8625 matches found
CVE-2026-73037 Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter
Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...
CVE-2026-73037
Summary: CVE-2026-73037 affects Next AI Draw.io versions 0.2.1–0.4.16. The issue is a reflected XSS vulnerability in the mcp query parameter, which is interpolated into HTML/JavaScript without proper escaping. Impact (as stated): Attackers can craft malicious URLs to execute arbitrary JavaScript ...
What 50 open source projects taught us about security in the AI era
AI is changing the pace of open source development and the security challenges that come with it. Maintainers are reviewing unfamiliar contributions, managing new attack surfaces, and responding to vulnerabilities with limited time and resources. Session 4 of the GitHub Secure Open Source Fund...
Malicious code in ai-analyzer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8949a02ffb1efc0779485ac4daedb4c0c1810f0a1a87dc5ba60c6f72c6e1cf22 The preinstall lifecycle script in preinstall.js issues an HTTPS request whose hostname is constructed as os.hostname prefixed to a hardcoded...
MAL-2026-13934 Malicious code in ai-analyzer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8949a02ffb1efc0779485ac4daedb4c0c1810f0a1a87dc5ba60c6f72c6e1cf22 The preinstall lifecycle script in preinstall.js issues an HTTPS request whose hostname is constructed as os.hostname prefixed to a hardcoded...
CVE-2026-66469
Unauthenticated Broken Access Control in Arvow AI SEO Writer = 1.5.3 versions...
CVE-2026-66459
Unauthenticated Broken Access Control in AI for SEO = 2.4.2 versions...
CVE-2026-65582
Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...
EUVD-2026-50562
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials...
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...
GHSA-H7P7-W5GC-XJ3W Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...
EUVD-2026-57888
Unauthenticated Broken Access Control in Arvow AI SEO Writer = 1.5.3 versions...
CVE-2026-66469 WordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Arvow AI SEO Writer = 1.5.3 versions...
CVE-2026-66469
Unauthenticated Broken Access Control in Arvow AI SEO Writer = 1.5.3 versions...
CVE-2026-66469
The CVE-2026-66469 entry concerns Unauthenticated Broken Access Control in WordPress plugin Arvow AI SEO Writer (versions
CVE-2026-66459 WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in AI for SEO = 2.4.2 versions...
CVE-2026-66459
CVE-2026-66459 concerns the WordPress plugin AI for SEO, affected versions
CVE-2026-66459
Unauthenticated Broken Access Control in AI for SEO = 2.4.2 versions...