PT-2026-69157

Name of the Vulnerable Software and Affected Versions Kakoune versions prior to 2026.05.21 Description The bundled autorestore.kak script, which is enabled by default, allows the execution of arbitrary shell and editor commands when a user opens a file if malicious backup files are present...

CVE-2026-19059

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulation causes path traversal. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendo...

CVE-2026-19059

FoundationAgents MetaGPT (up to version 0.8.2) contains a path traversal flaw in metagpt/tools/libs/editor.py: the read function is vulnerable, enabling local attackers to traverse the filesystem. The issue is local-access, with a publicly disclosed exploit. Vendor contact about the disclosure oc...

CVE-2026-19059 FoundationAgents MetaGPT editor.py read path traversal

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulation causes path traversal. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendo...

CVE-2026-66440

Unauthenticated Cross Site Scripting XSS in WPIDE – File Manager & Code Editor = 3.5.7 versions...

CVE-2026-28183

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

EUVD-2026-53882

Unauthenticated Cross Site Scripting XSS in WPIDE – File Manager & Code Editor = 3.5.7 versions...

CVE-2026-66440 WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPIDE – File Manager & Code Editor = 3.5.7 versions...

CVE-2026-66440

The CVE-2026-66440 entry documents an Unauthenticated Cross-Site Scripting (XSS) vulnerability in the WPIDE – File Manager & Code Editor WordPress plugin up to version 3.5.7. Affected component is the plugin’s WPIDE File Manager/Code Editor functionality; the flaw is an XSS issue exploitable with...

CVE-2026-28183

...

CVE-2026-28183

This CVE ID is rejected/not used and does not represent an active vulnerability entry.

EUVD-2026-53953

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-16065

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...

CVE-2026-16954

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

CVE-2026-16065

CVE-2026-16065 affects the Welcart e-Commerce WordPress plugin prior to 2.11.32. The issue is a lack of sanitisation of a value from an imported CSV file used in a SQL statement, enabling SQL injection by users with Editor role or higher (including custom shop-management roles). Reported CVSSv3.1...

EUVD-2026-53731

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...

CVE-2026-16065 Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...

EUVD-2026-53726

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

CVE-2026-16954 AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

CVE-2026-16954

The CVE concerns the AI Engine WordPress plugin prior to version 3.6.4. The vulnerability stems from not redacting secret configuration values before they are exposed in an admin page’s inline script data, enabling users with the Editor role to read stored third-party API keys and authentication ...