WordPress AI Engine plugin 3.3.3-3.7.2 - 3.7.1 - Subscriber+ Arbitrary File Read vulnerability

WordPress AI Engine plugin 3.3.3-3.7.2 - 3.7.1 - Subscriber+ Arbitrary File Read vulnerability discovered by Jashid Sany in WordPress Plugin AI Engine versions 3.3.3-3.7.1...

CVE-2018-16373

creationtimestamp| type| source ---|---|--- 2026-08-27 12:00:11+00:00| seen| Telegram/SVZvTdeqqmSRakJEIQhn4CjyThzPklzbZgbnjRRXOSeUVHM 2026-08-28 00:00:55+00:00| seen| Telegram/SVZvTdeqqmSRakJEIQhn4CjyThzPklzbZgbnjRRXOSeUVHM 2026-08-29 00:00:15+00:00| published-proof-of-concept|...

CVE-2026-81277

Contributor SQL Injection in Suggestion Engine for WooCommerce = 2.0.11 versions...

CVE-2026-81277 WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability

Contributor SQL Injection in Suggestion Engine for WooCommerce = 2.0.11 versions...

EUVD-2026-66954

Contributor SQL Injection in Suggestion Engine for WooCommerce = 2.0.11 versions...

CVE-2026-81277

Contributor-level SQL Injection vulnerability affects the Suggestion Engine for WooCommerce WordPress plugin in versions

CVE-2026-81277 WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability

Contributor SQL Injection in Suggestion Engine for WooCommerce = 2.0.11 versions...

WordPress AI Engine plugin < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription vulnerability

Subscriber+ Arbitrary File Read via Audio Transcription vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin AI Engine versions 3.6.6...

WordPress AI Engine plugin < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability

Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin AI Engine versions 3.6.4...

WordPress AI Engine plugin < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie vulnerability

Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin AI Engine versions 3.6.4...

Malicious code in @cortana-md/engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d849c8409247f2e6aa75683bf87afacaf8db81daded8235a622e952c94ccbb7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14553 Malicious code in @cortana-md/engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d849c8409247f2e6aa75683bf87afacaf8db81daded8235a622e952c94ccbb7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

SUSE CVE-2026-72475

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: Properly free struct axidmacdesc Use axidmacfreedesc to free fully the descriptor at fail path when call axidmacallocdesc in axidmacprepperipheraldmavec...

SUSE CVE-2026-78938

Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-78956

Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-75419

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...

CVE-2026-81277: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in Suggestion Engine for WooCommerce = 2.0.11 versions...

PT-2026-82473

Contributor SQL Injection in Suggestion Engine for WooCommerce = 2.0.11 versions...

CVE-2026-54718: Improper Neutralization of Special Elements Used in a Template Engine

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...

CVE-2026-75419

go-wind-cms (GoWind) before 1.0.0 suffers from a missing authorization flaw. The NewAuthorizer() function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine (noop.State{}), causing the authz middleware to always allow requests...