PT-2025-15290

Name of the Vulnerable Software and Affected Versions libvips versions prior to 8.16.1 Description The issue arises from the heifsave operation in libvips, which can incorrectly determine the presence of an alpha channel in a "multiband" input. This can occur with a well-crafted TIFF image, leadi...

PT-2025-15294 · Unknown · Apollo Gateway

Name of the Vulnerable Software and Affected Versions: Apollo Gateway versions prior to 2.10.1 Description: The issue concerns a vulnerability that allows queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansio...

PT-2025-15888 · Dell · Dell Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 9.4.0.0 through 9.10.0.0 Description: The issue concerns an exposure of information through directory listing, which could be exploited by a low privileged attacker with local access, potentially leading to...

PT-2025-15306 · Renrenio · Renren-Security

Name of the Vulnerable Software and Affected Versions: renrenio renren-security versions up to 5.4.0 Description: A vulnerability has been found in renrenio renren-security, affecting an unknown part of the JSON Handler component. The manipulation leads to cross-site scripting attacks, which can ...

PT-2025-15298 · Unknown · Apollo Router Core

Name of the Vulnerable Software and Affected Versions: Apollo Router Core versions prior to 1.61.2 Apollo Router Core versions prior to 2.1.1 Description: The issue concerns a vulnerability in the Apollo Router Core that allows queries with deeply nested and reused named fragments to be...

PT-2025-15241 · Unknown · Estree-Util-Value-To-Estree

Name of the Vulnerable Software and Affected Versions: estree-util-value-to-estree versions prior to 3.3.3 Description: The issue arises when estree-util-value-to-estree converts a JavaScript value to an ESTree expression. Specifically, when generating an ESTree from a value with a property named...

PT-2025-15293 · Unknown · Apollo-Compiler

Name of the Vulnerable Software and Affected Versions: apollo-compiler versions prior to 1.27.0 Description: The issue concerns a query-based compiler for the GraphQL query language. Prior to version 1.27.0, a vulnerability allowed queries with deeply nested and reused named fragments to be...

CVE-2025-31480

aiven-extras is a PostgreSQL extension. This is a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages the format function not being schema-prefixed. Affected users should install 1.1.16 and...

PT-2025-15122

Name of the Vulnerable Software and Affected Versions mod auth openidc versions prior to 2.4.16.11 Description A bug in mod auth openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure include an OIDCProviderAuthRequestMethod POST, a valid accoun...

PT-2025-15082 · Unknown · Chainmaker

Name of the Vulnerable Software and Affected Versions: ChainMaker versions prior to 2.4.0 Description: The issue arises from concurrent writes to a map by logger.go when a node's configuration file is frequently updated and the node is restarted. This can lead to a read-write conflict, resulting ...

PT-2025-29223

Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers versions 4.50.3 and earlier Hugging Face Transformers version 4.52.1 Description: A Regular Expression Denial of Service ReDoS vulnerability exists in the Hugging Face Transformers library, specifically within the...

PT-2025-15070 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad versions 6.4.0 through 6.4.1 Description: The issue allows an authenticated agent with knowledge base permissions to use the Zammad API to fetch knowledge base content that they have no permission for. Recommendations: For versions 6.4...

CVE-2025-31480 aiven-extras allows PostgreSQL Privilege Escalation through format function

aiven-extras is a PostgreSQL extension. This is a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages the format function not being schema-prefixed. Affected users should install 1.1.16 and...

CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...

Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: CVE-2024-45337: golang.org/x/crypto/ssh: Fixed misuse of ServerConfig.PublicKeyCallback leading to authorization bypass bsc1234563. Other fixes: - Updated to version 20250327.01 bsc1239763, bsc1239866 Remove error messages from...

Security update for go1.23

This update for go1.23 fixes the following issues: Update to go1.23.8 CVE-2025-22871: Fix an issue with request smuggling through invalid chunked data. bsc1240550 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

PT-2025-15014 · Infogiants · Infogiants Simple Website Logo

Name of the Vulnerable Software and Affected Versions: InfoGiants Simple Website Logo versions prior to 1.1 Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized access...

PT-2025-15007 · WordPress · Jetpack Feedback Exporter

Name of the Vulnerable Software and Affected Versions: Jetpack Feedback Exporter versions 1.23 and earlier Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For Jetpack...

PT-2025-14943 · Unknown · Jakub Glos Sparkle Elementor Kit

Name of the Vulnerable Software and Affected Versions: Jakub Glos Sparkle Elementor Kit versions 2.0.9 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local...

PT-2025-14898 · Unknown · Awesome Event Booking

Name of the Vulnerable Software and Affected Versions: Awesome Event Booking versions through 2.8.4 Description: The issue affects Awesome Event Booking, allowing Reflected XSS due to improper neutralization of input during web page generation. Recommendations: For versions through 2.8.4, update ...