CVE-2025-29908

Netty QUIC codec is a QUIC codec for netty which makes use of quiche. An issue was discovered in the codec. A hash collision vulnerability in the hash map used to manage connections allows remote attackers to cause a considerable CPU load on the server a Hash DoS attack by initiating connections...

CVE-2025-29766

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on artifact submission & edition from the tracker view. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up...

Jenkins Cadence vManager Plugin Stores Verisium Manager vAPI keys Unencrypted

Jenkins Cadence vManager Plugin 4.0.0-282.v5096ac2db275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins...

GHSA-PPH8-GCV7-4QJ5 PyO3 Risk of buffer overflow in `PyString::from_object`

PyString::fromobject took &str arguments and forwarded them directly to the Python C API without checking for terminating nul bytes. This could lead the Python interpreter to read beyond the end of the &str data and potentially leak contents of the out-of-bounds read by raising a Python exception...

SUSE-SU-2025:1099-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20250331T171002 2025-03-31T17:10:02Z jscPED-11136 GO-2025-3443 GO-2025-3548 GO-2025-3557 GO-2025-3558 GO-2025-3559 - Update to version 0.0.20250327T184518 2025-03-27T18:45:18Z jscPED-11136 GO-2025-3526...

PT-2025-14480

Name of the Vulnerable Software and Affected Versions Moodle versions up to 4.5.2 Description The issue concerns an information disclosure in the REST API. Recommendations For versions up to 4.5.2, update to a version that contains a fix for this issue...

CVE-2025-31121 OpenEMR allows XSS in Patient Image feature

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 7.0.3.1, the Patient Image feature in OpenEMR is vulnerable to cross-site scripting attacks via the EXIF title in an image. This vulnerability is fixed in 7.0.3.1...

PT-2025-14048 · Unknown · Greek Multi Tool

Name of the Vulnerable Software and Affected Versions: Greek Multi Tool – Fix peralinks, accents, auto create menus and more versions prior to 2.3.1 Description: The issue is related to Missing Authorization, allowing exploitation of incorrectly configured access control security levels...

Important: ghostscript

Issue Overview: The calculation of the buffer size was being done with int values, and overflowing that data type. The bug has existed since the creation of the file contrib/japanese/gdevnpdl.c The calculation of the buffer size was being done with int values, and overflowing that data type. By...

PT-2025-14392 · Unknown · Next-Cart Store To Woocommerce Migration

Name of the Vulnerable Software and Affected Versions: Next-Cart Store to WooCommerce Migration versions 3.9.4 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

PT-2025-14410 · WordPress · Wordpress Galleria

Name of the Vulnerable Software and Affected Versions: WordPress Galleria versions 1.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inje...

PT-2025-14178 · Unknown · Piotnet Forms

Name of the Vulnerable Software and Affected Versions: Piotnet Forms versions 1.0.0 through 1.0.30 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-14182 · Publitio · Publitio

Name of the Vulnerable Software and Affected Versions: Publitio versions 2.1.8 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels. Recommendations: For Publitio versions 2.1...

CVE-2025-29049

Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before fixed in 0.104.0 allows an attacker to execute arbitrary code via the MathLive function...

PT-2025-14266 · Unknown · Gosign – Posts Slider Block

Name of the Vulnerable Software and Affected Versions: Gosign – Posts Slider Block versions 1.1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers...

PT-2025-14096

Name of the Vulnerable Software and Affected Versions MongoDB Server versions 5.0 prior to 5.0.31 MongoDB Server versions 6.0 prior to 6.0.20 MongoDB Server versions 7.0 prior to 7.0.16 MongoDB Server versions 8.0 prior to 8.0.4 Description The issue arises when the explain command is run with...

PT-2025-14214 · WordPress · Brice Capobianco Wp Plugin Info Card

Name of the Vulnerable Software and Affected Versions: Brice Capobianco WP Plugin Info Card versions through 5.2.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an...

PT-2025-14261 · Unknown · Daniel Floeter Hyperlink Group Block

Name of the Vulnerable Software and Affected Versions: Daniel Floeter Hyperlink Group Block versions 2.0.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This can lead to cross-site scripting attacks...

PT-2025-14075 · Unknown · Mdjm Event Management

Name of the Vulnerable Software and Affected Versions: MDJM Event Management versions 1.7.5.2 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection in MDJM Event Management. Recommendations: For MDJM Event Management versions 1.7.5.2 and...

PT-2025-14400 · Woocommerce · Plugin Oficial – Getnet Para Woocommerce

Name of the Vulnerable Software and Affected Versions: Plugin Oficial – Getnet para WooCommerce versions 1.7.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS...