10252 matches found
CVE-2026-15241
The AI ChatBot for WooCommerce (also known as WoowBot ) WordPress plugin, in versions before 4.8.4 , is vulnerable to unauthenticated Gemini API key abuse . The root cause is a lack of authorization and nonce checks on the qcld_gemini_response AJAX action. An unauthenticated attacker can exploit ...
CVE-2026-15241
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...
EUVD-2026-51934
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...
PT-2026-67065
Name of the Vulnerable Software and Affected Versions AI ChatBot for WooCommerce versions prior to 4.8.4 Description An issue exists where the plugin fails to perform authorization or nonce checks on an AJAX action. This allows unauthenticated users to abuse the site owner's stored third-party AP...
July 28, 2026âKB5101681 (OS Build 28000.2608) Preview
None None...
EUVD-2026-42628
Open WebUI: Upload metadata.knowledgeid bypasses the knowledge-base write-access check read-only users can add files to KB...
GHSA-7R7X-GJVR-448G Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
Open WebUI upload metadata can add files to knowledge bases without write permission Summary Open WebUI's file upload background processing trusts the client-supplied metadata.knowledgeid value and inserts a knowledgefile association before validating that the uploading user has write access to t...
Incorrect Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization in the processuploadedfile process. An attacker can modify the file membership of a knowledge base without proper authorization by supplying a crafted metadata.knowledgeid value during...
Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
Open WebUI upload metadata can add files to knowledge bases without write permission Summary Open WebUI's file upload background processing trusts the client-supplied metadata.knowledgeid value and inserts a knowledgefile association before validating that the uploading user has write access to t...
Ethereum NFT Smart Contracts: Knowledge-Guided Vulnerability Detection with LLM and Code Slicing
Ethereum non-fungible tokens NFTs implement ownership, transfer, authorization, and metadata operations through smart contracts, making contract vulnerabilities a direct risk to digital assets. Existing static analyzers provide efficient rule-based screening but can struggle with...
CVE-2026-65522
Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65500
Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
EUVD-2026-48124
Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65522
The CVE-2026-65522 entry documents a Cross Site Scripting (XSS) vulnerability in the WordPress Manual theme (Documentation, Knowledge Base & Education WordPress Theme) up to version 7.5.4. The description specifies XSS in versions
EUVD-2026-48117
Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65511
Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65500
Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability
WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme = 7.5.4 - Cross Site Scripting XSS vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...
PT-2026-63934
Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65511: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...