PT-2025-5359 · Jenkins · Jenkins Folder-Based Authorization Strategy Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Folder-based Authorization Strategy Plugin versions 217.vd5b 18537403e and earlier Description: The issue potentially allows users who were formerly granted certain permissions to access functionality they are no longer entitled to,...

PT-2025-4791 · Cilium +1 · Cilium +1

Name of the Vulnerable Software and Affected Versions: Cilium versions 1.14.0 through 1.14.7 Cilium versions 1.15.0 through 1.15.11 Cilium versions 1.16.0 through 1.16.4 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default...

PT-2025-5041 · Unknown · Kiro G. Formatted Post

Name of the Vulnerable Software and Affected Versions: Kiro G. Formatted post versions n/a through 1.01 Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This means that an attacker can inject...

PT-2025-5189 · Unknown · Menus Plus+

Name of the Vulnerable Software and Affected Versions: Menus Plus+ versions 1.9.6 and earlier Description: The issue is related to improper neutralization of special elements used in an SQL command, which allows SQL Injection. This means that an attacker could potentially inject malicious SQL cod...

sniff_csv provides filesystem access even when enable_external_access is disabled in duckdb

Summary Content in filesystem is accessible for reading using sniffcsv, even with enableexternalaccess=false. Details During a pentest, a security researcher was able to access environment variable data and other system data by using the sniffcsv function, even though we set enableexternalaccess ...

Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loop

Impact The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included...

PT-2025-5254 · Unknown · Tamara Checkout

Name of the Vulnerable Software and Affected Versions: Tamara Checkout versions prior to 1.9.9 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can inject malicious scrip...

PT-2025-3466 · Linksys · Linksys E8450

Name of the Vulnerable Software and Affected Versions: Linksys E8450 version 1.2.00.360516 Description: A command injection issue was discovered, which can be exploited via the userEmail variable. This allows for potential unauthorized access and control. Recommendations: For Linksys E8450 versio...

PT-2025-1426 · Magma · Magma

Name of the Vulnerable Software and Affected Versions: Magma versions 1.8.0 and earlier Description: A null pointer dereference issue in the Mobile Management Entity MME allows network-adjacent attackers to crash the MME via an S1AP "Initial UE Message" packet missing an expected TAI field. This...

PT-2025-3375 · Unknown · Phpgurukul Hospital Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Hospital Management System version 4.0 Description: The issue concerns a Cross Site Scripting XSS vulnerability in the /edit-profile.php file, specifically via the address parameter. This allows an attacker to inject malicious...

PT-2025-4259 · Oracle · Peoplesoft Enterprise Fin Cash Management

Name of the Vulnerable Software and Affected Versions: PeopleSoft Enterprise FIN Cash Management version 9.2 Description: The issue is related to weaknesses in the authorization mechanism of the Cash Management component in PeopleSoft Enterprise FIN Cash Management. This can be exploited by a...

PT-2025-4250 · Oracle · Primavera P6 Enterprise Project Portfolio Management

Name of the Vulnerable Software and Affected Versions: Primavera P6 Enterprise Project Portfolio Management versions 20.12.1.0 through 20.12.21.5 Primavera P6 Enterprise Project Portfolio Management versions 21.12.1.0 through 21.12.20.0 Primavera P6 Enterprise Project Portfolio Management version...

PT-2025-3956 · Unknown · Code-Projects Fantasy-Cricket

Name of the Vulnerable Software and Affected Versions: code-projects Fantasy-Cricket version 1.0 Description: A critical issue has been found, allowing for SQL injection through the manipulation of the uname argument in an unknown function of the file /dash/update.php. This can be exploited...

GHSA-CG87-WMX4-V546 KaTeX \htmlData does not validate attribute names

Impact KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Patches Upgrade to KaTeX v0.16.21 to remove this vulnerability. Workarounds - Avoid use of or turn off the...

GHSA-FCR8-4R9F-R66M nbgrader's `frame-ancestors: self` grants all users access to formgrader

Impact Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of enablesubdomains = False. 1915 disables a protection which would...

PT-2025-3394 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.0 Description: The issue is related to Cross Site Scripting XSS via the dados addInfo parameter of the "documentos funcionario.php" endpoint. This allows for potential malicious script injection. Recommendations: F...

PT-2025-9855 · Tenda · Tenda Ac15

Name of the Vulnerable Software and Affected Versions: Tenda AC15 version 15.03.05.19 Description: The issue is related to command injection via the handler function in the /goform/telnet endpoint. This vulnerability may allow a remote attacker to execute arbitrary commands by sending a specially...

PT-2025-3934 · Code Projects · Admission Management System

Name of the Vulnerable Software and Affected Versions: code-projects Admission Management System version 1.0 Description: A critical issue was found in the Admission Management System. The problem affects an unknown functionality of the file /signupconfirm.php. The manipulation of the in eml...

PT-2025-1261 · Tenda · Tenda Ac15

Name of the Vulnerable Software and Affected Versions: Tenda AC15 version 15.13.07.13 Description: A critical issue has been found in the function formSetDevNetName of the file /goform/SetDevNetName, which affects the Tenda AC15 router. The manipulation of the argument mac leads to a stack-based...

PT-2025-3939 · Unknown · 1000 Projects Campaign Management System Platform For Women

Name of the Vulnerable Software and Affected Versions: 1000 Projects Campaign Management System Platform for Women version 1.0 Description: A critical issue has been identified, affecting an unknown functionality of the file /Code/sc login.php. The manipulation of the uname argument leads to SQL...