PT-2025-23238

Name of the Vulnerable Software and Affected Versions hdf5 version 1.14.6 Description A heap buffer overflow was discovered via the H5Z filter scaleoffset function. Recommendations For version 1.14.6, consider disabling the H5Z filter scaleoffset function as a temporary workaround until a patch i...

PT-2025-23344 · Unknown · Campcodes Online Hospital Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Hospital Management System version 1.0 Description: A critical issue was found in the system, affecting an unknown function of the file /admin/doctor-specilization.php. The manipulation of the doctorspecilization argument lea...

CVE-2025-47288 Discourse Policy plugin private group members visible

Discourse Policy plugin gives the ability to confirm users have seen or done something. Prior to version 0.1.1, if there was a policy posted to a public topic that was tied to a private group then the group members could be shown to non-group members. This issue has been patched in version 0.1.1....

CVE-2025-47288

Affected product: Discourse Policy plugin. Vulnerable: versions prior to 0.1.1. Root cause: a policy posted to a public topic that was tied to a private group could cause group members to be visible to non-group members. Impact: information disclosure of private-group membership (partial confiden...

PT-2025-23164 · Yasm +2 · Yasm +2

Name of the Vulnerable Software and Affected Versions: yasm version 9defefae Description: A NULL pointer dereference was discovered via the yasm section bcs append function at section.c. Recommendations: For version 9defefae, consider disabling the yasm section bcs append function as a temporary...

PT-2025-23202 · Unknown · Chshcms Mccms

Name of the Vulnerable Software and Affected Versions: chshcms mccms version 2.7 Description: A critical vulnerability affects the restore del function of the file /sys/apps/controllers/admin/Backups.php. The manipulation of the dirs argument leads to path traversal. The attack can be initiated...

PT-2025-23201 · Unknown · Chshcms Mccms

Name of the Vulnerable Software and Affected Versions: chshcms mccms version 2.7 Description: A critical issue affects the function index of the file sys/apps/controllers/api/Gf.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack...

PT-2025-23169 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.12 Mattermost versions 10.5.x through 10.5.3 Mattermost versions 10.6.x through 10.6.2 Mattermost versions 10.7.x through 10.7.0 Description: The issue is related to the improper validation of permissio...

PT-2025-23181 · Free5Gc · Free5Gc

Name of the Vulnerable Software and Affected Versions: Free5gc version 4.0.0 Description: The issue is a buffer overflow vulnerability that allows a remote attacker to cause a denial of service. This is achieved via the AMF, NGAP, security.go, handler generated.go, handleInitialUEMessageMain,...

PT-2025-23161

Name of the Vulnerable Software and Affected Versions gradio-app gradio versions up to 5.29.1 Description A problematic vulnerability has been found in the CORS Handler component, specifically affecting the is valid origin function. The issue arises from the manipulation of the localhost aliases...

PT-2025-23195 · Discourse · Discourse Policy Plugin

Name of the Vulnerable Software and Affected Versions: Discourse Policy plugin versions prior to 0.1.1 Description: The issue concerns the Discourse Policy plugin, which allows confirming users have seen or done something. Prior to version 0.1.1, if a policy was posted to a public topic tied to a...

PT-2025-23152 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.15.0-rc3 Description: A vulnerability in the Linux kernel has been resolved, related to the initialization of a spin lock in the m can classdev struct. The issue occurs when trying to send CAN frames, resultin...

Chrome PHP is missing encoding in `CssSelector`

Impact CSS Selector expressions are not properly encoded, which can lead to XSS cross-site scripting vulnerabilities. Patches This is patched in v1.14.0. Workarounds Users can apply encoding manually to their selectors, if they are unable to upgrade...

Cross-site Scripting (XSS)

Overview chrome-php/chrome is an Instrument headless chrome/chromium instances from PHP Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper encoding in CssSelector. An attacker can inject malicious scripts by crafting malicious CSS Selector expressions...

GHSA-3432-FMRF-7VMH Chrome PHP is missing encoding in `CssSelector`

Impact CSS Selector expressions are not properly encoded, which can lead to XSS cross-site scripting vulnerabilities. Patches This is patched in v1.14.0. Workarounds Users can apply encoding manually to their selectors, if they are unable to upgrade...

PT-2025-23091

Name of the Vulnerable Software and Affected Versions Tenda W18E version 2.0 v.16.01.0.11 Description An issue in Tenda W18E allows an attacker to execute arbitrary code via the editing functionality of the account module in the "goform/setmodules" route. Recommendations For Tenda W18E version 2....

PT-2025-23228

Name of the Vulnerable Software and Affected Versions vLLM versions 0.8.0 through 0.9.0 Description The vLLM backend used with the "/v1/chat/completions" API endpoint fails to validate unexpected or malformed input in the pattern and type fields when the tools functionality is invoked. These inpu...

CVE-2025-48054

Radashi is a TypeScript utility toolkit. Prior to version 12.5.1, the set function within the Radashi library is vulnerable to prototype pollution. If an attacker can control parts of the path argument to the set function, they could potentially modify the prototype of all objects in the JavaScri...

CVE-2025-48382 Fess has Insecure Temporary File Permissions

Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile method in org.codelibs.fess.helper.SystemHelper creates temporary files without explicitly setting restrictive permissions. This could lead to potential information disclosure, allowing unauthorized local...

PT-2025-22951 · Unknown · Campcodes Online Hospital Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Hospital Management System version 1.0 Description: A critical vulnerability has been found in the system, affecting an unknown function of the file /admin/add-doctor.php. The manipulation of the Doctorspecialization argument...