PT-2025-4839 · Github · Github

Name of the Vulnerable Software and Affected Versions: matrix-hookshot versions 5.4.1 and earlier matrix-hookshot versions 6.0.1 and earlier Description: The issue is related to a Denial of Service DoS condition that can occur when the software is configured with GitHub support. This happens due ...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 18.0.4 (openstack-ironic) security update

An update for openstack-ironic is now available for Red Hat OpenStack Platform 18.0.4 Antelope. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2025-23846

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in thaikolja Flexible Blogtitle flexible-blogtitle allows Reflected XSS.This issue affects Flexible Blogtitle: from n/a through = 0.1...

CVE-2025-23607

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Camoo Sarl CAMOO SMS camoo-sms allows Reflected XSS.This issue affects CAMOO SMS: from n/a through = 3.0.1...

PT-2025-5016 · Localgrid · Localgrid

Name of the Vulnerable Software and Affected Versions: LocalGrid versions n/a through 1.0.1 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables an attacker to inject malicious scripts into ...

CVE-2025-24013 CodeIgniter validation of header name and value

CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functionality, potentially causing errors or...

CVE-2025-21653

In the Linux kernel, the following vulnerability has been resolved: netsched: clsflow: validate TCAFLOWRSHIFT attribute syzbot found that TCAFLOWRSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values. UBSAN: shift-out-of-bounds in...

CVE-2024-41783

IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow a privileged user to inject commands into the underlying operating system due to improper validation of a specified type of input...

CVE-2024-41783 IBM Sterling Secure Proxy improper input validation

IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow a privileged user to inject commands into the underlying operating system due to improper validation of a specified type of input...

CVE-2024-45654

IBM Security ReaQta 3.12 is affected by CVE-2024-45654 due to reliance on untrusted inputs, enabling an authenticated user to perform unauthorized actions. The IBM advisory for QRadar EDR (version 3.12) documents the root cause as input validation relying on untrusted inputs and lists the affecte...

CVE-2024-13317

CVE-2024-13317 affects the ShipWorks Connector for Woocommerce (WordPress) up to version 5.2.5. Root cause: missing/incorrect nonce validation on the shipworks-wordpress page enabling CSRF. Impact: unauthenticated attackers could update the service credentials (username/password) by forging reque...

CVE-2024-13432 Webcamconsult <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Webcamconsult plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web...

CVE-2024-51462

IBM QRadar WinCollect Agent 10.0.0 through 10.1.12 could allow a remote attacker to inject XML data into parameter values due to improper input validation of assumed immutable data...

PT-2025-5299 · Apple · Ipados +6

Name of the Vulnerable Software and Affected Versions: visionOS versions prior to 2.3 iOS versions prior to 18.3 iPadOS versions prior to 18.3 macOS Sequoia versions prior to 15.3 watchOS versions prior to 11.3 tvOS versions prior to 18.3 Description: An input validation issue was addressed, whic...

WAVLINK AC3000 Buffer Overflow Vulnerability (CNVD-2025-08330)

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. The WAVLINK AC3000 suffers from a buffer overflow vulnerability, which is caused by the selmode parameter of the qos.cgi qossettings function failing to properly validate the length of the input data, which can be exploited by an...

GO-2025-3394 Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server

Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server...

PT-2025-5083 · Unknown · Gdpr Personal Data Reports

Name of the Vulnerable Software and Affected Versions: GDPR Personal Data Reports versions n/a through 1.0.5 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Stored XSS attacks. Recommendations:...

CVE-2025-20086 Insufficient Input Validation on Post Props

Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

CVE-2025-20036

CVE-2025-20036 affects Mattermost Mobile Apps, specifically versions

BIT-PHP-MIN-2020-7071 FILTER_VALIDATE_URL accepts URLs with invalid userinfo

In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filtervar$url, FILTERVALIDATEURL, PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong dat...