CVE-2025-46824 Discourse Code Review Plugin vulnerable to XSS via auto link commits

The Discourse Code Review Plugin allows users to review GitHub commits on Discourse. Prior to commit eed3a80, an attacker can execute arbitrary JavaScript on users' browsers by posting links to malicious GitHub commits. This problem is patched in commit eed3a80 of the discourse-code-review plugin...

Cisco IOS and IOS XE Software SNMPv3 Configuration Restriction Vulnerability

A vulnerability in the implementation of the Simple Network Management Protocol Version 3 SNMPv3 feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to poll an affected device using SNMP, even if the device is configured to deny SNMP traffic from ...

Memory leak while accessing <base-url>label/<labelname> (label search) on objects created in io.micrometer.core.instrument.ImmutableTag

h3. Issue Summary Memory leak while accessing label/ label search on objects created in io.micrometer.core.instrument.ImmutableTag This is reproducible on the Data Center: yes h3. Steps to Reproduce Use the following script to search randomly for labels code:java while : do curl...

PT-2025-20284 · Discourse · Discourse Code Review Plugin

Name of the Vulnerable Software and Affected Versions: Discourse Code Review Plugin versions prior to commit eed3a80 Description: The issue allows an attacker to execute arbitrary JavaScript on users' browsers by posting links to malicious GitHub commits. This is a problem with the Discourse Code...

PT-2025-19910 · Unknown · Cardealerpress

Name of the Vulnerable Software and Affected Versions: CarDealerPress versions up to, and including, 6.7.2504.00 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level...

PT-2025-20057 · Samsung · Samsung Flow

Name of the Vulnerable Software and Affected Versions: Samsung Flow versions prior to 4.9.17.6 Description: The issue is related to improper verification of intent by a broadcast receiver, allowing local attackers to modify the configuration. This could potentially lead to unauthorized changes in...

PT-2025-20062 · Samsung · Samsung Notes

Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 4.4.29.23 Description: The issue concerns the use of implicit intent for sensitive communication in translation, allowing local attackers to obtain sensitive information. User interaction is required to trigger...

PT-2025-20295 · Unknown · Wagtail Cms

Name of the Vulnerable Software and Affected Versions: Wagtail CMS version 6.4.1 Description: The issue is related to a Stored Cross-Site Scripting XSS in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface...

PT-2025-20111 · Unknown · Oliver Campion Display Remote Posts Block

Name of the Vulnerable Software and Affected Versions: Oliver Campion Display Remote Posts Block versions 1.1.0 and earlier Description: The issue is a Server-Side Request Forgery SSRF vulnerability, which allows for Server Side Request Forgery. This means an attacker can potentially force the...

PT-2025-20285 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions up to and including 3.3.0 Description: An unauthenticated SQL Injection issue was identified in the endpoint "/html/socio/sistema/get socios.php", specifically in the query parameter. This allows attackers to inject and execute...

PT-2025-20087 · WordPress · Product Quantity Dropdown For Woocommerce

Name of the Vulnerable Software and Affected Versions: Product Quantity Dropdown For Woocommerce versions 1.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions 1.2 and earlier, update to a...

DEBIAN-CVE-2025-46728

cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when Transfer-Encoding: chunked is used or when no Content-Length header is provided. A remote attacker can send a chunked...

CVE-2025-46728 cpp-httplib has Unbounded Memory Allocation in Chunked/No-Length Requests

cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when Transfer-Encoding: chunked is used or when no Content-Length header is provided. A remote attacker can send a chunked...

Inspektor Gadget Security Policies Can be Bypassed

Security policies like allowed-gadgets, disallow-pulling, verify-image can be bypassed by a malicious client. Impact Users running ig in daemon mode or IG on Kubernetes that rely on any of the features mentioned above are vulnerable to this issue. In order to exploit this, the client needs access...

PT-2025-19933 · D Link · D-Link Dir-600

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600L versions 2.07B01 and earlier Description: A critical issue has been identified that affects the formEasySetupWizard function. The manipulation of the host argument leads to a buffer overflow. This issue can be exploited...

PT-2025-19833 · Unknown · Sourcecodester Advanced Web Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Advanced Web Store version 1.0 Description: A critical vulnerability was found in SourceCodester Advanced Web Store. The issue affects an unknown function of the file /admin/admin addnew product.php. The manipulation of the...

PT-2025-19940 · D Link · D-Link Dir-600

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600L versions up to 2.07B01 Description: A critical vulnerability was found in the wake on lan function, allowing for command injection through the manipulation of the host argument. This issue can be exploited remotely and only...

PT-2025-19923 · Mrcms · Mrcms

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.2 Description: A vulnerability was found in MRCMS, classified as problematic, affecting an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has...

PT-2025-19961 · Tenda · Tenda Rx3

Name of the Vulnerable Software and Affected Versions: Tenda RX3 version V1.0br V16.03.13.11 Description: The issue concerns the manipulation of the mac parameter in the GetParentControlInfo function, accessible through the "/goform/GetParentControlInfo" API endpoint. This manipulation leads to a...

PT-2025-19834 · Sourcecodester · Sourcecodester Advanced Web Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Advanced Web Store version 1.0 Description: A critical vulnerability has been found in SourceCodester Advanced Web Store. The issue affects an unknown functionality of the file /admin/index.php. The manipulation of the txtLogin...