PT-2025-53905

Name of the Vulnerable Software and Affected Versions bizswoop BizPrint versions through 4.6.7 Description An authorization issue exists within bizswoop BizPrint, allowing exploitation due to incorrectly configured access control security levels. This allows unauthorized access. Recommendations...

PT-2025-53639

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.0 Description A security issue exists in JeecgBoot that allows for improper authorization. This is due to the manipulation of the departId argument within the getParameterMap function located in the...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the propagation of token scope for access control within Gitea's package registry. An attacker can gain unauthorized access or perform actions beyond their intended permissions by exploiting improper enforceme...

Improper Protection of Alternate Path

Overview Affected versions of this package are vulnerable to Improper Protection of Alternate Path due to insufficient validation in attachment editing APIs. An attacker can upload files with restricted extensions by modifying the attachment name, leading to unauthorized file uploads and further...

Improper Protection of Alternate Path

Overview Affected versions of this package are vulnerable to Improper Protection of Alternate Path due to insufficient validation in attachment editing APIs. An attacker can upload files with restricted extensions by modifying the attachment name, leading to unauthorized file uploads and further...

PT-2025-53097

Name of the Vulnerable Software and Affected Versions HasThemes WC Builder versions through 1.2.0 Description A flaw exists in HasThemes WC Builder that allows for Stored Cross-Site Scripting XSS. This occurs due to improper neutralization of input during web page generation. The issue allows an...

PT-2025-53278

Name of the Vulnerable Software and Affected Versions CRM Perks Integration for Contact Form 7 HubSpot versions through 1.4.2 Description A flaw exists in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubspot that allows for Blind SQL Injection. This is due to improper neutralization of...

[SECURITY] [DLA 4418-1] python-mechanize security update

Debian LTS Advisory DLA-4418-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert December 22, 2025 https://wiki.debian.org/LTS Package : python-mechanize Version : 1:0.4.5-2+deb11u1 CVE ID : CVE-2021-32837 Erik Krogh Kristensen and Rasmus Petersen from the GitHub...

PT-2026-22035

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.10.1 n8n versions prior to 2.9.3 n8n versions prior to 1.123.22 Description An issue exists in the expression evaluation system where expressions supplied by authenticated users during workflow configuration may be...

CVE-2025-68613

CVE-2025-68613 (n8n) : Affects n8n open source workflow automation prior to patched versions 1.120.4, 1.121.1, 1.122.0. Root cause is insufficient isolation in the workflow expression evaluation system, allowing authenticated users to cause the n8n process to execute arbitrary code in the runtime...

Authorization Bypass Through User-Controlled Key

Overview pretix is a Reinventing presales, one ticket at a time Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the UUID parameter in multiple API endpoints. An attacker can access sensitive files belonging to other users by supplying the...

Huawei EulerOS: Security Advisory for unbound (EulerOS-SA-2025-2567)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpng (UTSA-2025-991284)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991284 advisory. LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. Prior to 1.6.52, an...

Incorrect Authorization

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Incorrect Authorization in the live queries. An attacker can access unauthorized data by sending a crafted HTTP request. Remediati...

Allocation of Resources Without Limits or Throttling

Overview org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the snapshot restore request due to improper length validation for renamereplacement. An attacker can exhau...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the ParseUDP function. An attacker can cause the application to crash or exhaust resources by sending a single crafted UDP packet with an invalid fragment sequence number. Remediation Upgrade...

Packetbeat 8.19.9, 9.1.9, and 9.2.3 Security Update (ESA-2025-30)

Packetbeat Improper Bounds Check ESA-2025-30 Improper Bounds Check CWE-787 in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow CAPEC-100 and reliably crash the application or cause significant resource exhaustion via a single crafted UDP packet with an invalid...

Sensitive Cookie in HTTPS Session Without "Secure" Attribute

Overview Kentico.Xperience.Libraries is a package for libraries and applications that use Kentico Xperience API. Affected versions of this package are vulnerable to Sensitive Cookie in HTTPS Session Without "Secure" Attribute via the SetValue method in the CookieHelper class. The requireSSL...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the HTML style sanitizer module. An attacker can access sensitive information by crafting malicious HTML content that is improperly sanitized when viewed by a user. Remediation Upgrade...

HTML injection in Asset List in Guardian/CMC before 25.5.0

Summary A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data. Impact An unauthenticated attacker can send specially crafted network packets to inject HTML tags into asset attributes. When a victim views the affecte...