582 matches found
BIT-DISCOURSE-2025-68660 Discourse AI Discover's continue conversation allows threat actor to impersonate user
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, an endpoint lets any authenticated user bypass the aidiscoverpersona access controls and gain ongoing DM access to personas that may be wired to staff-only categories, RAG document set...
CVE-2025-68660
Affected product/versions: Discourse prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. Vulnerability: An endpoint allows any authenticated user to bypass the ai_discover_persona access controls and gain ongoing DM access to personas, potentially wired to staff-only categories, RAG documents, or...
Malicious Chrome extensions can spy on your ChatGPT chats
Researchers discovered 16 malicious browser extensions for Google Chrome and Microsoft Edge that steal ChatGPT session tokens, giving attackers access to accounts, including conversation history and metadata. The 16 malicious extensions 15 for Chrome and 1 for Edge claim to improve and optimize...
Malicious Package
Overview sd-conversation-history-module-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...
MAL-2026-307 Malicious code in sd-conversation-history-module-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30c335176b96214a0cf97acfa97156cd4216c1aa6e764167f49cef0eaa89cc72 The package sd-conversation-history-module-client was found to contain malicious code. Source: ghsa-malware...
MAL-2026-303 Malicious code in sd-active-conversation-module-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 278082132569830ff8cb8dd522f0e5284296ea09a1eebfbebffd95656cfe9c63 The package sd-active-conversation-module-client was found to contain malicious code. Source: ghsa-malware...
Malicious code in sd-active-conversation-module-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 278082132569830ff8cb8dd522f0e5284296ea09a1eebfbebffd95656cfe9c63 The package sd-active-conversation-module-client was found to contain malicious code. Source: ghsa-malware...
EUVD-2026-3059
Malicious code in sd-active-conversation-module-client npm...
Malicious code in sd-conversation-history-module-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30c335176b96214a0cf97acfa97156cd4216c1aa6e764167f49cef0eaa89cc72 The package sd-conversation-history-module-client was found to contain malicious code. Source: ghsa-malware...
EUVD-2026-3055
Malicious code in sd-conversation-history-module-client npm...
CVE-2025-12585 MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure
The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 via upload filenames. This makes it possible for unauthenticated attackers to extract session values that can subsequently be used to access...
WordPress Autochat Automatic Conversation plugin <= 1.1.9 - Missing Authorization to Unauthenticated Settings Update vulnerability
Missing Authorization to Unauthenticated Settings Update vulnerability discovered by Legion Hunter in WordPress Plugin Autochat Automatic Conversation versions = 1.1.9...
WordPress plugin Autochat Automatic Conversation 安全漏洞
WordPress Autochat Automatic Conversation plugin is an automated chat plugin designed for WordPress, which is mainly used to automate the communication between website visitors and merchants. WordPress Autochat Automatic Conversation plugin suffers from an unauthorized data modification...
AI and Voter Engagement
Social media has been a familiar, even mundane, part of life for nearly two decades. It can be easy to forget it was not always that way. In 2008, social media was just emerging into the mainstream. Facebook reached 100 million users that summer. And a singular candidate was integrating social...
When AI Meets the Web: Prompt Injection Risks in Third-Party AI Chatbot Plugins
Prompt injection attacks pose a critical threat to large language models LLMs, with prior work focusing on cutting-edge LLM applications like personal copilots. In contrast, simpler LLM applications, such as customer service chatbots, are widespread on the web, yet their security posture and...
CVE-2025-11256 Kognetiks Chatbot <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing
The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to upload limited safe files and erase conversatio...
CVE-2025-11256
CVE-2025-11256 refers to the WordPress plugin Kognetiks Chatbot (versions ≤ 2.3.5). The vulnerability arises from a missing capability check in multiple functions, enabling unauthenticated attackers to perform data modification, upload limited safe files, and erase conversations. Wordfence notes ...
CVE-2025-11256 Kognetiks Chatbot <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing
The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to upload limited safe files and erase conversatio...
CVE-2025-5009
In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conversation history and not just the snippet...
