CVE-2024-31999

@festify/secure-session creates a secure stateless cookie session for Fastify. At the end of the request handling, it will encrypt all data in the session with a secret key and attach the ciphertext as a cookie value with the defined cookie name. After that, the session on the server side is...

CVE-2024-31996

XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, the HTML escaping of escaping tool that is used in XWiki doesn't escape , which, when used in certain places, allows XWiki syntax injection and thereby remote code execution...

CVE-2024-31220

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbitrary files without authentication due to a path traversal vulnerability. Users who exposed the Sunshine configuration web user interface...

PT-2025-5752 · Unknown · Eazy-Logger

Name of the Vulnerable Software and Affected Versions: eazy-logger version 4.0.1 Description: A prototype pollution in the lib.Logger function allows attackers to cause a Denial of Service DoS via supplying a crafted payload. This can be achieved by introducing or modifying properties within the...

PT-2025-5756 · Vxe-Table · Vxe-Table

Name of the Vulnerable Software and Affected Versions: vxe-table version 4.8.10 Description: A prototype pollution in the lib.install function allows attackers to cause a Denial of Service DoS via supplying a crafted payload. Recommendations: For vxe-table version 4.8.10, consider disabling the...

PT-2025-5775

Name of the Vulnerable Software and Affected Versions: Bento4 version 1.6.0-641 Description: A floating point exception vulnerability, specifically a divide-by-zero error, was discovered in the AP4 TfraAtom function of Ap4TfraAtom.cpp. This issue allows a remote attacker to cause a denial of...

PT-2025-5759 · Unknown · @Stryker-Mutator/Util

Name of the Vulnerable Software and Affected Versions: @stryker-mutator/util version 8.6.0 Description: A prototype pollution in the deepMerge function allows attackers to cause a Denial of Service DoS via supplying a crafted payload. Recommendations: For @stryker-mutator/util version 8.6.0,...

PT-2025-5727 · F5 · F5 Big-Ip

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions prior to the fixed version Description: A command injection vulnerability exists in the iControl REST and BIG-IP TMOS Shell tmsh save command, which may allow an authenticated attacker to execute arbitrary system commands...

PT-2025-5792 · Ibm · Ibm Applinx

Name of the Vulnerable Software and Affected Versions: IBM ApplinX version 11.1 Description: The issue concerns the storage of sensitive information in cleartext in memory, which could be accessed by an authenticated user. Recommendations: For IBM ApplinX version 11.1, consider restricting access...

PT-2025-5692 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.0 through 16.9.7 GitLab CE/EE versions 16.10 through 16.10.5 GitLab CE/EE versions 16.11 through 16.11.2 Description: An issue has been discovered in GitLab CE/EE that affects the confidentiality of issues in public...

PT-2025-11013

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A softlockup issue in the Linux kernel has been identified, specifically in the bpf Berkeley Packet Filter component. This issue occurs on aarch64 kernels with a page size of 64KB, whe...

CVE-2024-35199

TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and 7071, are not bound to localhost by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTor...

MarbleRun unauthenticated recovery allows Coordinator impersonation

Impact During recovery, a Coordinator only verifies that a given recovery key decrypts the sealed state, not if this key was provided by a party with access to one of the recovery keys defined in the manifest. This allows an attacker to manually craft a sealed state using their own recovery keys,...

PT-2025-4173 · Unknown · Libsthmbc.So

Name of the Vulnerable Software and Affected Versions: libsthmbc.so versions prior to SMR Jan-2025 Release 1 Description: The issue is related to an out-of-bounds read in the decoding of malformed bitstreams of video thumbnails in libsthmbc.so. This allows local attackers to read arbitrary memory...

PT-2025-7108 · D Link · D-Link Dsl-3782

Name of the Vulnerable Software and Affected Versions: D-Link DSL-3782 version 1.01 Description: An OS command injection issue was discovered, allowing attackers to execute arbitrary operating system commands via crafted packets. This is achieved through the samba wg and samba nbn parameters...

CVE-2025-23210 Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet

phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting XSS sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1....

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2023-52489: mm/sparsemem: fix race in accessing memorysection-usage bsc1221326. CVE-2023-52581: netfilter: nftables: fix memleak when more than 255 elements...

PT-2025-1556 · Digiever · Digiever Ds-2105 Pro

Name of the Vulnerable Software and Affected Versions: Digiever DS-2105 Pro version 3.1.0.71-11 Description: The issue allows for arbitrary file read through the access device.cgi file on affected devices. This problem only affects products that are no longer supported by the manufacturer...

PT-2025-3686

Name of the Vulnerable Software and Affected Versions Arm Ltd Bifrost GPU Kernel Driver versions r44p1, from r46p0 through r49p0, from r50p0 through r51p0 Arm Ltd Valhall GPU Kernel Driver versions r44p1, from r46p0 through r49p0, from r50p0 through r51p0 Arm Ltd Arm 5th Gen GPU Architecture Kern...

PT-2025-4958 · Unknown · Blu Logistics

Name of the Vulnerable Software and Affected Versions: blu Logistics versions n/a through 1.0.0 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Reflected XSS. Recommendations: For versions n/a...