PT-2025-13130

Name of the Vulnerable Software and Affected Versions Product Author for WooCommerce versions 1.0.0 through 1.0.7 Description The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations For versions...

PT-2025-13272

Name of the Vulnerable Software and Affected Versions verkkovaraani Print PDF Generator and Publisher versions 1.2.0 and earlier Description A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations For version...

PT-2025-13079

Name of the Vulnerable Software and Affected Versions Abu Bakar TWB Woocommerce Reviews versions 1.7.7 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into performing...

Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154)

A popular third-party GitHub Action, tj-actions/changed-files tracked as CVE-2025-30066link is external, was compromised. tj-actions/changed-files is designed to detect which files have changed in a pull request or commit. The supply chain compromise allows for information disclosure of secrets...

Hitachi Energy RTU500 Series (Update B)

SUMMARY Hitachi Energy is aware of the vulnerabilities, CVE-2024-10037, CVE-2024-11499, CVE-2024-12169, and CVE-2025-1445 in the RTU500 Web server component, the IEC 60870-5-104 controlled station implementation and IEC 61850 implementation, that affects the RTU500 versions that are listed...

PT-2025-12835

Name of the Vulnerable Software and Affected Versions The Ultimate Dashboard – Custom WordPress Dashboard plugin versions up to, and including, 3.8.7 Description The issue is related to unauthorized modification of data due to a missing capability check on the handle module actions function. This...

The first 24 hours of a cyber incident. A practical playbook

TL;DR The first 24 hours after a cyber incident are critical for containment and recovery. Small and medium-sized businesses SMBs often lack resources, but swift action is still possible. This playbook provides clear steps to follow in the heat of a breach: who to contact, what to do, and how to...

PT-2025-12584

Name of the Vulnerable Software and Affected Versions WP Ride Booking versions n/a through 2.4 Description A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations For versions n/a through 2.4, update to a...

PT-2025-12621

Name of the Vulnerable Software and Affected Versions HuangYe WuDeng Hacklog Remote Image Autosave versions through 2.1.0 Description The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into performing...

VulnCheck KEV: CVE-2025-30154

reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs...

PT-2025-12591

Name of the Vulnerable Software and Affected Versions ChrisHurst Simple Optimizer versions 1.2.7 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations For ChrisHurst Simpl...

PT-2025-12579

Name of the Vulnerable Software and Affected Versions Typekit plugin for WordPress versions 1.2.3 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

OpenDayLight (ODL) security vulnerabilities

OpenDaylight ODL is an open source SDN controller from OpenDaylight Open Source. A security vulnerability exists in OpenDaylight ODL Sodium-SR4 and earlier versions, which stems from a flaw in the Shiro-based RBAC mechanism that allows an attacker to perform privileged operations via specially...

PT-2025-12605

Name of the Vulnerable Software and Affected Versions Fix Rss Feeds versions n/a through 3.1 Description The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This is a type of attack where an attacker tricks a user into performing...

PT-2025-12594

Name of the Vulnerable Software and Affected Versions OTWthemes Info Boxes Shortcode and Widget versions 1.15 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This vulnerability...

PT-2025-12595

Name of the Vulnerable Software and Affected Versions SoundCloud Ultimate versions 1.5 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker...

PT-2025-12652

Name of the Vulnerable Software and Affected Versions SpeakPipe versions 0.2 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker tricks a user...

PT-2025-12637

Name of the Vulnerable Software and Affected Versions Link OSS Upload versions n/a through 4.8.9 Description A Cross-Site Request Forgery CSRF issue affects Link OSS Upload, allowing unauthorized actions to be performed on behalf of a user. This can be exploited by tricking a user into performing...

PT-2025-12651

Name of the Vulnerable Software and Affected Versions takien Rewrite versions 0.2.1 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker tricks...

reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs...