CVE-2025-12714: Missing Authorization

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the updatesiteeditorhomepage function in all versions up to, and including, 1.0.271. This makes it possible for unauthenticated attackers to...

Poisoning AI Training Data

All it takes to poison AI training data is to create a website: I spent 20 minutes writing an article on my personal website titled "The best tech journalists at eating hot dogs." Every word is a lie. I claimed without evidence that competitive hot-dog-eating is a popular hobby among tech reporte...

CVE-2025-14384: Missing Authorization

The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /aioseo/v1/ai/credits REST route in all versions up to, and including, 4.9.2. This makes it possible for...

Cybersecurity AI: The World's Top AI Agent for Security Capture-The-Flag (CTF)

Are Capture-the-Flag competitions obsolete? In 2025, Cybersecurity AI CAI systematically conquered some of the world's most prestigious hacking competitions, achieving Rank 1 at multiple events and consistently outperforming thousands of human teams. Across five major circuits-HTB's AI vs Humans,...

CVE-2025-12847: Missing Authorization

The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment deletion due to a missing authorization check in all versions up to, and including, 4.8.9. This is due to the REST API endpoint...

MAL-2025-189335 Malicious code in sandbox-bash-authorize-hot-simulate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03dc660b6955606964bbd1a854d1ccdb491b52ee29cc056775e7f0a9e7c47d4e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-180429 Malicious code in teate-thy-sonic-girini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0c6a2362c977ae87b96cb86009d19debf32036368683d2e8156d7ccdde24abf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ksai-kaiso-olaki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f810da48b460d941c87035f35ab3f59d8d0a23d60549c1582b05a9400d2cbab5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-150008 Malicious code in @mipta1/ersata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4248a2157209e494d4100926bbb7e699582be8f66fa4212209a652f071631c50 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163627 Malicious code in nokire-zenitsu39 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37e1610fcc14de9943c9beefa6e25499d4a76ea145af5602e438f548b47efab6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145651 Malicious code in norma-supervisor-epimetheus-aquarius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b21559884472e9184dddd2e9706cb4f381d1a1b893b88c58be5f19663ce99356 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148785 Malicious code in transport-dotenv-safe-kinetic-deimos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c6b8a22e012e02ef3e3bac4f30177cc000a714bfbb20f47e5f2752d82dad8e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137521 Malicious code in umi-donat79-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 943d3e2feaad12aaa86b03ea4ef653ac8b61b57d245a5ea018d4d67c7da26a13 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-126007 Malicious code in eka-jengkol37-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04f63c3baa652b6a386998a99bb1d45115a02aa6d141ba050b5fdcb04454fbdc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indah-buburayam5-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8e803efbf42b78bbd7cce2e6a487d3a58d614ea621701769764a5ac0d291f9b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114778 Malicious code in indah-peyek82-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c776eba72a951378779a82c0e01313b610e4790347e68e37919adb9f01cecdc3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lutfi-martabak80-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31776bfa23a63ee3896e2ad7e4eb6bc77831fb4c3bdf99761522e616be2756c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111175 Malicious code in yanti-keripik26-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0284823f7e0649af8033a033f6280fb049d91f4aa8673679c7743552cce842a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-93376 Malicious code in big_crocodile_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af06dc79394dfe7bd4af27d1d77d056e2d8584b0fa8a731519c82aea6576eecd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-88545 Malicious code in mulyono-takokak53-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd96a18cfff20e755e11446c0489134dc794323c9d2388593ecf5a4aa5282c83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...