Chinese gangs made over $1 billion targeting Americans with scam texts

We regularly warn our readers about new scams and phishing texts. Almost everyone gets pestered with these messages. But where are all these scam texts coming from? According to an article in The Wall Street Journal: “It has become a billion-dollar, highly sophisticated business benefiting...

EUVD-2025-34980

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' parameter in all versions up to, and including, 3.17.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2025-10187: Improper Neutralization of Special Elements used in an SQL Command

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' parameter in all versions up to, and including, 3.17.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

PT-2025-42693

Name of the Vulnerable Software and Affected Versions GSpeech TTS – WordPress Text To Speech Plugin versions through 3.17.13 Description The GSpeech TTS – WordPress Text To Speech Plugin is susceptible to SQL Injection due to inadequate input sanitization and query preparation. This allows...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the acronym custom-tag in Rich Text. An attacker can execute arbitrary scripts in the context of the affected application by injecting malicious content through the back office interface. This is only...

GHSA-8C2G-F8JM-5CR7 ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text

Impact This security advisory resolves an XSS vulnerability in acronym custom tag in Rich Text, in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit this vulnerability. This typically means Editor or Administrator role,...

ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text

Impact This security advisory resolves an XSS vulnerability in acronym custom tag in Rich Text, in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit this vulnerability. This typically means Editor or Administrator role,...

PT-2025-44079

Impact This security advisory resolves an XSS vulnerability in acronym custom tag in Rich Text, in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit this vulnerability. This typically means Editor or Administrator role,...

CVE-2025-6051 vulnerabilities

Vulnerabilities for packages: text-generation-inference...

GHSA-37MW-44QP-F5JM vulnerabilities

Vulnerabilities for packages: text-generation-inference...

GHSA-RCV9-QM8P-9P6J vulnerabilities

Vulnerabilities for packages: text-generation-inference...

CVE-2025-6638 vulnerabilities

Vulnerabilities for packages: text-generation-inference...

GHSA-4W7R-H757-3R74 vulnerabilities

Vulnerabilities for packages: text-generation-inference...

CVE-2025-3933 vulnerabilities

Vulnerabilities for packages: text-generation-inference...

CVE-2025-6921 vulnerabilities

Vulnerabilities for packages: text-generation-inference...

GHSA-59P9-H35M-WG4G vulnerabilities

Vulnerabilities for packages: text-generation-inference...

CVE-2025-20329

The CVE-2025-20329 entry describes a vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software. When SIP media component logging is enabled, unencrypted credentials are stored, allowing an authenticated attacker with valid administrative cr...

Scammers are still sending us their fake Robinhood security alerts

A short while ago, our friends at Malwaretips wrote about a text scam impersonating Robinhood, a popular US-based investment app that lets people trade stocks and cryptocurrencies. The scam warns users about supposed “suspicious activity” on their accounts. As if to demonstrate that this phishing...

Satellites leak voice calls, text messages and more

Scientists from several US universities intercepted unencrypted broadcast through geostationary satellites using only off-the-shelf equipment on a university rooftop. Geostationary satellites move at the same speed as the Earth’s rotation so it seems as though they are always above the same exact...

CVE-2025-10132

The Dhivehi Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dhivehi' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...