CVE-2023-4935

The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the createprofile function. This makes it possible for unauthenticated attackers to create profiles via a forged request granted th...

CVE-2023-4926

The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobebulkdeleteproducts function. This makes it possible for unauthenticated attackers to delete products via a forged request...

2025 exposed the risks we ignored while rushing AI

This blog is part of a series where we highlight new or fast-evolving threats in the consumer security landscape. This one looks at how the rapid rise ofArtificial Intelligence AI is putting users at risk. In 2025 we saw an ever-accelerating race between AI providers to push out new features. We...

AI teddy bear for kids responds with sexual content and advice about weapons

In testing, FoloToy’s AI teddy bear jumped from friendly chat to sexual topics and unsafe household advice. It shows how easily artificial intelligence can cross serious boundaries. It’s a fair moment to ask whether AI-powered stuffed animals are appropriate for children. It’s easy to get swept u...

EUVD-2025-116956

Malicious code in mixedbearz3n npm...

EUVD-2025-117225

Malicious code in misleading-red-bear npm...

EUVD-2025-117475

Malicious code in comprehensive-scarlet-bear npm...

EUVD-2025-100084

Malicious code in dependentbearz3n npm...

Malicious code in promising_bear_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c22c39fdd5f08b74a728076f604c2ef34025bcef17d9675c1a0359955782019c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-102975

Malicious code in promisingbearz3n npm...

MAL-2025-127239 Malicious code in honest_bear_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ae3f9408619491702eddeadc351c39de63dcf0752cce45d34614baffce43c19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-95726

Malicious code in protectivebearz3n npm...

EUVD-2025-94815

Malicious code in symbolicbearz3n npm...

Malicious code in symbolic_bear_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a390ce953913ff224e33ceb198e6667bf90274788088315eb61dbdf051481c88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in protective_bear_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb3468b05bca5f9bdf0d358d79291e7b0af5f8b23eacd0572780d9c61a29b9a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-122574 Malicious code in protective_bear_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb3468b05bca5f9bdf0d358d79291e7b0af5f8b23eacd0572780d9c61a29b9a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-96856

Malicious code in lengthybearz3n npm...

Malicious code in silent_bear_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 280b6c41e0d67c7e2945cfcc43d3b4fd32af7cff790c746bda237f48cd2fae14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-87411

Malicious code in zealousbearz3n npm...

Malicious code in grotesque_bear_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5ab993cf6c54daf3e56072ef099d9975c81765c2e86904473ead70cb77abd62 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...