PT-2025-17792 · Unknown · Metaloha Dropdown Content

Name of the Vulnerable Software and Affected Versions: metaloha Dropdown Content versions n/a through 1.0.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in metaloha Dropdown Content...

PT-2025-17824 · Unknown · Alphasis Related Posts Via Taxonomies

Name of the Vulnerable Software and Affected Versions: alphasis Related Posts via Taxonomies versions n/a through 1.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a...

PT-2025-17835 · WordPress · Domain Aliases +1

Name of the Vulnerable Software and Affected Versions: Landing pages and Domain aliases for WordPress versions 0.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

PT-2025-17733 · Trpc · Trpc

Name of the Vulnerable Software and Affected Versions: tRPC versions 11.0.0 through 11.1.0 Description: The issue allows any unauthenticated user to crash a tRPC 11 WebSocket server by throwing an unhandled error when validating invalid connectionParams. This affects tRPC 11 servers with WebSocke...

CVE-2025-32966

DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.8...

GHSA-GGPF-24JW-3FCW CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0

Description https://github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54 reported a vulnerability where loading a malicious model could result in code execution on the vllm host. The fix applied to specify weightsonly=True to calls to torch.load did not solve the problem prior to...

Tenable Nessus Privilege Escalation Vulnerability (TNS-2025-05)

Tenable Nessus is prone to a local privilege escalation vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-17656 · Drupal · Drupal Colorbox

Name of the Vulnerable Software and Affected Versions: Drupal Colorbox versions 0.0.0 through 2.1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows an attacker to perform Cross-Site Scripting XSS...

Google Chrome Security Update (stable-channel-update-for-desktop_22-2025-04) - Linux

Google Chrome is prone to an unspecified vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...

PT-2025-17658 · Drupal · Drupal Block Class

Name of the Vulnerable Software and Affected Versions: Drupal Block Class versions 4.0.0 through 4.0.0 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, in the Drupal Block Class. This allows for Cross-Site...

CVE-2025-32965

xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also malicious, though it is less likely t...

PT-2025-17528 · Caseproof · Memberpress

Name of the Vulnerable Software and Affected Versions: Memberpress versions 1.11.37 and earlier Description: The issue affects the Memberpress plugin, allowing for Reflected Cross-site Scripting XSS. This occurs due to improper neutralization of input during web page generation. Recommendations:...

PT-2025-17482 · Hitachi · Hitachi Ops Center Analyzer +1

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Common Services versions 10.0.0-00 through 11.0.0-04 Hitachi Ops Center Analyzer viewpoint OVF versions 10.0.0-00 through 11.0.0-04 Description: The issue is related to an authentication credentials leakage. This means that...

PT-2025-17576 · Unknown · Cuba Rest Api Add-On

Name of the Vulnerable Software and Affected Versions: CUBA REST API add-on versions prior to 7.2.7 Description: The issue allows malicious JavaScript code to be executed in the browser by manipulating the input parameter, which consists of a file path and name, to return the Content-Type header...

PT-2025-17533 · Crocoblock · Jetelements For Elementor

Name of the Vulnerable Software and Affected Versions: JetElements For Elementor versions 2.7.4.1 and earlier Description: The issue is related to missing authorization, allowing access to functionality not properly constrained by Access Control Lists ACLs. This could potentially lead to...

PT-2025-19702 · Opensuse +1 · Govulncheck-Vulndb

Name of the Vulnerable Software and Affected Versions: govulncheck-vulndb versions prior to 0.0.20250416T165455 Description: This update addresses multiple issues within govulncheck-vulndb. The update includes fixes for GO-2025-3595, GO-2025-3601, and GO-2025-3602. Recommendations: Update to...

PT-2025-17488 · WordPress · User Registration & Membership

Name of the Vulnerable Software and Affected Versions: User Registration & Membership WordPress plugin version 4.1.2 and earlier Description: The issue concerns the User Registration & Membership WordPress plugin, where data in an AJAX action is not properly validated when the Membership Addon is...

PT-2025-17497 · Unknown · Affiliate-Toolkit

Name of the Vulnerable Software and Affected Versions: affiliate-toolkit versions through 3.7.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions through 3.7.3,...

CVE-2025-3857

When reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class, Amazon.IonDotnet does not check the number of bytes read from the underlying stream while deserializing the binary format. If the Ion data is malformed or truncated, this triggers an infinite loop condition tha...

openSUSE Security Advisory (openSUSE-SU-2025:0131-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...