PT-2025-8491 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.18.0-rc7+ Description: A double hook unregistration issue in the netfilter nf tables component has been identified. The nft release hooks function is called from the pre netns exit path, which unregisters the...

PT-2025-8230 · Unknown · Privilege Management For Windows

Name of the Vulnerable Software and Affected Versions: Privilege Management for Windows versions prior to 25.2 Description: A local authenticated attacker can elevate privileges on a system via the manipulation of COM objects under certain circumstances where an EPM policy allows for automatic...

CVE-2025-27148

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. This library initialization could be...

CVE-2025-27148 Gradle vulnerable to local privilege escalation through system temporary directory

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. This library initialization could be...

CVE-2025-27110 Libmodsecurity3 has possible bypass of encoded HTML entities

Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurit...

UBUNTU-CVE-2025-23046

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth...

UBUNTU-CVE-2025-25192

GLPI is a free asset and IT management software package. Prior to version 10.0.18, a low privileged user can enable debug mode and access sensitive information. Version 10.0.18 contains a patch. As a workaround, one may delete the install/update.php file...

CVE-2025-23046

GLPI CVE-2025-23046 affects versions 9.5.0 through 10.0.18 where a Mail servers authentication provider using an OAuth (OauthIMAP) connection allows a login using a username with an existing OAuth authorization. The root cause is an access control/authentication issue in the OAuth integration wit...

CVE-2025-23046 GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth...

UBUNTU-CVE-2025-23024

GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active plugins. Version 10.0.18 contains a patch. As a workaround, one may delete the install/update.php file...

CVE-2025-21626

GLPI is an asset/IT management product vulnerable up to version 10.0.18 due to an anonymous user able to fetch sensitive data from status.php. The issue is fixed in 10.0.18; mitigations include deleting status.php, restricting access, or sanitizing sensitive values in LDAP directories and related...

PT-2025-23488 · Run Llama +1 · Llama Index +1

Name of the Vulnerable Software and Affected Versions: run-llama/llama index version v0.12.19 Description: An SQL injection vulnerability exists in the delete function of DuckDBVectorStore. This vulnerability allows an attacker to manipulate the ref doc id parameter, enabling them to read and wri...

PT-2025-7810 · Lumsoft · Lumsoft Erp

Name of the Vulnerable Software and Affected Versions: Lumsoft ERP version 8 Description: A critical issue has been found in Lumsoft ERP 8, affecting some unknown functionality of the file "/Api/TinyMce/UploadAjaxAPI.ashx" of the component ASPX File Handler. The manipulation of the file argument...

PT-2025-16723

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the handling of multiple calls to vhost scsi set endpoint in the Linux kernel. This can lead to several problems, including a use-after-free bug when no tpgs are...

PT-2025-7804 · Benner · Benner Modernanet

Name of the Vulnerable Software and Affected Versions: Benner ModernaNet versions 1.1.0 and earlier Description: A critical issue has been found in Benner ModernaNet, affecting an unknown part of the file...

AZL-57180 CVE-2025-27144 affecting package containerized-data-importer for versions less than 1.55.0-23

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

CVE-2025-27141 Metabase Enterprise Edition allows cached questions to leak data to impersonated users

Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to versions 1.50.36, 1.51.14, 1.52.11, and 1.53.2 of Metabase Enterprise Edition, users with impersonation permissions may be able to see resul...

PT-2025-7700

Name of the Vulnerable Software and Affected Versions vTiger CRM version 6.4.0 Description A problematic issue has been identified, affecting the /modules/Mobile/index.php file. The manipulation of the operation argument leads to cross-site scripting. This issue can be exploited remotely...

PT-2025-7682 · Sourcecodester · Sourcecodester Telecom Billing Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Telecom Billing Management System version 1.0 Description: A critical issue affects some unknown processing of the file main.cpp of the component Add New Record. The manipulation of the name argument leads to buffer overflow...

PT-2025-7673 · Sourcecodester · Sourcecodester Best Employee Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Employee Management System version 1.0 Description: A vulnerability has been found in the processing of the file /admin/salary slip.php. The manipulation of the id argument leads to authorization bypass. The attack may be...