CVE-2025-12714: Missing Authorization

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the updatesiteeditorhomepage function in all versions up to, and including, 1.0.271. This makes it possible for unauthenticated attackers to...

coinsta (>=0.1.5, <=0.1.6), cricket-rankings (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2026-41066 via lxml (4.2.2)

lxml PYPI version 4.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - coinsta =0.1.5, =1.0.1, =1.0.3 - onelogin 1.4.0 Source cves: CVE-2026-41066 Source advisory: OSV:PYSEC-2026-87...

coinsta (>=0.1.5, <=0.1.6), cricket-rankings (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2026-41066 via lxml (4.2.2)

lxml PYPI version 4.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - coinsta =0.1.5, =1.0.1, =1.0.3 - onelogin 1.4.0 Source cves: CVE-2026-41066 Source advisory: OSV:GHSA-VFMQ-68HX-4JFW...

Poisoning AI Training Data

All it takes to poison AI training data is to create a website: I spent 20 minutes writing an article on my personal website titled "The best tech journalists at eating hot dogs." Every word is a lie. I claimed without evidence that competitive hot-dog-eating is a popular hobby among tech reporte...

CVE-2025-14384: Missing Authorization

The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /aioseo/v1/ai/credits REST route in all versions up to, and including, 4.9.2. This makes it possible for...

Cybersecurity AI: The World's Top AI Agent for Security Capture-The-Flag (CTF)

Are Capture-the-Flag competitions obsolete? In 2025, Cybersecurity AI CAI systematically conquered some of the world's most prestigious hacking competitions, achieving Rank 1 at multiple events and consistently outperforming thousands of human teams. Across five major circuits-HTB's AI vs Humans,...

CVE-2025-12847: Missing Authorization

The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment deletion due to a missing authorization check in all versions up to, and including, 4.8.9. This is due to the REST API endpoint...

MAL-2025-189335 Malicious code in sandbox-bash-authorize-hot-simulate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03dc660b6955606964bbd1a854d1ccdb491b52ee29cc056775e7f0a9e7c47d4e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-180429 Malicious code in teate-thy-sonic-girini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0c6a2362c977ae87b96cb86009d19debf32036368683d2e8156d7ccdde24abf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ksai-kaiso-olaki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f810da48b460d941c87035f35ab3f59d8d0a23d60549c1582b05a9400d2cbab5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163627 Malicious code in nokire-zenitsu39 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37e1610fcc14de9943c9beefa6e25499d4a76ea145af5602e438f548b47efab6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-150008 Malicious code in @mipta1/ersata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4248a2157209e494d4100926bbb7e699582be8f66fa4212209a652f071631c50 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145651 Malicious code in norma-supervisor-epimetheus-aquarius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b21559884472e9184dddd2e9706cb4f381d1a1b893b88c58be5f19663ce99356 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148785 Malicious code in transport-dotenv-safe-kinetic-deimos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c6b8a22e012e02ef3e3bac4f30177cc000a714bfbb20f47e5f2752d82dad8e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137521 Malicious code in umi-donat79-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 943d3e2feaad12aaa86b03ea4ef653ac8b61b57d245a5ea018d4d67c7da26a13 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-126007 Malicious code in eka-jengkol37-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04f63c3baa652b6a386998a99bb1d45115a02aa6d141ba050b5fdcb04454fbdc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indah-buburayam5-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8e803efbf42b78bbd7cce2e6a487d3a58d614ea621701769764a5ac0d291f9b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114778 Malicious code in indah-peyek82-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c776eba72a951378779a82c0e01313b610e4790347e68e37919adb9f01cecdc3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lutfi-martabak80-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31776bfa23a63ee3896e2ad7e4eb6bc77831fb4c3bdf99761522e616be2756c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111175 Malicious code in yanti-keripik26-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0284823f7e0649af8033a033f6280fb049d91f4aa8673679c7743552cce842a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...