40161 matches found
CVE-2026-16954
The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...
CVE-2026-16954
The AI Engine WordPress plugin (versions prior to 3.6.4 ) contains a sensitive information disclosure vulnerability. The plugin fails to redact secret configuration values before exposing them within an admin page's inline script data . This flaw allows users with the Editor role to read stored t...
EUVD-2026-53726
The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...
PT-2026-68707
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.109 Description An out of bounds write in V8, the open-source high-performance JavaScript and WebAssembly engine, allows a remote attacker to execute arbitrary code within a sandbox by inducing the us...
PT-2026-68713
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.109 Description An inappropriate implementation in the V8 engine allows a remote attacker to execute arbitrary code within a sandbox by inducing a user to visit a specially crafted HTML page. V8 is th...
PT-2026-69019
viperjs is a JavaScript engine intended to run untrusted script inside a host application, so script text is data rather than a trusted caller and a panic reachable from script is a denial of service in the embedder's process. A divisor whose magnitude lands exactly on the engine's internal limb...
CVE-2026-12501: Insufficient Verification of Data Authenticity
The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookin...
PT-2026-68639
Name of the Vulnerable Software and Affected Versions WP Travel Engine versions prior to 6.8.2 Description The plugin fails to verify if incoming PayPal payment notifications were sent to the configured merchant account or if the paid amount matches the order total before marking a booking as pai...
PT-2026-68627
Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2 Description An inefficient algorithmic complexity issue exists in the traversal engine. An unauthenticated remote attacker can exhaust server CPU and memory by providing a flat run of sibling...
PT-2026-68402
Name of the Vulnerable Software and Affected Versions AI Engine versions prior to 3.6.4 Description The AI Engine WordPress plugin fails to redact secret configuration values before exposing them within an admin page's inline script data. This allows users with the Editor role to access the site'...
CVE-2026-16954: Exposure of Sensitive Information to an Unauthorized Actor
The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...
CVE-2026-65545: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in AI Engine = 3.6.8 versions...
From Documentation to Zero-Day Vulnerabilities: LLM-Driven Fuzzing of JavaScript Engines in PDF Readers
Existing fuzzers for PDF readers rely on simple test cases that involve only individual API calls, leading to limited coverage and potentially missing vulnerabilities that require sequences of API calls. To address these limitations, we propose PDFuzzer, a novel PDF engine fuzzer that automatical...
Malicious code in multi-acct (npm)
Source: amazon-inspector 395e9271172eea5db15a1090043ee564ad6b8564fb9e267faff883ac3c6af125 [email protected] is a near-empty wrapper index.js is a two-line stub returning name/version literals; author is the generic 'Package Registry' and repository.url points at an example.com-style placeholder...
CVE-2026-18411
The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access...
EUVD-2026-53612
The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access...
CVE-2026-18411 Use of hard-coded cryptographic key in Acrisure KARR BT and DR-100
The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access...
CVE-2026-18411
The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access...
Malicious code in app-kst-engine (npm)
Source: amazon-inspector 08cfc426d2f4b29bba2b81f2eb56eeee32ab114338a51fae5eeced2571e6b2d9 On npm install, package.json's postinstall runs node test.js, which triggers three malicious paths against the installer. 1 A recursive scan of the current working directory collects files matching id.json,...
