PT-2025-20061 · Samsung · Samsung Notes

Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 4.4.29.23 Description: The issue is an out-of-bounds read in applying binary of text content. This allows attackers to read out-of-bounds memory. Recommendations: For versions prior to 4.4.29.23, update to...

PT-2025-20082 · Unknown · Listamester

Name of the Vulnerable Software and Affected Versions: Listamester versions prior to 2.3.7 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions prior to 2.3.7, update ...

PT-2025-20108 · Unknown · Testimonial Slider

Name of the Vulnerable Software and Affected Versions: GS Testimonial Slider versions 3.2.9 and earlier Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability, which allows Code Injection in GS Testimonial Slider. Recommendations: For GS...

PT-2025-20125 · Code Atlantic · Code Atlantic Content Control

Name of the Vulnerable Software and Affected Versions: Code Atlantic Content Control versions n/a through 2.6.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS attacks. This means that an attacker could potentially...

PT-2025-20187 · Unknown · Meks Flexible Shortcodes

Name of the Vulnerable Software and Affected Versions: Meks Flexible Shortcodes versions 1.3.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to...

PT-2025-20146 · Unknown · Karim42 Quran Multilanguage Text & Audio

Name of the Vulnerable Software and Affected Versions: karim42 Quran multilanguage Text & Audio versions n/a through 2.3.23 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

PT-2025-20293 · Unknown · Ixon Vpn Client

Name of the Vulnerable Software and Affected Versions: IXON VPN Client versions prior to 1.4.4 Description: The issue allows Local Privilege Escalation to SYSTEM due to code execution from a configuration file that can be controlled by a low-privileged user. A race condition exists where a...

PT-2025-20197 · Woocommerce · Awin – Advertiser Tracking For Woocommerce

Name of the Vulnerable Software and Affected Versions: Awin – Advertiser Tracking for WooCommerce versions n/a through 2.0.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions n/a through 2.0.0, update ...

PT-2025-20216 · Liveagent · Liveagent

Name of the Vulnerable Software and Affected Versions: LiveAgent versions n/a through 4.4.7 Description: A Cross-Site Request Forgery CSRF issue affects the LiveAgent software. This issue allows for Cross Site Request Forgery. Recommendations: For versions n/a through 4.4.7, update to a version...

PT-2025-20180 · Unknown · Easy Connect

Name of the Vulnerable Software and Affected Versions: EasyMe Connect versions 3.0.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 3.0.3 and earlier, update to...

PT-2025-20230 · Unknown · Ultimate Member

Name of the Vulnerable Software and Affected Versions: Ultimate Member versions through 2.10.3 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection'. This allows for Code Injection in Ultimate Member. Recommendations: For versions through...

PT-2025-20127 · Unknown · Wpo-Hr Ngg Smart Image Search

Name of the Vulnerable Software and Affected Versions: wpo-HR NGG Smart Image Search versions 3.3.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacke...

PT-2025-20207 · WordPress · Wp-Recall

Name of the Vulnerable Software and Affected Versions: WP-Recall versions through 16.26.14 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion in...

CVE-2025-46735

Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found in Terraform WinDNS Provider before version 1.0.5. The windnsrecord resource did not sanitize the input variables. This could lead to authenticated command...

Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`

Impact: A security issue has been found in terraform-provider-windns before version 1.0.5. The windnsrecord resource did not santize the input variables. This can lead to authenticated command injection in the underlyding powershell command prompt. Patches: 83ef736 fix: better input validation...

CVE-2025-46728

cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when Transfer-Encoding: chunked is used or when no Content-Length header is provided. A remote attacker can send a chunked...

CVE-2025-46728 cpp-httplib has Unbounded Memory Allocation in Chunked/No-Length Requests

cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when Transfer-Encoding: chunked is used or when no Content-Length header is provided. A remote attacker can send a chunked...

PT-2025-19981 · Hashicorp · Terraform Windns Provider

Name of the Vulnerable Software and Affected Versions: Terraform WinDNS Provider versions prior to 1.0.5 Description: A security issue has been found in the Terraform WinDNS Provider, where the windns record resource did not sanitize the input variables, leading to authenticated command injection...

Azure Linux 3.0 Security Update: kernel (CVE-2025-21687)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21687 advisory. - In the Linux kernel, the following vulnerability has been resolved: vfio/platform: check the bounds of...

PT-2025-19989 · Crestron · Crestron Automate Vx

Name of the Vulnerable Software and Affected Versions: Crestron Automate VX versions 5.6.8161.21536 through 6.4.0.49 Description: The issue allows for the exposure of sensitive information to an unauthorized actor, enabling functionality misuse. There is no visible indication when the system is...