PT-2025-20573 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.0 through 17.9.7 GitLab CE/EE versions 17.10 through 17.10.5 GitLab CE/EE versions 17.11 through 17.11.1 Description: An issue has been discovered in GitLab CE/EE that allows users to bypass IP access restrictions and...

PT-2025-20071 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, related to the net sched component. The issue arises from the cp-alloc hash not being updated after hash allocation in tcindex...

BELL-CVE-2023-53058

Bulletin has no description...

PT-2025-19998 · Milesight · Milesight Ug65-868M-Ea

Name of the Vulnerable Software and Affected Versions: Milesight UG65-868M-EA gateway affected versions not specified Description: A new issue in the Milesight industrial gateway could potentially impact critical infrastructure. The estimated number of potentially affected devices worldwide is no...

PT-2025-19899

Name of the Vulnerable Software and Affected Versions vllm versions 0.5.2 through 0.8.5.post1 Description The issue exists in the V0 engine of vLLM, which uses ZeroMQ for multi-node communication. When data is received on the SUB ZeroMQ socket, it is deserialized with pickle, allowing for potenti...

CVE-2025-21760 affecting package kernel for versions less than 5.15.180.1-1

CVE-2025-21760 affecting package kernel for versions less than 5.15.180.1-1. An upgraded version of the package is available that resolves this issue...

Microsoft Office for Universal Privilege Escalation (April 2025)

The Microsoft Office for Universal products are missing a security update. It is, therefore, affected by a privilege escalation vulnerability. Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a network. Note that Nessus has not tested for this iss...

PT-2025-18783 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue was determined to not be a vulnerability. No further details are available. Recommendations: At the moment, there is no information about a newer version that contains a fix for th...

PT-2025-18392 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch affected versions not specified Description: The issue is related to Uncontrolled Resource Consumption in Elasticsearch. It occurs when the system evaluates specifically crafted search templates that utilize Mustache functions...

PT-2025-18540

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc3+ Description The issue arises from the function ata tdev add not checking the return value of transport add device, leading to a null pointer dereference when removing the module because transport remov...

CVE-2024-9877

CVE-2024-9877 affects ABB ANC, ABB ANC-L, and ABB ANC-mini up to version 1.1.4. The root cause is use of GET requests that transmit sensitive query strings, potentially exposing confidential data. Public references confirm affected versions through 1.1.4 and describe exposure vectors via GET para...

CVE-2025-46557 Any user with view access to the XWiki space can change the authenticator

XWiki is a generic wiki platform. In versions starting from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.4.6, and from 16.5.0-rc-1 to before 16.10.0-rc-1, a user who can access pages located in the XWiki space by default, anyone can access the page XWiki.Authentication.Administrati...

Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements

Summary Due to a missing error propagation in function GetNamespaceSelectorsFromNamespaceLister in pkg/utils/engine/labels.go it may happen that policy rules using namespace selectors in their match statements are mistakenly not applied during admission review request processing. As a consequence...

CVE-2025-23177

CVE-2025-23177 affects Ribbon Communications Apollo 9608 SBC. Connected sources identify the issue as CWE-427: Uncontrolled Search Path Element, with specific mentions of Apollo 9608 version v9.6R3 being implicated (PT-2025-18181 and CNNVD-202504-3975 align on this version). The Red Hat/NVD/CVE r...

PT-2025-18296 · Kyverno · Kyverno

Name of the Vulnerable Software and Affected Versions: Kyverno versions prior to 1.13.5 and 1.14.0 Description: The issue concerns a policy engine where policy rules using namespace selectors in their match statements may not be applied correctly due to a missing error propagation in the...

Amazon Linux 2 : redis (ALASREDIS6-2025-012)

The version of redis installed on the remote host is prior to 6.2.14-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2REDIS6-2025-012 advisory. Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An...

PT-2025-18182 · Ribbon Communications · Apollo 9608

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue is related to improper restriction of communication channels to intended endpoints. Recommendations: At the moment, there is no information about a newer version that contains a fi...

PT-2025-17979 · Goldendb · Goldendb

Name of the Vulnerable Software and Affected Versions: GoldenDB affected versions not specified Description: The issue is related to a code-related problem in the GoldenDB database product, allowing attackers to access system tables. This access can disrupt the normal operation of business SQL...

CVE-2025-46502

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bas Matthee LSD Custom taxonomy and category meta custom-taxonomy-category-and-term-fields allows Cross Site Request Forgery.This issue affects LSD Custom taxonomy and category meta: from n/a throu...

CVE-2025-29459

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation...