Malicious Chrome extensions can spy on your ChatGPT chats

Researchers discovered 16 malicious browser extensions for Google Chrome and Microsoft Edge that steal ChatGPT session tokens, giving attackers access to accounts, including conversation history and metadata. The 16 malicious extensions 15 for Chrome and 1 for Edge claim to improve and optimize...

Malicious Package

Overview sd-conversation-history-module-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

MAL-2026-307 Malicious code in sd-conversation-history-module-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30c335176b96214a0cf97acfa97156cd4216c1aa6e764167f49cef0eaa89cc72 The package sd-conversation-history-module-client was found to contain malicious code. Source: ghsa-malware...

MAL-2026-303 Malicious code in sd-active-conversation-module-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 278082132569830ff8cb8dd522f0e5284296ea09a1eebfbebffd95656cfe9c63 The package sd-active-conversation-module-client was found to contain malicious code. Source: ghsa-malware...

EUVD-2026-3055

Malicious code in sd-conversation-history-module-client npm...

EUVD-2026-3059

Malicious code in sd-active-conversation-module-client npm...

Malicious code in sd-conversation-history-module-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30c335176b96214a0cf97acfa97156cd4216c1aa6e764167f49cef0eaa89cc72 The package sd-conversation-history-module-client was found to contain malicious code. Source: ghsa-malware...

Malicious code in sd-active-conversation-module-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 278082132569830ff8cb8dd522f0e5284296ea09a1eebfbebffd95656cfe9c63 The package sd-active-conversation-module-client was found to contain malicious code. Source: ghsa-malware...

CVE-2025-12585 MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure

The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 via upload filenames. This makes it possible for unauthenticated attackers to extract session values that can subsequently be used to access...

WordPress Autochat Automatic Conversation plugin <= 1.1.9 - Missing Authorization to Unauthenticated Settings Update vulnerability

Missing Authorization to Unauthenticated Settings Update vulnerability discovered by Legion Hunter in WordPress Plugin Autochat Automatic Conversation versions = 1.1.9...

WordPress plugin Autochat Automatic Conversation 安全漏洞

WordPress Autochat Automatic Conversation plugin is an automated chat plugin designed for WordPress, which is mainly used to automate the communication between website visitors and merchants. WordPress Autochat Automatic Conversation plugin suffers from an unauthorized data modification...

AI and Voter Engagement

Social media has been a familiar, even mundane, part of life for nearly two decades. It can be easy to forget it was not always that way. In 2008, social media was just emerging into the mainstream. Facebook reached 100 million users that summer. And a singular candidate was integrating social...

When AI Meets the Web: Prompt Injection Risks in Third-Party AI Chatbot Plugins

Prompt injection attacks pose a critical threat to large language models LLMs, with prior work focusing on cutting-edge LLM applications like personal copilots. In contrast, simpler LLM applications, such as customer service chatbots, are widespread on the web, yet their security posture and...

CVE-2025-11256 Kognetiks Chatbot <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing

The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to upload limited safe files and erase conversatio...

CVE-2025-11256

CVE-2025-11256 refers to the WordPress plugin Kognetiks Chatbot (versions ≤ 2.3.5). The vulnerability arises from a missing capability check in multiple functions, enabling unauthenticated attackers to perform data modification, upload limited safe files, and erase conversations. Wordfence notes ...

CVE-2025-11256 Kognetiks Chatbot <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing

The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to upload limited safe files and erase conversatio...

CVE-2025-5009

In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conversation history and not just the snippet...

CVE-2025-5009

In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conversation history and not just the snippet...

CVE-2025-5009 Information Disclosure in Gemini iOS App

In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conversation history and not just the snippet...

CVE-2025-5009

In Gemini iOS, the sharing flow for a conversation snippet inadvertently exposes the entire conversation history via a publicly accessible link. Affected software: Gemini iOS. Root cause: the share mechanism does not limit content to the selected snippet, leading to information disclosure of prev...