EUVD-2025-77736

Malicious code in artificialcowz3n npm...

EUVD-2025-82810

Malicious code in artificialperchz3n npm...

EUVD-2025-82811

Malicious code in artificialmarmotz3n npm...

EUVD-2025-55805

Malicious code in artificial-pink-lemming npm...

EUVD-2025-55806

Malicious code in artificial-gray-krill npm...

EUVD-2025-55804

Malicious code in artificial-purple-hummingbird npm...

EUVD-2025-55803

Malicious code in artificial-purple-puffin npm...

Malicious code in gilang-gorengan88-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b97bad6cd375ce0773144fbc469a3aab549201c53f6f9478cbe143412e8151e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Empower and Accelerate Your SOC with the Blue Agent

Meet the Blue Agent: AI-powered threat triage built on the Wiz platform. Investigate every threat with speed and transparency...

Exposure Report: 65% of Leading AI Companies Found with Verified Secret Leaks

How secure are top private AI companies? Find out from our scans and disclosures...

AI Pulse: AI Bots Are Targeting Commerce, Publishers, and High Tech

...

This Week in Spring - November 10th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! As I write this I am preparing for a flight to North Carolina first in flight!. This week's going to be busy, but next week even busier still! I'll be at AI By The Bay in San Francisco, AI Native Dev Con in NYC, and QCon SF i...

Exploit for CVE-2025-11749

CVE-2025-11749 AI Engine = 3.1.3 - Unauthenticated Sensiti...

CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

Faking Receipts with AI

Over the past few decades, it's become easier and easier to create fake receipts. Decades ago, it required special paper and printers--I remember a company in the UK advertising its services to people trying to cover up their affairs. Then, receipts became computerized, and faking them required...

Vibe-Coded Malicious VS Code Extension Found with Built-In Ransomware Capabilities

Cybersecurity researchers have flagged a malicious Visual Studio Code VS Code extension with basic ransomware capabilities that appears to be created with the help of artificial intelligence – in other words, vibe-coded. Secure Annex researcher John Tuckner, who flagged the extension "susvsex,"...

GHSA-RWVC-J5JR-MGVH Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade...

CVE-2025-48985

The CVE-2025-48985 vulnerability affects Vercel’s AI SDK, with fixes in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. The issue is an input-validation bypass that could allow bypassing filetype whitelists during file uploads. Connected sources confirm remediation via upgrading the AI SDK. Impact...

CVE-2025-48985

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details:...

CVE-2025-63639

The chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting XSS due to improper handling of user-supplied input. An attacker can inject malicious HTML or JavaScript into chat messages, which executes in the browser of any user viewing th...