PT-2025-16506 · Shapedplugin Llc · Real Testimonials

Name of the Vulnerable Software and Affected Versions: ShapedPlugin LLC Real Testimonials versions 3.1.6 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can...

PT-2025-16422

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.0 through 8.0.41 MySQL Server versions 8.4.0 through 8.4.4 MySQL Server versions 9.0.0 through 9.2.0 Description The issue allows a low-privileged attacker with network access via multiple protocols to compromise MySQ...

PT-2025-16522 · Unknown · Glossy Blog

Name of the Vulnerable Software and Affected Versions: Glossy Blog versions 1.0.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject malicious script...

SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2025:1226-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:1226-1 advisory. - Update to version 0.0.20250409T170536 2025-04-09T17:05:36Z jscPED-11136 GO-2025-3591 GO-2025-3594 GO-2025-3598 GO-2025-3599 - Update to...

PT-2025-16404

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 8.0.0 through 8.0.41 Oracle MySQL versions 8.4.0 through 8.4.4 Oracle MySQL versions 9.0.0 through 9.2.0 Description The issue allows a high-privileged attacker with network access via multiple protocols to compromise the...

PT-2025-16314 · Jetblog · Jetblog

Name of the Vulnerable Software and Affected Versions: JetBlog versions n/a through 2.4.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker can inject...

PT-2025-16362 · Openrazer +1 · Openrazer +1

Name of the Vulnerable Software and Affected Versions: OpenRazer versions prior to 3.10.2 Description: The issue allows an attacker to cause the custom kernel driver to read more bytes than provided by user space by writing specially crafted data to the matrix custom frame file. This data will be...

PT-2025-16438

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.0 through 8.0.41 MySQL Server versions 8.4.0 through 8.4.4 MySQL Server versions 9.0.0 through 9.2.0 Description The issue allows a high-privileged attacker with network access via multiple protocols to compromise MyS...

RHEL 7 : python-django (RHSA-2016:2041)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:2041 advisory. Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as...

PT-2025-16284 · Unknown · Http-Proxy-Middleware

Name of the Vulnerable Software and Affected Versions: http-proxy-middleware versions 2.0.9 and earlier, 3.x versions prior to 3.0.5 Description: The issue arises when fixRequestBody proceeds even if bodyParser has failed. This can lead to potential security risks. Recommendations: For versions...

CVE-2025-32428 Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended

Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still...

CVE-2025-32428 Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended

Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still...

CVE-2025-31491

CVE-2025-31491 affects AutoGPT prior to version 0.6.1. A custom requests wrapper does not follow redirects safely: the initial request is not redirected, but the wrapper re-issues the request to the new location. Crucially, this re-request path does not account for security-sensitive headers and ...

CVE-2024-49709

Technical details about CVE-2024-49709 are not publicly available in the provided connected documents. The initial description mentions session cookie abuse and non-destroyed sessions; monitor for official advisories or patches for confirmation of affected versions and remediation.

CVE-2024-10087 XSS in iKSORIS

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS Cross-site Scripting attacks. An attacker might craft a link containing a malicious script, which then gets directly embedded in references to other resources, what causes the script to run in user's context...

Medium: containerd

Issue Overview: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing...

PT-2025-16379

Name of the Vulnerable Software and Affected Versions gorilla/csrf versions prior to 1.7.2 Description The issue concerns a Cross Site Request Forgery CSRF prevention middleware for Go web applications and services. It does not validate the Origin header against an allowlist prior to version 1.7....

Debian: Security Advisory (DLA-4127-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-16257 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2024.0.3 Description: A database manipulation issue allows an unauthenticated attacker to modify the contents of WhatsUp.dbo.WrlsMacAddressGroup. This enables attackers to tamper with the database without...

Medium: nerdctl

Issue Overview: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing...