Vulnerabilities & Threats

Subscribe to hear about critical security incidents

We'll send you updates on incidents as and when they happen

Featured

August 28, 2026

Popular code generator for TanStack Query hit by supply chain worm

A supply chain worm was found hiding in @7nohe/openapi-react-query-codegen, a popular code generator for TanStack Query, stealing credentials and spreading itself to every package the victim maintains.

#Malware

August 4, 2026

Keyv and friends compromised in active Shai-Hulud supply chain attack

Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub account

#Malware

July 31, 2026

Anthropic's Fever Dream: Claude's package that stole real keys

Anthropic disclosed an agent that pushed real malware to PyPI. We think we found the package, and every mistake in it points back to the AI.

#AI

#AI Safety

#Malware

Subscribe to our newsletter.
No spam, guaranteed.

October 17, 2023

What is a CVE?

What is a CVE? Common vulnerabilities and exposures database inform devs and security teams about past threats. CVSS scores report the severity of a CVE.

Tags/

#Vulnerabilities

#AI

#open-source

September 27, 2023

Top 3 web application security vulnerabilities in 2024

Learn about the most common and critical web application security vulnerabilities in 2024. Covers SAST, DAST, and CSPM vulnerabilities. And how to fix them.

Tags/

#Vulnerabilities

#AppSec

July 12, 2023

What is OWASP Top 10?

What is OWASP Top 10? Learn about the importance of the OWASP Top 10 in building a secure, compliant, and trustworthy web application.

Tags/

#OWASP

#Vulnerabilities

Roundcube XSS chained with cookie tossing for full inbox access

We found a stored XSS in Roundcube's draft attachment endpoint that, chained with a cookie tossing technique, gives an attacker full access to a victim's inbox. Here's how the exploit chain works and how it was patched

Tags/

No items found.