CVE-2026-75798 AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant

The AI Engine WordPress plugin (versions 3.4.0 – 3.7.1 ) contains an authorization flaw in its Editor Assistant feature. The administration-only endpoint does not verify user privileges, instead relying on a token that is distributed to anonymous visitors. This allows an unauthenticated attacker ...

CVE-2026-21836 HCL DominoIQ is affected by broken access control

The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability. Under certain circumstances, document level access restrictions will be ignored when determining what data to return from an AI query. This could enable an authenticated attacker to view sensitive data...

CVE-2024-3403

imartinez/privategpt version 0.2.0 is vulnerable to a local file inclusion vulnerability that allows attackers to read arbitrary files from the filesystem. By manipulating file upload functionality to ingest arbitrary local files, attackers can exploit the 'Search in Docs' feature or query the AI...