PT-2025-21444 · WordPress · Ip Based Login

Name of the Vulnerable Software and Affected Versions: IP Based Login WordPress plugin versions prior to 2.4.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in...

PT-2025-21393 · WordPress · Happyforms

Name of the Vulnerable Software and Affected Versions: Happyforms versions prior to 1.26.3 Description: The issue concerns the Happyforms plugin for WordPress, where certain settings are not properly sanitized and escaped. This could allow high-privilege users, such as administrators, to perform...

PT-2025-21372

Name of the Vulnerable Software and Affected Versions: LogDash Activity Log WordPress plugin versions prior to 1.1.4 Description: The issue concerns a SQL injection vulnerability. It occurs because the plugin does not properly escape the username when performing SQL requests, specifically when...

PT-2025-21352 · Automattic · Automattic Tours

Name of the Vulnerable Software and Affected Versions: Automattic Tours versions n/a through 1.0.0 Description: The issue is related to a Missing Authorization vulnerability. This means that there is a lack of proper authorization checks, potentially allowing unauthorized access to certain featur...

PT-2025-21462 · WordPress · Memberspace

Name of the Vulnerable Software and Affected Versions: MemberSpace WordPress plugin versions prior to 2.1.14 Description: The issue arises from the plugin's failure to sanitise and escape a parameter before outputting it back in the page. This leads to a Reflected Cross-Site Scripting issue that...

PT-2025-21565 · WordPress · Funnelkit

Name of the Vulnerable Software and Affected Versions: FunnelKit WordPress plugin versions prior to 3.10.2 Description: The issue allows administrators to perform SQL injection attacks due to a parameter not being sanitized and escaped before use in a SQL statement. Recommendations: For versions...

PT-2025-21538 · WordPress · Maspik

Name of the Vulnerable Software and Affected Versions: Maspik WordPress plugin versions prior to 2.1.3 Description: The issue concerns the Maspik WordPress plugin, where certain settings are not properly sanitized and escaped. This could allow high-privilege users, such as administrators, to...

PT-2025-21562 · WordPress · Plugin Oficial Wordpress

Name of the Vulnerable Software and Affected Versions: Plugin Oficial WordPress plugin through 1.7.3 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and escaped, a...

PT-2025-21442 · WordPress · Buddyboss Platform

Name of the Vulnerable Software and Affected Versions: buddyboss-platform versions prior to 2.7.60 Description: The issue is related to improper access controls in the buddyboss-platform WordPress plugin, allowing a logged-in user to view comments on private posts. Recommendations: For versions...

PT-2025-21348

Name of the Vulnerable Software and Affected Versions: Vyper versions up to and including 0.4.2rc1 Description: The issue concerns the slice builtin in Vyper, which can elide side effects when the output length is 0 and the source bytestring is a builtin, such as msg.data or .code. This occurs...

PT-2025-21440 · WordPress · Mailpoet

Name of the Vulnerable Software and Affected Versions: MailPoet WordPress plugin versions prior to 5.5.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for...

PT-2025-21452 · WordPress · Aweber Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: AWeber WordPress plugin versions 7.3.20 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for...

PT-2025-21548 · WordPress · Ekc Tournament Manager

Name of the Vulnerable Software and Affected Versions: EKC Tournament Manager WordPress plugin versions prior to 2.2.2 Description: The issue is related to the lack of a CSRF check when updating settings in the EKC Tournament Manager WordPress plugin. This could allow attackers to make a logged-i...

WordPress SureTriggers Plugin < 1.0.83 Privilege Escalation Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:suretriggers:suretriggers"; if description...

Mozilla Thunderbird ESR Security Update (mfsa_2025-34) - Windows

Mozilla Thunderbird ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

RHEL 8 / 9 : updated discovery-cli RPMs (Important) (RHSA-2025:7630)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7630 advisory. New version of Discovery CLI dsc and installer are now available for RHEL 8 and RHEL 9 for Discovery 1.14. Tenable has extracted the preceding...

PT-2025-21523 · WordPress · Everest Forms

Name of the Vulnerable Software and Affected Versions: Everest Forms versions prior to 3.0.3.1 Description: The issue concerns the Everest Forms WordPress plugin, where it fails to properly sanitize and escape some of its settings. This could allow high-privilege users, such as administrators, to...

PT-2025-21439 · WordPress · Mobile Contact Bar

Name of the Vulnerable Software and Affected Versions: Mobile Contact Bar WordPress plugin versions prior to 3.0.5 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised...

Security Bulletin: Vulnerability in Netty affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Netty has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

CLSA-2025-1747251120 buildah: Fix of 2 CVEs

Rebuild with new golang version to address the following CVEs: - CVE-2023-45287: Timing Side Channel attack in RSA based TLS key exchanges - CVE-2024-34156: panic due to stack exhaustion for Decoder.Decode...