CVE-2026-15245 BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...

CVE-2026-15245 BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...

CVE-2026-15245

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...

CVE-2026-46358: Insertion of Sensitive Information into Log File

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to...

CVE-2026-67422

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors caret, tilde, betterem, and magiclink use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways,...

CVE-2026-67422

CVE-2026-67422 affects pymdown-extensions up to version 11.0, where four inline processors—caret, tilde, betterem, and magiclink—use regex patterns whose groups can partition delimiter runs in exponentially many ways. This causes catastrophic backtracking and unbounded CPU usage when rendering a ...

CVE-2026-67422

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors caret, tilde, betterem, and magiclink use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways,...

CVE-2026-67422 pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors caret, tilde, betterem, and magiclink use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways,...

CVE-2026-67422 pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors caret, tilde, betterem, and magiclink use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways,...

CVE-2026-16954

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

EUVD-2026-53726

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

CVE-2026-16954

The AI Engine WordPress plugin (versions prior to 3.6.4 ) contains a sensitive information disclosure vulnerability. The plugin fails to redact secret configuration values before exposing them within an admin page's inline script data . This flaw allows users with the Editor role to read stored t...

CVE-2026-16954

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

GHSA-9PF5-HG6P-4PWP Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

Impact For serial-port and media camera / microphone permission checks made from an iframe, the requestingOrigin passed to session.setPermissionCheckHandler was the top-level frame's origin rather than the requesting frame's. Origin-based handler logic could therefore grant a cross-origin iframe...

CVE-2026-6972

The CVE-2026-6972 entry concerns the SKT Skill Bar WordPress plugin (

GHSA-6XHV-RXHV-PWM4 Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Summary Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model. The knowledge attached to such an inline model was used as-is, without checking that the caller can read what it points at. Any authenticated user who knows another user's file i...

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Summary Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model. The knowledge attached to such an inline model was used as-is, without checking that the caller can read what it points at. Any authenticated user who knows another user's file i...

CVE-2026-67618

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious baseurl in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own setting...

PYSEC-2026-3574 gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

Summary consultgeminiwithfiles in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip and...

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

Summaryconsultgeminiwithfiles in inline mode read any file path supplied inthe files argument without confining it to the working directory, thenforwarded the contents to the Gemini CLI. Because the caller also controlsquery, the file contents are echoed back through the Gemini round-tripand sent...