PT-2025-13852 · Unknown · Configuration Split

Name of the Vulnerable Software and Affected Versions: Configuration Split versions 0.0.0 through 1.9.x Configuration Split versions 2.0.0 through 2.0.1 Description: A Cross-Site Request Forgery CSRF issue affects the Configuration Split module, allowing unauthorized actions to be performed. This...

PT-2025-13848 · Drupal · Drupal Oauth2 Client

Name of the Vulnerable Software and Affected Versions: Drupal OAuth2 Client versions 0.0.0 through 4.1.2 Description: A Cross-Site Request Forgery CSRF issue affects the Drupal OAuth2 Client, allowing unauthorized actions to be performed on behalf of the user. This issue may be exploited by an...

PT-2025-13761 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: Varnish WordPress versions 1.7 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions. The estimated number of potentially affected devices worldwide is not specified. There is no...

CVE-2025-31010 WordPress SimplyRETS Real Estate IDX plugin <= 3.0.5 - CSRF to Multiple Admin Actions vulnerability

Cross-Site Request Forgery CSRF vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Cross Site Request Forgery.This issue affects SimplyRETS Real Estate IDX: from n/a through = 3.0.5...

CVE-2025-2863

Cross-site request forgery CSRF vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attacker to exploit active administrator sessions and perform malicious actions. The malicious actions that can be executed by the attacker depend ...

CVE-2025-2863 Cross-site request forgery (CSRF) vulnerability in saTECH BCU

Cross-site request forgery CSRF vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attacker to exploit active administrator sessions and perform malicious actions. The malicious actions that can be executed by the attacker depend ...

CVE-2025-2863 Cross-site request forgery (CSRF) vulnerability in saTECH BCU

Cross-site request forgery CSRF vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attacker to exploit active administrator sessions and perform malicious actions. The malicious actions that can be executed by the attacker depend ...

MAL-2025-2749 Malicious code in contactbookmgmtserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4411a3fb5e56778179c647fb703b28d332d7b0f719ac7746b763317322a9a49a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2773 Malicious code in macos-relese (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 398aca8803a64fcc22bd99f0a9ded72acd13a096dc268e6a30cabb2828066c62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress SimplyRETS Real Estate IDX plugin <= 3.0.5 - CSRF to Multiple Admin Actions vulnerability

CSRF to Multiple Admin Actions vulnerability discovered by Psai in WordPress Plugin SimplyRETS Real Estate IDX versions = 3.0.5...

MAL-2025-2736 Malicious code in test-utils-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c296c435648a7ea93add03c751dc85edae75eeaf8f9e36b3059aa28846dc654 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-30872

Cross-Site Request Forgery CSRF vulnerability in Nitin Prakash Product Author for WooCommerce wc-product-author allows Cross Site Request Forgery.This issue affects Product Author for WooCommerce: from n/a through = 1.0.7...

CVE-2025-30833 WordPress Verge3D Publishing and E-Commerce Plugin <= 4.8.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through = 4.8.2...

Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154)

A popular third-party GitHub Action, tj-actions/changed-files tracked as CVE-2025-30066link is external, was compromised. tj-actions/changed-files is designed to detect which files have changed in a pull request or commit. The supply chain compromise allows for information disclosure of secrets...

Hitachi Energy RTU500 Series (Update B)

SUMMARY Hitachi Energy is aware of the vulnerabilities, CVE-2024-10037, CVE-2024-11499, CVE-2024-12169, and CVE-2025-1445 in the RTU500 Web server component, the IEC 60870-5-104 controlled station implementation and IEC 61850 implementation, that affects the RTU500 versions that are listed...

The first 24 hours of a cyber incident. A practical playbook

TL;DR The first 24 hours after a cyber incident are critical for containment and recovery. Small and medium-sized businesses SMBs often lack resources, but swift action is still possible. This playbook provides clear steps to follow in the heat of a breach: who to contact, what to do, and how to...

VulnCheck KEV: CVE-2025-30154

reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs...

OpenDaylight（ODL） 安全漏洞

OpenDaylight ODL is an open source SDN controller from OpenDaylight Open Source. A security vulnerability exists in OpenDaylight ODL Sodium-SR4 and earlier versions, which stems from a flaw in the Shiro-based RBAC mechanism that allows an attacker to perform privileged operations via specially...

reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs...

Coinbase Initially Targeted in GitHub Actions Supply Chain Attack; 218 Repositories' CI/CD Secrets Exposed

The supply chain attack involving the GitHub Action "tj-actions/changed-files" started as a highly-targeted attack against one of Coinbase's open-source projects, before evolving into something more widespread in scope. "The payload was focused on exploiting the public CI/CD flow of one of their...