PT-2025-28010

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions prior to 3.6.4 Description: The issue is related to a race condition in AESNI detection that can occur under certain compiler optimizations. This could potentially allow an attacker to extract an AES key from a multithreaded...

Slackware Linux 15.0 / current sudo Multiple Vulnerabilities (SSA:2025-181-01)

The version of sudo installed on the remote host is prior to 1.9.17p1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-181-01 advisory. New sudo packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding...

PT-2025-27470 · Dell · Openmanage Network Integration

Name of the Vulnerable Software and Affected Versions: Dell OpenManage Network Integration versions prior to 3.8 Description: The issue is related to an Authentication Bypass by Capture-replay vulnerability in the RADIUS protocol. An attacker with local network access could potentially exploit th...

PT-2025-27497 · Graylog · Graylog

Name of the Vulnerable Software and Affected Versions: Graylog versions prior to 6.2.4 Graylog versions prior to 6.3.0-rc.2 Description: A flaw in Graylog allows authenticated users to escalate privileges via API token abuse. This issue can be exploited by creating and using API tokens for the...

SUSE SLES12: libsqlite3-0 / libsqlite3-0-32bit / sqlite3 / sqlite3-devel / etc (SUSE-SU-2025:01455-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01455-1 advisory. - CVE-2025-3277,CVE-2025-29087: Fixed integer overflow in sqlite concat function bsc1241020 - CVE-2025-29088: Fixed integer overflow through t...

CVE-2025-53091

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the /controle/getProdutosPorAlmox.php endpoint. This issue allows any unauthenticated...

SUSE-SU-2025:01455-1 Security update for sqlite3

This update for sqlite3 fixes the following issues: - CVE-2025-3277,CVE-2025-29087: Fixed integer overflow in sqlite concat function bsc1241020 - CVE-2025-29088: Fixed integer overflow through the SQLITEDBCONFIGLOOKASIDE component bsc1241078 Other fixes: - Updated to version 3.49.1 from Factory...

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: Update to version 20250416.02 bsc1244304, bsc1244503 defaultSleeper: tolerate 10% difference to reduce test flakiness Add output of some packagemanagers to the testdata from version 20250416.01 Refactor OS Info package from version...

SUSE-SU-2025:02149-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: - Update to version 20250416.02 bsc1244304, bsc1244503 defaultSleeper: tolerate 10% difference to reduce test flakiness Add output of some packagemanagers to the testdata - from version 20250416.01 Refactor OS Info package - from...

PT-2025-27203 · Unknown · Rohil Contact Form – 7 : Hide Success Message

Name of the Vulnerable Software and Affected Versions: Rohil Contact Form – 7 : Hide Success Message versions 1.1.4 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For...

PT-2025-27121 · Unknown · Pebas Couponxxl Custom Post Types

Name of the Vulnerable Software and Affected Versions: pebas CouponXxL Custom Post Types versions 3.0 and earlier Description: The issue is related to an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation in pebas CouponXxL Custom Post Types. Recommendations: For versio...

PT-2025-27107 · Arraytics · Arraytics Eventin

Name of the Vulnerable Software and Affected Versions: Arraytics Eventin versions through 4.0.28 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. Recommendations: For versions through...

PT-2025-27134

Name of the Vulnerable Software and Affected Versions: themehunk Zita versions 1.6.5 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion in...

PT-2025-27224 · Unknown · Track Everything

Name of the Vulnerable Software and Affected Versions: Track Everything versions n/a through 2.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-27065 · WordPress · Vr Calendar

Name of the Vulnerable Software and Affected Versions: VR Calendar plugin for WordPress versions prior to 2.4.8 Description: The issue is related to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the syncCalendar function. This makes it possible for...

PT-2025-27226 · Re.Place · Re.Place

Name of the Vulnerable Software and Affected Versions: re.place versions 0.2.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web application, potential...

PT-2025-27187 · Unknown · Antoineh Football Pool

Name of the Vulnerable Software and Affected Versions: AntoineH Football Pool versions n/a through 2.12.5 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject...

PT-2025-27250 · Unknown · Tabberneue

Name of the Vulnerable Software and Affected Versions: TabberNeue versions 3.0.0 through 3.1.0 Description: The issue allows any user to insert arbitrary HTML into the DOM by inserting a payload into any allowed attribute of the tag, posing a significant security risk to user data. Recommendation...

PT-2025-27093 · Unknown · Content No Cache

Name of the Vulnerable Software and Affected Versions: Content No Cache versions 0.1.3 and earlier Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability, which allows Code Injection. This vulnerability affects the Content No Cache software...

PT-2025-27206 · Unknown · Gopi Plus Image Slider With Description

Name of the Vulnerable Software and Affected Versions: gopi plus Image Slider With Description versions n/a through 9.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions n/a through 9.2, update to a version that include...