PT-2025-3499 · Monetdb · Monetdb Server

Name of the Vulnerable Software and Affected Versions: MonetDB Server version 11.49.1 Description: The issue in the is column unique component allows attackers to cause a Denial of Service DoS via crafted SQL statements. Recommendations: For MonetDB Server version 11.49.1, consider disabling the ...

PT-2025-2890

Name of the Vulnerable Software and Affected Versions GestioIP version 3.5.7 Description The ip do job request is vulnerable to Cross-Site Scripting XSS, allowing data exfiltration and enabling CSRF attacks. The vulnerability requires specific user permissions within the application to exploit...

PT-2025-3455

Name of the Vulnerable Software and Affected Versions Tenda i24 version 2.0.0.5 Description The issue is related to a buffer overflow in the addWifiMacFilter function. This function is susceptible to a buffer overflow, which can lead to potential security risks. Recommendations For Tenda i24...

PT-2025-6044

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.43 Description A problem has been found in the function sanitizer::internal strlen of the file binutils/nm.c of the component nm. The manipulation of the argument const leads to buffer overflow. The attack can be launche...

PT-2025-4751 · Teedy · Teedy

Name of the Vulnerable Software and Affected Versions: Teedy versions 1.11 and earlier Description: The issue allows for CSRF, enabling account takeover via POST "/api/user/admin". This can be exploited to gain unauthorized access to user accounts. Recommendations: For versions 1.11 and earlier, ...

PT-2025-1204

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server ABAP affected versions not specified SAP BusinessObjects Business Intelligence Platform affected versions not specified Description The issue is related to an information disclosure vulnerability that allows an...

PT-2025-2941 · Unknown · Graphics Ddk

Name of the Vulnerable Software and Affected Versions: Graphics DDK version = 24.2 RTM2 Description: Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to write data outside the Guest's virtualised GPU memory. Recommendations: For versions = 24....

PT-2025-3875 · Unknown · Liujianview Gymxmjpa

Name of the Vulnerable Software and Affected Versions: liujianview gymxmjpa version 1.0 Description: A critical vulnerability has been found in the CoachController function of the file src/main/java/com/liujian/gymxmjpa/controller/CoachController.java. The manipulation of the coachName argument...

PT-2025-3871

Name of the Vulnerable Software and Affected Versions StarSea99 starsea-mall version 1.0 Description A cross-site scripting issue affects the processing of the file "/admin/categories/update", where the manipulation of the categoryName argument leads to cross-site scripting. The attack may be...

PT-2025-3879 · Unknown · Liujianview Gymxmjpa

Name of the Vulnerable Software and Affected Versions: liujianview gymxmjpa version 1.0 Description: A critical issue has been found in the function LoosDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/LoosController.java. The manipulation of the argument loosName leads to SQL...

PT-2025-1652 · WordPress · Gatormail Smartforms

Name of the Vulnerable Software and Affected Versions: GatorMail SmartForms plugin for WordPress versions up to, and including, 1.1.0 Description: The issue is related to Stored Cross-Site Scripting in the GatorMail SmartForms plugin for WordPress. This is due to insufficient input sanitization a...

PT-2025-1920 · WordPress · The Coupon X: Discount Pop Up

Name of the Vulnerable Software and Affected Versions: The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress versions up to, and including, 1.3.5 Description: The issue is related to PHP Object Injection via deserialization of untrusted...

PT-2025-3414 · Linksys · Linksys E7350

Name of the Vulnerable Software and Affected Versions: Linksys E7350 version 1.1.00.032 Description: A command injection issue was discovered via the ifname parameter in the apcli wps gen pincode function. This allows for potential exploitation. Recommendations: For Linksys E7350 version...

PT-2025-3417 · Linksys · Linksys E7350

Name of the Vulnerable Software and Affected Versions: Linksys E7350 version 1.1.00.032 Description: A command injection issue was discovered via the iface parameter in the vif enable function. This allows for potential exploitation. Recommendations: For Linksys E7350 version 1.1.00.032, as a...

PT-2025-3415 · Linksys · Linksys E7350

Name of the Vulnerable Software and Affected Versions: Linksys E7350 version 1.1.00.032 Description: A command injection issue was discovered via the ifname parameter in the apcli do enr pin wps function. This allows for potential exploitation. Recommendations: For Linksys E7350 version 1.1.00.03...

PT-2025-3685 · Megabip · Megabip

Name of the Vulnerable Software and Affected Versions: MegaBIP versions prior to 5.15 Description: The issue affects websites managed by MegaBIP, where a form under the "/edytor/index.php?id=7,7,0" endpoint lacks protection mechanisms, making it vulnerable to Cross-Site Request Forgery CSRF. An...

PT-2025-2876

Name of the Vulnerable Software and Affected Versions Indico versions 3.2.9 through 3.3.5 Description A Broken Object Level Authorization BOLA issue allows attackers to read or access sensitive information by sending a crafted POST request to the "/api/principals" component. The supplier disputes...

CVE-2025-22149

The CVE-2025-22149 issue affects the JWK Set Go implementation’s auto-caching HTTP client (github.com/MicahParks/jwkset). Before v0.6.0, the local JWK Set cache could overwrite or append during remote refresh instead of performing a full replacement, potentially leaving revoked keys usable if rem...

CVE-2025-22149 JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh

JWK Set JSON Web Key Set is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use...

CVE-2025-22149 JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh

JWK Set JSON Web Key Set is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use...