CVE-2026-65545

CVE-2026-65545 concerns the WordPress plugin AI Engine (versions

EUVD-2026-53975

Unauthenticated Cross Site Scripting XSS in AI Engine = 3.6.8 versions...

CVE-2026-65545 WordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in AI Engine = 3.6.8 versions...

WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Jamaal ahmed in WordPress Theme AI Hub versions = 1.3.10...

CVE-2026-19019

A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager.setupsessionpersistence of the file executor/app/core/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed fro...

CVE-2026-19019 poco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanup

A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager.setupsessionpersistence of the file executor/app/core/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed fro...

EUVD-2026-53818

A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager.setupsessionpersistence of the file executor/app/core/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed fro...

CVE-2026-16954

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

EUVD-2026-53726

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

CVE-2026-16954

The CVE concerns the AI Engine WordPress plugin prior to version 3.6.4. The vulnerability stems from not redacting secret configuration values before they are exposed in an admin page’s inline script data, enabling users with the Editor role to read stored third-party API keys and authentication ...

Important: Red Hat Security Advisory: RHTAS 1.4.3 - Tech Preview Release Of the Go based Model Transparency CLI

The Tech Preview release of the Go based RHTAS Model Transparency CLI image. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The Go based RHTAS Model Transparency CLI image can be used to sign and verify AI/M...

pentest-ai-agents v3.4.0

pentest-ai-agents 50 Claude Code subagents for penetration testing. Quick Start | Cheatsheet | Coverage | Agents | Examples Table of Contents What's New in v3.3 What's New in v3.2 Agent Map What's New in v3.1 Quick Start Cheatsheet Coverage Agents Tier 1 vs Tier 2 Examples Running Tools in a...

Shadow AI, Rogue Agents, and Data Leaks: A Special Report on Navigating AI Risk

Discover top enterprise AI risks — from shadow AI to rogue agents and data leaks — plus practical CISO strategies in the new Akamai SOTI special report...

Malicious code in opencode-engos-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42180a034d43d3c6d16e223fe6fcd93f6e403f0c73c763e9b21b6aded0545274 On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos---baseline-musl, resolves each to the...

MLflow AI Gateway permits SSRF through an unvalidated api_base

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

WordPress AI Copilot – Content Generator plugin <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kazuma Matsumoto in WordPress Plugin AIWU versions = 1.4.6...

MAL-2026-12043 Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...

CVE-2026-70492 Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Th...

CVE-2026-70484

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client-supplied imagegeneration flag and did not re-check the features.imagegeneration permission that the direct image routes and...

CVE-2026-69250

creationtimestamp| type| source ---|---|--- 2026-08-04 16:29:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6thxbosiashei 2026-08-04 16:35:29+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-r745-8hwv-h473 2026-08-07 14:03:17+00:00|...