CVE-2026-87936

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3...

CVE-2026-87936 amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3...

EUVD-2026-107865

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3...

CVE-2026-87936 amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3...

CVE-2026-87936

The Drupal amazee.ai Private AI Provider module (versions 0.0.0 to 1.3.7 and 1.4.0 to 1.4.3 ) is vulnerable to SQL Injection due to improper sanitization of filter values used to build queries in its Postgres/pgvector vector database backend. This occurs when a site uses this backend for a Search...

CVE-2026-87936 amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3...

Drupal amazee.ai Private AI Provider SQL injection vulnerability

Drupal amazee.ai Private AI Provider versions prior to 0.0.0 and 1.3.7, as well as versions prior to 1.4.0 and 1.4.3, contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to SQL injection attacks...

OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys

An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key...

CVE-2026-59970 Tandoor Recipes: Blind SSRF via AI provider URL (api_base)

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space,...

CVE-2026-59970 Tandoor Recipes: Blind SSRF via AI provider URL (api_base)

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space,...

CVE-2026-59970

Prior to version 2.6.10 , Tandoor Recipes is vulnerable to a Blind Server-Side Request Forgery (SSRF) via the AI provider URL (api_base ). An authenticated user can configure an AI provider with a URL targeting internal addresses; when an AI action is invoked, the application passes this URL to L...

CVE-2026-59970: Server-Side Request Forgery (SSRF)

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space,...

EUVD-2026-102435

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents...

CVE-2026-105039

EnergizeLab station-middleware (NestJS) Docker images versions 1.6.5 through 1.8.2 are vulnerable to a Missing Authorization (CWE-862) flaw. The application fails to perform role checks on administrative APIs, allowing any authenticated low-privilege user to perform unauthorized actions. Attacker...

CVE-2026-105039 EnergizeLab Station Middleware Admin APIs Missing Role Checks

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents...

CVE-2026-105039 EnergizeLab Station Middleware Admin APIs Missing Role Checks

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents...

PT-2026-115226

Name of the Vulnerable Software and Affected Versions EnergizeLab station-middleware NestJS Docker images versions 1.6.5 through 1.8.2 Description Insufficient authorization checks on administrative APIs allow authenticated users with low privileges to perform unauthorized actions. This includes...

CVE-2026-105039: Missing Authorization

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents...

EnergizeLab station-middleware authorization issue vulnerability

The EnergizeLab station-middleware versions 1.6.5 to 1.8.2 have authorization-related vulnerabilities. This issue arises from the management API not checking user roles, which may allow any authenticated, low-privilege user to obtain AI provider keys and alter configuration settings as well as...

CVE-2026-110208 Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys

Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to...