PT-2025-43167

Name of the Vulnerable Software and Affected Versions DELUCKS SEO versions through 2.5.9 Description A missing authorization flaw exists in DELUCKS SEO. This allows access to functionality that is not properly restricted by Access Control Lists ACLs. Recommendations Update DELUCKS SEO to a versio...

PT-2025-43211

Name of the Vulnerable Software and Affected Versions billingo Official Integration for Billingo versions through 4.2.5 Description A missing authorization flaw exists in billingo Official Integration for Billingo. This issue allows for privilege escalation. Recommendations Update billingo Offici...

PT-2025-43273

Name of the Vulnerable Software and Affected Versions Arevico WP Tactical Popup versions through 1.1 Description The software contains a flaw related to improper input handling during web page generation, specifically a Reflected Cross-Site Scripting XSS issue. This allows for the injection of...

PT-2025-43409

Name of the Vulnerable Software and Affected Versions BookLore versions 1.8.1 and prior Description BookLore is a self-hosted web app for managing book collections. Versions prior to a recent update have an authentication bypass issue in the BookMediaController. This allows unauthenticated users ...

Use of a Cryptographic Primitive with a Risky Implementation

Overview Affected versions of this package are vulnerable to Use of a Cryptographic Primitive with a Risky Implementation in the handling of precompiles in the BalanceHandler that can cause prevEventsLen to be overwritten. An attacker can compromise the integrity or confidentiality of the system ...

Server-side Request Forgery (SSRF)

Overview shopware/core is a Shopware platform is the core for all Shopware ecommerce products. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the PDF generation process. An attacker can cause the server to send HTTP requests to internal or external...

CVE-2025-22166

This High severity DoS Denial of Service vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely...

EUVD-2025-35185

This High severity DoS Denial of Service vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely...

CVE-2025-22166

CVE-2025-22166 is a Denial of Service vulnerability affecting Atlassian Confluence Data Center. Introduced in Confluence Data Center 2.0, it enables an unauthenticated remote attacker to render the host unavailable by disrupting services, with high impact on availability. The advisory recommends ...

GHSA-7RC8-5C8Q-JR6J Taguette password reset link poisoning

Impact An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. Patches Users should upgrade to Taguette 1.5.0. References -...

Improper Isolation or Compartmentalization

Overview Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization of Groovy code provided by delegated administrators. A privileged attacker can execute arbitrary code remotely by providing malicious Groovy implementations that are loaded and executed by the...

Incomplete Filtering of One or More Instances of Special Elements

Overview org.webjars.npm:validator is an A library of string validators and sanitizers. Affected versions of this package are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength function that does not take into account Unicode variation selectors \uFE0F...

Incomplete List of Disallowed Inputs

Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs involving the PHP arraysearch function. An attacker can gain unauthorized access to a PayPal merchant account. Note: Versions 9.4.3.1 through 9.4.3.3, which used the build numbering scheme prior to...

CVE-2025-41254 Spring Framework STOMP CSRF Vulnerability

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework: 6.2.0 - 6.2.11 6.1.0 - 6.1.23 6.0.x - 6.0.29 5.3.0 - 5.3.45 Older, unsupported versions are also affected...

Missing Authorization

Overview github.com/mattermost/mattermost-server is an open source Slack-alternative in Golang and React. Affected versions of this package are vulnerable to Missing Authorization via the /api/v4/teams/teamid/channels/ids endpoint. An attacker can access sensitive channel metadata by sending...

Missing Authorization

Overview github.com/mattermost/mattermost/server/v8/channels/web is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Missing Authorization in the RelayState parameter. An attacker can gain unauthorized access ...

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions

Summary d3-color and brace-expansion vulnerabilities are addressed in IBM Business Automation Manager Open Editions 9.3.0. Those libraries are used in the UI components of IBM Business Automation Manager Open Editions. Vulnerability Details CVEID:CVE-2025-5889 DESCRIPTION: A vulnerability was fou...

SQL Plugin Job Fails with Error: "Mandatory arguments not set" or "Starting retention policy task"

Challenge After the upgrade or installation of the patch for Veeam Backup & Replication 12.3.2.4165, existing Veeam Plug-In for Microsoft SQL jobs fail with the following error: Failed to backup database. Error: Mandatory arguments not set Session failed: Mandatory arguments not set. Starting...

CVE-2025-62375

The CVE describes an improper verification in the AWS attestor used by go-witness and witness. In affected versions, the attestor can accept forged AWS EC2 instance identity documents when a signature is absent/empty or RSA verification fails, and it relies on a legacy global AWS certificate inst...

DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Dependency in Jira Service Management Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 5.12.0, 10.3.0, 10.7.1, and 11.0.0 of Jira Service Management Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...