PT-2025-25532 · Nosto · Nosto

Name of the Vulnerable Software and Affected Versions: Nosto affected versions not specified Description: A Reflected Cross-Site Scripting XSS issue exists in the /pages/search-results-page endpoint of Nosto. This allows remote attackers to execute arbitrary code via the q GET request parameter...

PT-2025-25538 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.06B01 Description: A critical issue affects the form macfilter function. The manipulation of the argument mac hostname %d/sched name %d leads to a stack-based buffer overflow. This issue can be exploited remotely. Th...

PT-2025-25588 · Python +1 · Pip +2

Name of the Vulnerable Software and Affected Versions: Conda-build versions prior to 25.3.0 Description: The issue concerns a dependency injection vulnerability. Conda-build lists conda-index as a Python dependency in its pyproject.toml file. Since conda-index is not published in PyPI, an attacke...

PT-2025-25584 · Unknown · Projectworlds Life Insurance Management System

Name of the Vulnerable Software and Affected Versions: Projectworlds Life Insurance Management System version 1.0 Description: A critical issue affects the processing of the file "/insertPayment.php". The manipulation of the argument recipt no leads to SQL injection. The attack may be initiated...

PT-2025-25579 · Unknown · Projectworlds Life Insurance Management System

Name of the Vulnerable Software and Affected Versions: Projectworlds Life Insurance Management System version 1.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file /insertagent.php. The manipulation of the agent id argument leads to SQL...

PT-2025-25512 · Letta-Ai · Letta-Ai

Name of the Vulnerable Software and Affected Versions: letta-ai letta versions up to 0.4.1 Description: A critical issue has been found in the function function message of the file letta/letta/interface.py. The manipulation of the argument function name/function args leads to improper...

PT-2025-25501 · H3C · H3C Gr-3000Ax

Name of the Vulnerable Software and Affected Versions: H3C GR-3000AX version V100R007L50 Description: A critical vulnerability was found in the function UpdateWanParamsMulti/UpdateIpv6Params of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. It i...

PT-2025-25506 · Foxcms · Foxcms

Name of the Vulnerable Software and Affected Versions: FoxCMS versions 1.2.5 and earlier Description: A critical issue has been found in FoxCMS, affecting the batchCope function of the file app/admin/controller/Download.php. The manipulation of the ids argument leads to SQL injection. The attack...

Konsole: Code execution

Background Konsole is KDE's terminal emulator. Description Konsole supports loading URLs from the scheme handlers such as telnet://URL. This can be executed regardless of whether the telnet binary is available. It would fallback to bash in that case and execute arbitrary code. Impact Clicking a...

PT-2025-25493

Name of the Vulnerable Software and Affected Versions codesiddhant Jasmin Ransomware versions up to 1.0.1 Description A critical vulnerability has been found in codesiddhant Jasmin Ransomware, affecting an unknown functionality of the file /dashboard.php. The manipulation of the Search argument...

GHSA-59W6-R9HM-439H XWiki does not require right warnings for XClass definitions

Impact When an attacker without script or programming right creates an XClass definition in XWiki requires edit right, and that same document is later edited by a user with script, admin, or programming right, malicious code could be executed with the rights of the editing user without prior...

PT-2025-25455 · Ibm · Ibm Backup

Name of the Vulnerable Software and Affected Versions: IBM Backup, Recovery and Media Services for i versions 7.4 through 7.5 Description: The issue allows a user with the capability to compile or restore a program to gain elevated privileges due to a library unqualified call made by a BRMS...

CVE-2025-27505

GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension e.g., rest.html. The REST API index can...

Medium: python-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume ...

PT-2025-25334

Name of the Vulnerable Software and Affected Versions InstallShield versions 2021 R2 through 2023 R2 Description A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. Recommendations For...

Qt: Multiple Vulnerabilities

Background Qt is a cross-platform application development framework. Description Multiple vulnerabilities have been discovered in Qt. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

Emacs: Multiple Vulnerabilities

Background Emacs is the extensible, customizable, self-documenting real-time display editor. org-mode is an Emacs mode for notes and project planning. Description Multiple vulnerabilities have been discovered in Emacs, org-mode. Please review the CVE identifiers referenced below for details. Impa...

GTK+ 3: Search path vulnerability

Background GTK+ GIMP Toolkit + is a toolkit for creating graphical user interfaces. Description A vulnerability has been discovered in GTK+ 3. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifier for details. Workaround There is no kno...

GStreamer, GStreamer Plugins: Multiple Vulnerabilities

Background GStreamer is an open source multimedia framework. Description Multiple vulnerabilities have been discovered in GStreamer, GStreamer Plugins. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There...

Amazon Linux 2023 : ecs-init (ALAS2023-2025-1015)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1015 advisory. containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum...