197 matches found
EUVD-2026-8614
Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns readableContentHtml, the HTML parsing subprocess uses it directly without running it through DOMPurify. Every other content source in the crawler goes through Readability + DOMPurify,...
CVE-2026-27627 Karakeep's Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSS
Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns readableContentHtml, the HTML parsing subprocess uses it directly without running it through DOMPurify. Every other content source in the crawler goes through Readability + DOMPurify,...
CVE-2026-27627
Summary: CVE-2026-27627 affects Karakeep’s Reddit metascraper path. In version 0.30.0, the HTML returned as readableContentHtml by the Reddit plugin is consumed directly by the HTML parsing subprocess without DOMPurify sanitization, while other content sources go through Readability + DOMPurify. ...
PT-2026-21852
Name of the Vulnerable Software and Affected Versions Karakeep version 0.30.0 Description Karakeep is an elf-hostable bookmark-everything app. Version 0.30.0 does not properly sanitize HTML content received from the Reddit metascraper plugin. Specifically, when the plugin returns...
karakeep 跨站脚本漏洞
Karakeep is an open-source bookmarking app developed by Karakeep App. Version 0.30.0 of Karakeep contains a cross-site scripting vulnerability. This vulnerability arises from the Reddit meta-fetching plugin not using DOMPurify to clean HTML content, allowing malicious HTML to be executed in users...
Reddit, porn sites fined by UK regulators over children’s safety and privacy
The UK’s online safety and privacy regulators are targeting companies that violate new age verification laws at both ends : Porn sites that did not keep children out, and mainstream platforms that profited from children coming in. On February 23, media regulator Ofcom fined porn operators that...
[SECURITY] Fedora 42 Update: rust-redlib-0.35.1-10.fc42
Redlib is alternative private front-end to Reddit, with its origins in Libreddit. Redlib hopes to provide an easier way to browse Reddit, without the ads, trackers, and bloat...
[SECURITY] Fedora 43 Update: rust-redlib-0.35.1-10.fc43
Redlib is alternative private front-end to Reddit, with its origins in Libreddit. Redlib hopes to provide an easier way to browse Reddit, without the ads, trackers, and bloat...
Friday Squid Blogging: Petting a Squid
Video from Reddit shows what could go wrong when you try to pet a--looks like a Humboldt--squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy...
EUVD-2014-6634
Malware in sbrugna...
Baggage Tag Scam
I just heard about this: There's a travel scam warning going around the internet right now: You should keep your baggage tags on your bags until you get home, then shred them, because scammers are using luggage tags to file fraudulent claims for missing baggage with the airline. First, the scam i...
Malicious code in reddit-mobile (npm)
The package reddit-mobile was found to contain malicious code...
MAL-2025-31923 Malicious code in reddit-mobile-plugin-metrics (npm)
The package reddit-mobile-plugin-metrics was found to contain malicious code...
MAL-2025-31921 Malicious code in reddit-mobile (npm)
The package reddit-mobile was found to contain malicious code...
Malicious code in reddit-mobile-plugin-ads (npm)
The package reddit-mobile-plugin-ads was found to contain malicious code...
Malicious code in reddit-mobile-plugin-metrics (npm)
The package reddit-mobile-plugin-metrics was found to contain malicious code...
luis-reddit-cli (1.0.0), md-links-larissadepaula (>=0.2.0, <=0.2.1) +1 more potentially affected by unknown CVE via node-fecth (0.0.1-security)
node-fecth NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on node-fecth and may be impacted: - luis-reddit-cli 1.0.0 - md-links-larissadepaula =0.2.0, =0.0.37, =0.0.40 Source cves: unknown CVE Source advisory: OSV:MAL-2025-2761...
MAL-2025-31922 Malicious code in reddit-mobile-plugin-ads (npm)
The package reddit-mobile-plugin-ads was found to contain malicious code...
Understanding Content Moderation Policies and User Experiences in Generative AI Products
While recent research has focused on developing safeguards for generative AI GAI model-level content safety, little is known about how content moderation to prevent malicious content performs for end-users in real-world GAI products. To bridge this gap, we investigated content moderation policies...
Reddit’s new AI-powered tools scan your posts to serve you better ads
Reddit has introduced two Artificial Intelligence AI tools which will use Reddit comments, posts, and conversations to help sellers make the most of the community. Reddit is a social media platform and online forum where users can share and discuss content across a wide range of topics. The...