CVE-2025-31479 canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output

canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUBTOKEN. If the full token is included in the excepti...

MAL-2025-3066 Malicious code in ehackify-workshop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6b886d5c20d3c03f44c4900a8073d17e4871883be89a22c897197d0a5baecb7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3069 Malicious code in keybase-live-feed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04e37d8ed67c047350e5767575fe330037e3df4a1d2bc9a1159801b02c54a375 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Tiger Theme <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Tiger Type Theme Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-31407 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 7418cf31bc7a Credits Mika Required privilege Subscriber Published 2...

3DPrint Lite < 2.1.3.6 - Cross-Site Request Forgery

Description The 3DPrint Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3.5. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action...

get-workflow-version-action 日志信息泄露漏洞

get-workflow-version-action is a Canonical open source tool. A log information disclosure vulnerability exists in get-workflow-version-action versions prior to 1.0.1, which stems from the fact that the exception output may contain GITHUBTOKEN, which could lead to information disclosure...

Oracle Hit with Lawsuit Over Alleged Cloud Breach Affecting Millions

Oracle faces a class action lawsuit filed in Texas over a cloud data breach exposing sensitive data of 6M+ users; plaintiff alleges negligence and delays...

WordPress Dima Take Action Plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tri Doan in WordPress Plugin Dima Take Action versions = 1.0.5...

CVE-2025-31742

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PixelDima Dima Take Action dima-take-action allows Stored XSS.This issue affects Dima Take Action: from n/a through = 1.0.5...

CVE-2025-30354

Bruno is an open source IDE for exploring and testing APIs. A bug in the assertion runtime caused assert expressions to run in Developer Mode, even if Safe Mode was selected. The bug resulted in the sandbox settings to be ignored for the particular case where a single request is run/sent. This...

CVE-2025-31742 WordPress Dima Take Action Plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PixelDima Dima Take Action dima-take-action allows Stored XSS.This issue affects Dima Take Action: from n/a through = 1.0.5...

CVE-2025-31742 WordPress Dima Take Action Plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PixelDima Dima Take Action dima-take-action allows Stored XSS.This issue affects Dima Take Action: from n/a through = 1.0.5...

CVE-2025-31742

CVE-2025-31742 is documented in connected sources as an Apache HTTP Server mod_proxy SSRF vulnerability (not specifically tied to Dima Take Action). Reported impact is internal service exposure via SSRF; remediation guidance in the connected doc includes upgrading to patched Apache and deploying ...

PT-2025-14427 · Unknown · M. Tuhin Ultimate Push Notifications

Name of the Vulnerable Software and Affected Versions: M. Tuhin Ultimate Push Notifications versions n/a through 1.1.8 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

WordPress plugin Dima Take Action 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Malicious code in yaml-update-action (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-2919 Malicious code in yaml-update-action (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in team-labeler-action (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-2905 Malicious code in team-labeler-action (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-2787 Malicious code in smart-file-renamer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28b650ad09355a36c0fcdb91255b1bcb59984a12295de8a0a88ac5735c29f7f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...