PT-2025-26761 · Netbox · Netbox

Name of the Vulnerable Software and Affected Versions: Netbox Community version 4.1.7 Description: In Netbox Community, once authenticated, the Configuration History Add option is vulnerable to cross-site scripting XSS due to the current value field rendering user-supplied HTML. An authenticated...

PT-2025-26791 · Sourcecodester · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Salon Management System version 1.0 Description: A critical issue was found in the SourceCodester Best Salon Management System, affecting an unknown functionality of the file /add-customer.php. The manipulation of the...

PT-2025-26673 · Tarantool +1 · Tarantool +1

Name of the Vulnerable Software and Affected Versions: Tarantool versions up to 3.3.1 Description: A vulnerability has been found in the tm to datetime function in the library src/lib/core/datetime.c. The manipulation leads to a reachable assertion. Attacking locally is a requirement...

PT-2025-26760 · Sentry · Sentry

Name of the Vulnerable Software and Affected Versions: Sentry versions 25.1.0 through 25.5.1 Description: The issue allows an authenticated attacker to access a project's issue endpoint and perform unauthorized actions, such as adding a comment, without being a member of the project's team. This...

PT-2025-26666 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: xxyopen/201206030 novel-plus versions up to 5.1.3 Description: A critical issue has been found in the User Management Module, specifically affecting the function list of the file novel-admin/src/main/resources/mybatis/system/UserMapper.xml. T...

CVE-2025-52561

HTMLSanitizer.jl is a Whitelist-based HTML sanitizer. Prior to version 0.2.1, when adding the style tag to the whitelist, content inside the tag is incorrectly unescaped, and closing tags injected as content are interpreted as real HTML, enabling tag injection and JavaScript execution. This could...

CVE-2025-52561 HTMLSanitizer.jl Possible XSS

HTMLSanitizer.jl is a Whitelist-based HTML sanitizer. Prior to version 0.2.1, when adding the style tag to the whitelist, content inside the tag is incorrectly unescaped, and closing tags injected as content are interpreted as real HTML, enabling tag injection and JavaScript execution. This could...

GHSA-9623-MJ7J-P9V4 Quarkus potentially leaks data when duplicating a duplicated context

Impact Vert.x 4.5.12 has changed the semantics of the duplication of duplicated context. Duplicated context is an object used to propagate data through a processing synchronous or asynchronous. Each "transaction" or "processing" runs on its own isolated duplicated context. Initially, duplicating ...

Quarkus potentially leaks data when duplicating a duplicated context

Impact Vert.x 4.5.12 has changed the semantics of the duplication of duplicated context. Duplicated context is an object used to propagate data through a processing synchronous or asynchronous. Each "transaction" or "processing" runs on its own isolated duplicated context. Initially, duplicating ...

CVE-2025-52464

Meshtastic is an open source mesh networking solution. In versions from 2.5.0 to before 2.6.11, the flashing procedure of several hardware vendors was resulting in duplicated public/private keys. Additionally, the Meshtastic was failing to properly initialize the internal randomness pool on some...

CVE-2025-47771

PowSyBl Power System Blocks is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in...

PT-2025-26642 · Quarkus · Quarkus

Name of the Vulnerable Software and Affected Versions: Quarkus versions prior to 3.24.0 Description: The issue is related to a potential data leak when duplicating a duplicated context in Quarkus, which extensively uses the Vert.x duplicated context to implement context propagation. This can caus...

PT-2025-26604 · Ncr · Ncr Itm Web Terminal

Name of the Vulnerable Software and Affected Versions: NCR ITM Web terminal versions 4.4.0 through 4.4.4 Description: The issue allows a remote attacker to execute arbitrary code via a crafted script to the IP camera URL component. Recommendations: For versions 4.4.0 through 4.4.4, consider...

PT-2025-26572 · Unknown +1 · Htacg Tidy-Html5 +1

Name of the Vulnerable Software and Affected Versions: HTACG tidy-html5 version 5.8.0 Description: A vulnerability was found in HTACG tidy-html5, affecting the function InsertNodeAsParent of the file src/parser.c. The manipulation leads to null pointer dereference. Local access is required to...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2025-1033)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1033 advisory. There is an issue in CPython when using bytes.decodeunicodeescape, error=ignore|replace. If you are not using the unicodeescape encoding or an error handler your usage is not affected. To work-around...

Medium: python3.11

Issue Overview: There is an issue in CPython when using bytes.decode"unicodeescape", error="ignore|replace". If you are not using the "unicodeescape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the...

PT-2025-26664

Name of the Vulnerable Software and Affected Versions Linksys E-Series routers versions prior to a firmware update Linksys E4200 Linksys E3200 Linksys E3000 Linksys E2500 Linksys E2100L Linksys E2000 Linksys E1550 Linksys E1500 Linksys E1200 Linksys E1000 Linksys E900 Description An OS command...

PT-2025-26653

Name of the Vulnerable Software and Affected Versions: 70mai M300 up to 20250611 Description: A vulnerability was found in the Telnet Service component, affecting an unknown part of the file demo.sh. The manipulation leads to denial of service. Access to the local network is required for this...

PT-2025-26639

Name of the Vulnerable Software and Affected Versions: pbkdf2 versions =3.1.2 Description: The issue is related to an Improper Input Validation vulnerability in pbkdf2, allowing Signature Spoofing by Improper Validation. Recommendations: For versions =3.1.2, update to a version greater than 3.1.2...

PT-2025-26564 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R version 1.1.1-B20200824.0128 Description: A critical vulnerability was found in the TOTOLINK A3002R, affecting the function formWlanMultipleAP of the file /boafrm/formWlanMultipleAP. The manipulation of the argument submit-url...