PT-2025-28084 · Belkin · Belkin F9K1122

Name of the Vulnerable Software and Affected Versions: Belkin F9K1122 version 1.00.33 Description: A critical vulnerability has been found in the function formConnectionSetting of the file /goform/formConnectionSetting of the component webs. The manipulation of the argument max Conn/timeOut leads...

PT-2025-28082 · Belkin · Belkin F9K1122

Name of the Vulnerable Software and Affected Versions: Belkin F9K1122 version 1.00.33 Description: A critical vulnerability was found in the formPPPoESetup function of the webs component. The manipulation of the pppUserName argument leads to a stack-based buffer overflow. This issue can be...

PT-2025-28077 · Belkin · Belkin F9K1122

Name of the Vulnerable Software and Affected Versions: Belkin F9K1122 version 1.00.33 Description: A critical issue has been found in the Belkin F9K1122, affecting the function mp of the file /goform/mp of the component webs. The manipulation of the argument command leads to os command injection...

PT-2025-26760 · Sentry · Sentry

Name of the Vulnerable Software and Affected Versions: Sentry versions 25.1.0 through 25.5.1 Description: The issue allows an authenticated attacker to access a project's issue endpoint and perform unauthorized actions, such as adding a comment, without being a member of the project's team. This...

PT-2025-26761 · Netbox · Netbox

Name of the Vulnerable Software and Affected Versions: Netbox Community version 4.1.7 Description: In Netbox Community, once authenticated, the Configuration History Add option is vulnerable to cross-site scripting XSS due to the current value field rendering user-supplied HTML. An authenticated...

PT-2025-26673 · Tarantool +1 · Tarantool +1

Name of the Vulnerable Software and Affected Versions: Tarantool versions up to 3.3.1 Description: A vulnerability has been found in the tm to datetime function in the library src/lib/core/datetime.c. The manipulation leads to a reachable assertion. Attacking locally is a requirement...

PT-2025-26791 · Sourcecodester · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Salon Management System version 1.0 Description: A critical issue was found in the SourceCodester Best Salon Management System, affecting an unknown functionality of the file /add-customer.php. The manipulation of the...

PT-2025-26666 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: xxyopen/201206030 novel-plus versions up to 5.1.3 Description: A critical issue has been found in the User Management Module, specifically affecting the function list of the file novel-admin/src/main/resources/mybatis/system/UserMapper.xml. T...

CVE-2025-52561

HTMLSanitizer.jl is a Whitelist-based HTML sanitizer. Prior to version 0.2.1, when adding the style tag to the whitelist, content inside the tag is incorrectly unescaped, and closing tags injected as content are interpreted as real HTML, enabling tag injection and JavaScript execution. This could...

CVE-2025-52561 HTMLSanitizer.jl Possible XSS

HTMLSanitizer.jl is a Whitelist-based HTML sanitizer. Prior to version 0.2.1, when adding the style tag to the whitelist, content inside the tag is incorrectly unescaped, and closing tags injected as content are interpreted as real HTML, enabling tag injection and JavaScript execution. This could...

GHSA-9623-MJ7J-P9V4 Quarkus potentially leaks data when duplicating a duplicated context

Impact Vert.x 4.5.12 has changed the semantics of the duplication of duplicated context. Duplicated context is an object used to propagate data through a processing synchronous or asynchronous. Each "transaction" or "processing" runs on its own isolated duplicated context. Initially, duplicating ...

Quarkus potentially leaks data when duplicating a duplicated context

Impact Vert.x 4.5.12 has changed the semantics of the duplication of duplicated context. Duplicated context is an object used to propagate data through a processing synchronous or asynchronous. Each "transaction" or "processing" runs on its own isolated duplicated context. Initially, duplicating ...

CVE-2025-52464

Meshtastic is an open source mesh networking solution. In versions from 2.5.0 to before 2.6.11, the flashing procedure of several hardware vendors was resulting in duplicated public/private keys. Additionally, the Meshtastic was failing to properly initialize the internal randomness pool on some...

CVE-2025-47771

PowSyBl Power System Blocks is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in...

Medium: python3.11

Issue Overview: There is an issue in CPython when using bytes.decode"unicodeescape", error="ignore|replace". If you are not using the "unicodeescape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the...

PT-2025-26642 · Quarkus · Quarkus

Name of the Vulnerable Software and Affected Versions: Quarkus versions prior to 3.24.0 Description: The issue is related to a potential data leak when duplicating a duplicated context in Quarkus, which extensively uses the Vert.x duplicated context to implement context propagation. This can caus...

PT-2025-26572 · Unknown +1 · Htacg Tidy-Html5 +1

Name of the Vulnerable Software and Affected Versions: HTACG tidy-html5 version 5.8.0 Description: A vulnerability was found in HTACG tidy-html5, affecting the function InsertNodeAsParent of the file src/parser.c. The manipulation leads to null pointer dereference. Local access is required to...

PT-2025-26604 · Ncr · Ncr Itm Web Terminal

Name of the Vulnerable Software and Affected Versions: NCR ITM Web terminal versions 4.4.0 through 4.4.4 Description: The issue allows a remote attacker to execute arbitrary code via a crafted script to the IP camera URL component. Recommendations: For versions 4.4.0 through 4.4.4, consider...

PT-2025-26653

Name of the Vulnerable Software and Affected Versions: 70mai M300 up to 20250611 Description: A vulnerability was found in the Telnet Service component, affecting an unknown part of the file demo.sh. The manipulation leads to denial of service. Access to the local network is required for this...

PT-2025-26664

Name of the Vulnerable Software and Affected Versions Linksys E-Series routers versions prior to a firmware update Linksys E4200 Linksys E3200 Linksys E3000 Linksys E2500 Linksys E2100L Linksys E2000 Linksys E1550 Linksys E1500 Linksys E1200 Linksys E1000 Linksys E900 Description An OS command...