Malicious code in updated-tricks-robux-generator-free_2023-ss1nujjg-pba (npm)

The package updated-tricks-robux-generator-free2023-ss1nujjg-pba was found to contain malicious code...

Malicious code in updated-tricks-robux-generator-free_2023-ss1nujjg-ftr (npm)

The package updated-tricks-robux-generator-free2023-ss1nujjg-ftr was found to contain malicious code...

MAL-2025-37903 Malicious code in updated-tricks-roblox-robux-generator-2023-get-verify_wrhzdu (npm)

The package updated-tricks-roblox-robux-generator-2023-get-verifywrhzdu was found to contain malicious code...

MAL-2025-20933 Malicious code in free-codes-fortnite-2023-for-free-updated-tricks (npm)

The package free-codes-fortnite-2023-for-free-updated-tricks was found to contain malicious code...

Malicious code in updated-tricks-v-bucks-generator-free_2023-08ivy7m1f (npm)

The package updated-tricks-v-bucks-generator-free2023-08ivy7m1f was found to contain malicious code...

MAL-2025-37905 Malicious code in updated-tricks-robux-generator-free_2023-ss1nujjg-pba (npm)

The package updated-tricks-robux-generator-free2023-ss1nujjg-pba was found to contain malicious code...

MAL-2025-37907 Malicious code in updated-tricks-v-bucks-generator-free_2023-bbi7zrezw (npm)

The package updated-tricks-v-bucks-generator-free2023-bbi7zrezw was found to contain malicious code...

CVE-2025-30027

CVE-2025-30027 affects Axis devices via insufficient input validation in ACAP configuration files, enabling arbitrary code execution. Exploitation requires the device to allow unsigned ACAP apps and a user to install a malicious ACAP application. Impact: high on confidentiality, integrity, and av...

Webinar: How to Stop Python Supply Chain Attacks—and the Expert Tools You Need

Python is everywhere in modern software. From machine learning models to production microservices, chances are your code—and your business—depends on Python packages you didn’t write. But in 2025, that trust comes with a serious risk. Every few weeks, we’re seeing fresh headlines about malicious...

git: Git does not sanitize URLs when asking for credentials interactively

A flaw was found in Git. This vulnerability occurs when Git requests credentials via a terminal prompt, for example, without the use of a credential helper. During this process, Git displays the host name for which the credentials are needed, but any URL-encoded parts are decoded and displayed...

⚡ Weekly Recap: Chrome 0-Day, 7.3 Tbps DDoS, MFA Bypass Tricks, Banking Trojan and More

Not every risk looks like an attack. Some problems start as small glitches, strange logs, or quiet delays that don’t seem urgent—until they are. What if your environment is already being tested, just not in ways you expected? Some of the most dangerous moves are hidden in plain sight. It’s worth...

CVE-2024-56279

Server-Side Request Forgery SSRF vulnerability in mra13 Compact WP Audio Player compact-wp-audio-player allows Server Side Request Forgery.This issue affects Compact WP Audio Player: from n/a through = 1.9.14...

CVE-2023-22691

Cross-Site Request Forgery CSRF vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin = v2.1 versions...

CVE-2023-22685

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin = v2.2 versions...

CVE-2023-48286

Missing Authorization vulnerability in mra13 Stripe Payments stripe-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stripe Payments: from n/a through = 2.0.79...

CVE-2022-47163

Cross-Site Request Forgery CSRF vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress plugin = 2.6 versions...

New Android Trojan Crocodilus Abuses Accessibility to Steal Banking and Crypto Credentials

Cybersecurity researchers have discovered a new Android banking malware called Crocodilus that's primarily designed to target users in Spain and Turkey. "Crocodilus enters the scene not as a simple clone, but as a fully-fledged threat from the outset, equipped with modern techniques such as remot...

The Rise of QR Phishing: How Scammers Exploit QR Codes and How to Stay Safe

QR phishing is on the rise, tricking users into scanning malicious QR codes. Learn how cybercriminals exploit QR codes and how to protect yourself...

Windows Exploitation Tricks: Trapping Virtual Memory Access (2025 Update)

Posted by James Forshaw, Google Project Zero Back in 2021 I wrote a blog post about various ways you can build a virtual memory access trap primitive on Windows. The goal was to cause a reader or writer of a virtual memory address to halt for a significant e.g. 1 or more seconds amount of time,...

CVE-2025-24663 WordPress Simple Download Monitor plugin <= 3.9.25 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in mra13 Simple Download Monitor simple-download-monitor allows Blind SQL Injection.This issue affects Simple Download Monitor: from n/a through = 3.9.25...