PT-2025-29761 · WordPress · Toast Plugins Animator

Name of the Vulnerable Software and Affected Versions: Toast Plugins Animator versions n/a through 3.0.16 Description: A Cross-Site Request Forgery CSRF issue exists in Toast Plugins Animator. This allows attackers to perform actions on behalf of unsuspecting users. Recommendations: Update Toast...

MAL-2025-5941 Malicious code in node-mongodb-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ac7ad5072828933069aa01c5de1ac1780566e205e1866722a012b7fa73c900b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5928 Malicious code in jsonlis-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fce7376d51c7762ca92d6e8e883d0149c250a44d92fcdea76667d07c5b584dff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Directus 授权问题漏洞

Directus is a real-time Api and application dashboard open-sourced by Directus. It is used to manage Sql database content. An authorization issue vulnerability exists in Directus versions prior to 9.12.0 to 11.9.0 that stems from a manual trigger process that does not validate permissions, which...

CVE-2025-6948

An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content...

When Developer Aid Becomes Security Debt: a Systematic Analysis of Insecure Behaviors in LLM Coding Agents

LLM-based coding agents are rapidly being deployed in software development, yet their security implications remain poorly understood. These agents, while capable of accelerating software development, may inadvertently introduce insecure practices. We conducted the first systematic security...

CVE-2025-4855

The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sbencryption function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization...

WordPress PrivateContent-Mail Actions File Inclusion Vulnerability

WordPress PrivateContent-Mail Actions is the name of the plugin or feature module for mail actions and member management. WordPress PrivateContent-Mail Actions suffers from a file inclusion vulnerability that stems from improper file inclusion control, which can be exploited by an attacker to cau...

CVE-2025-32988

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name SAN entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1deletestructure on an ASN.1 node it do...

Improper Verification Of Cryptographic Signature

Clerk is vulnerable to improper verification of cryptographic signature. The vulnerability is due to the use of the verifyWebhook helper, which may accept improperly signed webhook events, allowing an attacker to forge webhook requests and potentially trigger unauthorized actions...

MAL-2025-5743 Malicious code in actions-experiment (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a3571367d4274d4ca5d5c2cd7b400c40b4d656c2c58fb0746e8372cb24910c5b The OpenSSF Package Analysis project identified 'actions-experiment' ...

Malicious code in actions-experiment (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a3571367d4274d4ca5d5c2cd7b400c40b4d656c2c58fb0746e8372cb24910c5b The OpenSSF Package Analysis project identified 'actions-experiment' ...

Access Control Bypass

pyloadng is vulnerable to Access Control Bypass. The vulnerability is due to improper enforcement of access control rules for localhost-restricted functionality, which allows unauthenticated attackers to bypass security checks and perform unauthorized actions such as creating arbitrary packages...

CVE-2025-4855

The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sbencryption function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization...

CVE-2025-4855

The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sbencryption function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization...

MAL-2025-5717 Malicious code in pogomap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 346daf8a2d0c74a0583577fb5a7a813715159cc2783cee412ed8064813f0f20b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Folo 安全漏洞

Folo is an information aggregation tool open-sourced by RSSNext. Folo has a security vulnerability that stems from the use of pullrequesttarget in the GitHub Actions workflow, which could lead to elevation of privilege...

CVE-2025-7030

Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication TFA allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.11.0...

CVE-2025-7030

CVE-2025-7030 affects Drupal Two-factor Authentication (TFA) module prior to 1.11.0. The root cause is a Privilege Defined With Unsafe Actions vulnerability that hinges on incorrectly configured access controls, allowing bypass of certain privilege checks. Affected versions range from 0.0.0 up to...

No thanks: Google lets its Gemini AI access your apps, including messages [updated]

If you're an Android user, you'll need to take action if you don’t want Google's Gemini AI to have access to your apps. That's because, regardless of your previous settings, Google now allows Gemini to interact with third-party apps. Through Gemini extensions, it already had the ability to...