8438 matches found
CVE-2026-16955 AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription
The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at...
EUVD-2026-54745
The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at...
EUVD-2026-54744
The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delet...
PT-2026-69186
Name of the Vulnerable Software and Affected Versions AI Copilot – Content Generator versions prior to 1.5.7 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can achieve full site...
CVE-2026-47361
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...
CVE-2026-47361
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...
CVE-2026-47361
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...
CVE-2026-47361
Datadog’s Android app exposes BubbleChatActivity (android:exported="true") with no permission guard, accepts SEND intents with mimeType text/plain, and reads a conversation_id from extras. On destruction, BubbleChatNotification.dismiss unconditionally cancels a hard-coded Bits AI notification (ID...
CVE-2026-47361
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...
EUVD-2026-54567
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...
EUVD-2026-54565
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...
MAL-2026-13520 Malicious code in @aster110/cc2wechat (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac The package runs a daemon that long-polls Tencent's iLink Bot API ilinkai.weixin.qq.com for incoming WeChat messages and forwards each message body...
Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.
Summary Maximo AI Service uses micrometer-core-1.15.11.jar, spring-core-6.2.18.jar, spring-security-web-6.5.10.jar, spring-data-commons-3.5.11.jar, spring-webmvc-6.2.18.jar, spring-expression-6.2.18.jar and spring-security-config-6.5.10.jar which are vulnerable to CVE-2026-40983, CVE-2026-40984,...
SecureAI-Scan v0.8.0
SecureAI-Scan The AI security scanner that proves its findings. SecureAI-Scan finds LLM, MCP, Agent Skill, and RAG vulnerabilities in TypeScript, JavaScript, and Python — and shows you the evidence: the exact source → flow → sink path for every dataflow finding, resolved through real imports, not...
Important: Red Hat Security Advisory: RHEL AI 3.4 RPM runtime CVE fix - aom
AIPCC Security Alerts identified CVEs in the 3.4 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...
CVE-2026-65545
Unauthenticated Cross Site Scripting XSS in AI Engine = 3.6.8 versions...
Important: Red Hat Security Advisory: RHEL AI 3.3 RPM runtime CVE fix - aom
AIPCC Security Alerts identified CVEs in the 3.3 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...
CVE-2026-65581
Unauthenticated PHP Object Injection in AI ANN = 1.29.0 versions...
CVE-2026-65581
The CVE-�2026-65581 entry concerns the WordPress AI ANN theme (<= 1.29.0) and describes an unauthenticated PHP Object Injection vulnerability. The connected documents corroborate the affected product and version range, with a focus on PHP object injection as the underlying issue. There are no ...