Malicious code in markdownlint-cli2-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 655d6053e439a95c848bd57cd41cba21de94f230903346b885b527082e131915 The package markdownlint-cli2-action was found to contain malicious code...

EUVD-2025-200053

Malicious code in markdownlint-cli2-action npm...

EUVD-2025-200010

Malicious code in m365-action-sdk npm...

Malicious code in m365-action-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a647b4c1144f1fc77a782dcc21ff359b1eecf83ecf7feaae9c0c2f3949670af The package m365-action-sdk was found to contain malicious code. Source: ghsa-malware 41899b4f5df3e91b3c1d1d83bfada41c83afbe17c90245a5410e87518e4e78f...

MAL-2025-191500 Malicious code in m365-action-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a647b4c1144f1fc77a782dcc21ff359b1eecf83ecf7feaae9c0c2f3949670af The package m365-action-sdk was found to contain malicious code. Source: ghsa-malware 41899b4f5df3e91b3c1d1d83bfada41c83afbe17c90245a5410e87518e4e78f...

CVE-2025-27232 Frontend arbitrary file read in oauth.authorize action

An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss...

Tencent HunyuanVideo load_vae Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent HunyuanVideo. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loadvae...

PT-2025-48442

An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss...

CVE-2025-13143

The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 19.12.0. This is due to missing or insufficient nonce validation on the disconnectaccountaction function. This makes it possible for...

CVE-2025-12579

The Reuters Direct plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'logoff' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to reset the plugin's settings...

CVE-2025-12578

The Reuters Direct plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the the 'class-reuters-direct-settings.php' page. This makes it possible for unauthenticated attackers to reset...

EUVD-2025-199791

The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 19.12.0. This is due to missing or insufficient nonce validation on the disconnectaccountaction function. This makes it possible for...

CVE-2025-13143

The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 19.12.0. This is due to missing or insufficient nonce validation on the disconnectaccountaction function. This makes it possible for...

CVE-2025-13143

CVE-2025-13143 : The Poll, Survey & Quiz Maker Plugin by Opinion Stage (WordPress) is vulnerable to Cross-Site Request Forgery in all versions up to 19.12.0 due to missing nonce validation on disconnect_account_action. Unauthenticated attackers can disconnect the site from the Opinion Stage integ...

CVE-2025-13143 Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.12.0 - Cross-Site Request Forgery to Account Disconnection

The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 19.12.0. This is due to missing or insufficient nonce validation on the disconnectaccountaction function. This makes it possible for...

EUVD-2025-199787

The Reuters Direct plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'logoff' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to reset the plugin's settings...

CVE-2025-12579

The Reuters Direct plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'logoff' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to reset the plugin's settings...

CVE-2025-12579 Reuters Direct <= 3.0.0 - Missing Authorization to Unauthenticated Settings Reset

The Reuters Direct plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'logoff' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to reset the plugin's settings...

CVE-2025-12579 Reuters Direct <= 3.0.0 - Missing Authorization to Unauthenticated Settings Reset

The Reuters Direct plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'logoff' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to reset the plugin's settings...

CVE-2025-12579

CVE-2025-12579 affects the Reuters Direct WordPress plugin. The vulnerability is a missing capability check on the logoff action in all versions up to and including 3.0.0, enabling unauthenticated attackers to reset the plugin’s settings (unauthorized modification of data). Connected sources conf...