redamon

Unmask the hidden before the world does An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing code fixes, and opening pull requests on your repository. From first packet to merge...

CVE-2026-107745

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the uploadfile function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with...

EUVD-2026-111565

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the uploadfile function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with...

EUVD-2026-90465

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...

PT-2026-103667

Name of the Vulnerable Software and Affected Versions The AI Engine – The Chatbot, AI Framework & MCP for WordPress versions prior to 3.8.1 Description Stored Cross-Site Scripting occurs due to a chain of missing input neutralization and output escaping. An unauthenticated caller can bypass the...

CVE-2026-89141: Authorization Bypass Through User-Controlled Key

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-15988: Cross-Site Request Forgery (CSRF)

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauthforauthorize function. This makes it possible for...

redamon v6.2.5

Unmask the hidden before the world does An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing code fixes, and opening pull requests on your repository. From first packet to merge...

CVE-2026-8719: Improper Privilege Management

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid OAuth token causes MCP access to be...

Cybersecurity AI (CAI) Framework 0.5.10 - Command Injection

Exploit Title: Cybersecurity AI CAI Framework 0.5.10 - Command Injection CVE: CVE-2026-25130 Date: 2026-02-03 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity Author GitHub: https://github.com/yourusername Vendor Homepage:...

Multimodal Message Handler SSRF

The vulnerability of the Multimodal Message Handler component in the Spring AI development framework relates to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

Spring AI MariaDBFilterExpressionConverter SQL Injection

The vulnerability of the MariaDBFilterExpressionConverter component in the Spring AI development framework relates to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...

Griptape path traversal vulnerability

Griptape is an open-source generative AI application development framework created by Griptape. Version 0.19.4 of Griptape contains a path traversal vulnerability, which stems from incorrect handling of the parameter filename, potentially leading to path traversal attacks...

claude-bug-bounty

Claude Bug Bounty Hunter The AI-native bug bounty framework...

PT-2026-21491

Name of the Vulnerable Software and Affected Versions datapizza-labs datapizza-ai version 0.0.2 Description A flaw exists in the Jinja2 Template Handler component of datapizza-ai. Specifically, the ChatPromptTemplate function within the datapizza-ai-core/datapizza/modules/prompt/prompt.py file is...

CVE-2026-1400: Unrestricted Upload of File with Dangerous Type

The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the resthelpersupdatemediametadata function in all versions up to, and including, 3.3.2. This makes it possible for authenticated attacker...

redamon

Unmask the hidden before the world does An autonomous AI fra...

EUVD-2024-2703

Malicious code in bioql PyPI...

Intel AI for Enterprise Retrieval-augmented Generation Search Path Uncontrolled Vulnerability

Intel AI for Enterprise Retrieval-augmented Generation is a technology framework for enhancing the accuracy and relevance of Large Language Model LLM responses by incorporating an external knowledge base. An uncontrolled search path vulnerability exists in Intel AI for Enterprise...

This Week in Spring - June 24th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! We're in the middle of June already! And you know what that means? Warm weather, fun, and of course: the amazing SpringOne event in lovely Las Vegas, NV! The content catalog went live today! I'll be there doing, among other...