PT-2025-27318

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A heap-based buffer overflow issue was found in the function H5O chunk protect of the file /src/H5Ochunk.c. This issue can be exploited locally. Recommendations: For HDF5 version 1.14.6, as a temporary...

PT-2025-27333 · Unknown · Aaluoxiang Oa System

Name of the Vulnerable Software and Affected Versions: aaluoxiang oa system up to c3a08168c144f27256a90838492c713f55f1b207 Description: A critical issue was found in the outAddress function of the External Address Book Handler component, leading to SQL injection. The attack can be initiated...

PT-2025-27319 · Code Projects · Code-Projects Inventory Management System

Name of the Vulnerable Software and Affected Versions: code-projects Inventory Management System version 1.0 Description: A critical vulnerability has been found in the code-projects Inventory Management System, affecting an unknown functionality of the file /php action/removeBrand.php. The...

PT-2025-27145 · Hikvision · Hikvision Ds-2Cd1321-I

Name of the Vulnerable Software and Affected Versions: Hikvision DS-2CD1321-I version 5.7.21 build 230819 Description: The issue allows attackers to cause a Denial of Service DoS via sending a crafted POST request to the endpoint "/ISAPI/Security/challenge". Recommendations: For Hikvision...

PT-2025-27205 · Lucidcrew · Lucidcrew Wp Forum Server

Name of the Vulnerable Software and Affected Versions: lucidcrew WP Forum Server versions 1.8.2 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-27043

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A heap-based buffer overflow issue has been found in the function H5O mtime new encode of the file src/H5Omtime.c. The manipulation leads to this issue, and attacking locally is a requirement. The exploit has...

PT-2025-27270 · Marvell · Marvell Qconvergeconsole

Name of the Vulnerable Software and Affected Versions: Marvell QConvergeConsole affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole. The specific flaw exists within the implementation of th...

PT-2025-27147 · Unknown · Sfturing Hosp Order

Name of the Vulnerable Software and Affected Versions: sfturing hosp order versions up to 627f426331da8086ce8fff2017d65b1ddef384f8 Description: A critical issue was found in the getOfficeName function of the OfficeServiceImpl.java file, which is vulnerable to SQL injection through the manipulatio...

PT-2025-27063 · WordPress · A/B Testing For Wordpress

Name of the Vulnerable Software and Affected Versions: A/B Testing for WordPress plugin versions up to and including 1.18.2 Description: The issue is related to stored cross-site scripting due to insufficient input sanitization and output escaping on the id parameter in the...

PT-2025-27172 · Virusdie · Virusdie

Name of the Vulnerable Software and Affected Versions: Virusdie versions 1.1.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Virusdie versions 1.1.3 and...

PT-2025-27165 · Wow Company · Hover Effects

Name of the Vulnerable Software and Affected Versions: Wow-Company Hover Effects versions n/a through 2.1.2 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-27219 · Unknown · Pre-Publish Checklist

Name of the Vulnerable Software and Affected Versions: Pre-Publish Post Checklist versions 3.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions 3.1 a...

SUSE CVE-2025-52894

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the rekey process. An attacker can disrupt critical security operations by sending unauthenticated requests to cancel root rekey and recovery rekey operations. This can result in denial o...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the rekey process. An attacker can disrupt critical security operations by sending unauthenticated requests to cancel root rekey and recovery rekey operations. This can result in denial o...

OpenBao allows cancellation of root rekey and recovery rekey operations without authentication

Impact OpenBao and HashiCorp Vault allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. Patches In OpenBao v2.2.2 and later, manually setting the configuration option disableunauthedrekeyendpoints=true...

CVE-2025-53013

Summary (CVE-2025-53013, Himmelblau) : Versions 0.9.10–0.9.16 allow offline authentication to a Linux host via Himmelblau using an invalid Linux Hello PIN. The root cause is an incorrect handling in acquire_token_by_hello_for_business_key: offline, a TPMFail is expected for an invalid key, but a ...

CVE-2025-53013 Himmelblau offline auth permits authentication with invalid Hello PIN

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to authenticate to a Linux host via Himmelblau using an invalid Linux Hello PIN, provided the host is offline. While the user gains access to th...

PT-2025-26985 · Unknown · Labredescefetrj Wegia

Name of the Vulnerable Software and Affected Versions: LabRedesCefetRJ WeGIA version 3.4.0 Description: A vulnerability was found in the file /html/matPat/adicionar tipoEntrada.php of the component Adicionar tipo. The manipulation of the argument Insira o novo tipo leads to cross site scripting...

PT-2025-26975 · Unknown · Netbox Community

Name of the Vulnerable Software and Affected Versions: Netbox Community versions 4.1.7 through 4.2.1 Description: The issue is related to Cross Site Scripting XSS via the RSS feed widget. This allows for potential malicious script execution. Recommendations: For Netbox Community version 4.1.7,...