374 matches found
CVE-2025-69084 WordPress Photo Gallery plugin <= 2.7.7.26 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Reflected XSS.This issue affects Photo Gallery: from n/a through = 2.7.7.26...
Hacktivists claim near-total Spotify music scrape
Hacktivist group Anna’s Archive claims to have scraped almost all of Spotify’s catalog and is now seeding it via BitTorrent, effectively turning a streaming platform into a roughly 300 TB pirate “preservation archive.” On its blog, the group states: “A while ago, we discovered a way to scrape...
Scammers harvesting Facebook photos to stage fake kidnappings, warns FBI
The FBI has warned about a new type of scam where your Facebook pictures are harvested to act as “proof-of-life” pictures in a virtual kidnapping. The scammers pretend they have kidnapped somebody and contact friends and next of kin to demand a ransom for their release. While the alleged victim i...
Important: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.8.0 release
Red Hat OpenShift distributed tracing platform Tempo 3.8.0 has been released This release of the Red Hat OpenShift distributed tracing platform Tempo provides new features, security improvements, and bug fixes. Breaking changes: Nothing Deprecations: Nothing Technology Preview features: Nothing...
When AI Meets the Web: Prompt Injection Risks in Third-Party AI Chatbot Plugins
Prompt injection attacks pose a critical threat to large language models LLMs, with prior work focusing on cutting-edge LLM applications like personal copilots. In contrast, simpler LLM applications, such as customer service chatbots, are widespread on the web, yet their security posture and...
Allocation of Resources Without Limits or Throttling
Overview Scrapy is a high-level web crawling and web scraping framework, used to crawl websites and extract structured data from their pages. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to insufficient protection against decompressi...
CVE-2025-59571 WordPress WorkScout-Core plugin < 1.7.06 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through 1.7.06...
Elasticsearch Leak Exposes 6 Billion Records from Scraping, Old and New Breaches
An Elasticsearch leak exposed 6 billion records from global data breaches and scraping sources, including banking and personal details tied to multiple regions...
EUVD-2020-29672
Malware in sbrugna...
EUVD-2021-0239
Malware in sbrugna...
EUVD-2020-29673
Malware in sbrugna...
EUVD-2024-49922
Malicious code in bioql PyPI...
From Scraping to Paying: Monetizing AI Bots at the Edge
...
Lawsuit About WhatsApp Security
Attaullah Baig, WhatsApp's former head of security, has filed a whistleblower lawsuit alleging that Facebook deliberately failed to fix a bunch of security flaws, in violation of its 2019 settlement agreement with the Federal Trade Commission. The lawsuit, alleging violations of the whistleblower...
scraping-eksi (>=0.0.0, <=1.0.1) potentially affected by unknown CVE via limited-parallel-loop (0.0.0)
limited-parallel-loop NPM version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on limited-parallel-loop and may be impacted: - scraping-eksi =0.0.0, =1.0.1 Source cves: unknown CVE Source advisory: OSV:MAL-2025-25373...
Malicious code in scraping-eksi (npm)
The package scraping-eksi was found to contain malicious code...
MAL-2025-32816 Malicious code in scraping-eksi (npm)
The package scraping-eksi was found to contain malicious code...
CVE-2025-46341 Privilege escalation via SSRF when using HTTP auth
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any user either via the Remote-User header or the X-WebAuth-User header by making specially crafted requests via the add feed functionality an...
CVE-2025-24369
Anubis is a tool that allows administrators to protect bots against AI scrapers through bot-checking heuristics and a proof-of-work challenge to discourage scraping from multiple IP addresses. Anubis allows attackers to bypass the bot protection by requesting a challenge, formulates any nonce suc...