GHSA-WJ56-G96R-673Q StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts

Summary The REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank. This inconsistency allows an admin to create additional admin accounts...

New RFP Template for AI Usage Control and AI Governance 

As AI becomes the central engine for enterprise productivity, security leaders are finally getting the green light — and the budget — to secure it. But there’s a quiet crisis unfolding in the boardroom: many organizations know they need "AI Governance," but they have no idea what they are actuall...

CVE-2021-33666

When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facilitate an XSS attack or malware proliferation...

MAL-2025-181100 Malicious code in teate-thy-sonic-wodeg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f11d57af56c973d4837b0bdaebf66366f36fcd07237a6aa9a3555fada3e36e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158456 Malicious code in lookingan-nalako46 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9adee7d726d356098eacd25a2ab3a7ca98ad2968f07307c48d598e646e7ebe4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-130073 Malicious code in scared_bison_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88072624d312752e3426013cd3a27107ca90f50d3605141c4c689622c31e3723 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-131289 Malicious code in weekly_woodpecker_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fac04c08107e0abfa4df0e784ed098f5a9a947425614377f63a2b8a6f4b4fdd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rifqi-soto76-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f864128663e82e5953feed538070e139fb44848accd449c6f4509367ee06f08 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-116571 Malicious code in putri-naget20-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5aab9b87827f59881596b2066813a38a2d21290c3c7ed5eaac6b5b3418a418c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-104121 Malicious code in indah-papeda1-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d9ac9495dcfe1ea198e20dd69c7cee975a69c6010838ae08f7bc10ccd1b0ecc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-88106 Malicious code in mad_locust_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eed062c8eca4e2cad9fa33b70133a8ce414c3ff5430b2231dd41a9a7242f0763 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-79933 Malicious code in mathematical_guineafowl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fa49d0ff38621df0c38fa5d315fb49a2b82ce4a7ca875326eb2816edb4fa18d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-67060 Malicious code in brief-coral-tortoise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0d6ae84abe6e7eda359884f6366ebfbf0697d69ff0166cf351c0b03c352a3fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2021-20343

Malware in sbrugna...

International Security Applications of Flexible Hardware-Enabled Guarantees

As AI capabilities advance rapidly, flexible hardware-enabled guarantees flexHEGs offer opportunities to address international security challenges through comprehensive governance frameworks. This report examines how flexHEGs could enable internationally trustworthy AI governance by establishing...

Passwordless AND Keyless: The Future of (Privileged) Access Management

In IT environments, some secrets are managed well and some fly under the radar. Here's a quick checklist of what kinds of secrets companies typically manage, including one type they should manage: Passwords x TLS certificates x Accounts x SSH keys ??? The secrets listed above are typically secure...

Apple Updates Spyware Alert System to Warn Victims of Mercenary Attacks

Apple on Wednesday revised its documentation pertaining to its mercenary spyware threat notification system to mention that it alerts users when they may have been individually targeted by such attacks. It also specifically called out companies like NSO Group for developing commercial surveillanc...

U.S. Imposes Visa Restrictions on those Involved in Illegal Spyware Surveillance

The U.S. State Department said it's implementing a new policy that imposes visa restrictions on individuals who are linked to the illegal use of commercial spyware to surveil civil society members. "The misuse of commercial spyware threatens privacy and freedoms of expression, peaceful assembly,...

Getting off the Attack Surface Hamster Wheel: Identity Can Help

IT professionals have developed a sophisticated understanding of the enterprise attack surface – what it is, how to quantify it and how to manage it. The process is simple: begin by thoroughly assessing the attack surface, encompassing the entire IT environment. Identify all potential entry and...

Analyzing the FUD Malware Obfuscation Engine BatCloak

We look into BatCloak engine, its modular integration into modern malware, proliferation mechanisms, and interoperability implications as malicious actors take advantage of its fully undetectable FUD capabilities...