related to a missing authorization vulnerability. This problem affects SeventhQueen Kleo, with no specific details on the estimated number of potentially affected devices or...

Fedora 40 : thunderbird (2025-fd8eb9ca57)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-fd8eb9ca57 advisory. Update to 128.9.2 https://www.thunderbird.net/en-US/thunderbird/128.9.1esr/releasenotes/...

KLA82866 SB vulnerability in LibreOffice

Improper Verification of Cryptographic Signature vulnerability was found in LibreOffice. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories CVE-2025-2866: PDF signature forgery with adbe.pkcs7.sha1 SubFilter Exploitation Public exploits exist for...

Debian dla-4140 : gir1.2-soup-2.4 - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4140 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4140-1 [email protected]...

WordPress Jupiter X Core plugin <= 4.8.11 - Unauthenticated PHP Object Injection via PHAR vulnerability

Unauthenticated PHP Object Injection via PHAR vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin JupiterX Core versions = 4.8.11...

CVE-2025-46333 z2d OOB composition could lead to invalid memory access and corruption

z2d is a pure Zig 2D graphics library. Versions of z2d after 0.5.1 and up to and including 0.6.0, when writing from one surface to another using z2d.compositor.StrideCompositor.run, and higher-level operations when the anti-aliasing mode is set to .default such as Context.fill, Context.stroke,...

GHSA-F3GW-9WW9-JMC3 Craft CMS Allows Remote Code Execution

Impact This is an additional fix for https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g This is a high-impact, low-complexity attack vector. To mitigate the issue, users running Craft installations before the fixed versions are encouraged to update to at least that version...

PT-2025-11: Server-Side Request Forgery (SSRF) in HTML2PDF

During the analysis of the HTML2PDF library version 5.3.1, despite the existence of the defense mechanism that was implemented to validate source image paths, a vulnerability allowing SSRF execution was found. The application performs insufficient validation of the destination address before...

GIMP Multiple Vulnerabilities (Apr 2025) - Windows

GIMP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gimp:gimp"; ifdescription...

Ubuntu: Security Advisory (USN-7462-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-17938 · Unknown · Ngeniusone

Name of the Vulnerable Software and Affected Versions: nGeniusONE versions prior to 6.4.0 b2350 Description: The issue is related to a weak sudo configuration. Recommendations: For versions prior to 6.4.0 b2350, update to version 6.4.0 b2350 or later to resolve the issue...

PT-2025-17780 · WordPress · Trân Minh-Quân Wpvn

Name of the Vulnerable Software and Affected Versions: Trân Minh-Quân WPVN versions 0.7.8 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Trân Minh-Quân WPVN...

PT-2025-17847 · WordPress · Eform

Name of the Vulnerable Software and Affected Versions: eForm - WordPress Form Builder plugin versions up to, and including, 4.18.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to...

PT-2025-17833 · WordPress · Ankur Vishwakarma Wp Avcl Automation Helper

Name of the Vulnerable Software and Affected Versions: Ankur Vishwakarma WP AVCL Automation Helper formerly WPFlyLeads versions 3.4 and earlier Description: A Server-Side Request Forgery SSRF issue allows for Server Side Request Forgery. Recommendations: For versions 3.4 and earlier, update to a...

PT-2025-17793 · Unknown · Bbcode Deluxe

Name of the Vulnerable Software and Affected Versions: BBCode Deluxe versions through 2020.08.01.2 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This can lead to Cross-site Scripting attacks. Recommendations: For...

PT-2025-17818 · Unknown · Shamim Hasan Custom Functions Plugin

Name of the Vulnerable Software and Affected Versions: Shamim Hasan Custom Functions Plugin versions 1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For Shamim Hasan Custom Functions Plugin versions 1.1 and earlier...

PT-2025-17728 · Acronis · Acronis Cyber Protect Cloud Agent

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Cloud Agent Windows versions prior to build 39904 Description: The issue is related to local privilege escalation due to insecure folder permissions. Recommendations: For versions prior to build 39904, update to build...

PT-2025-17763 · Angelo Mandato · Powerpress Podcasting

Name of the Vulnerable Software and Affected Versions: Angelo Mandato PowerPress Podcasting versions prior to 11.12.6 Description: The issue allows attackers to upload dangerous files, potentially leading to the upload of a web shell to a web server. This can be exploited through unrestricted fil...

Debian: Security Advisory (DLA-4136-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...