CVE-2015-9501

CVE-2015-9501 affects the WordPress Artificial Intelligence theme up to version 1.2.3 (before 1.2.4). The root cause is Genericons HTML files being placed under the web root, enabling cross-site scripting (XSS). The vulnerability is a DOM/XSS class issue in the theme that can allow an attacker to...

CVE-2025-31678

The Drupal AI (Artificial Intelligence) module is vulnerable to a Missing Authorization issue (CWE-862), which enables Forceful Browsing . This vulnerability affects versions 0.0.0 through 1.0.2 . An unauthenticated network attacker can bypass authorization controls to access restricted content. ...

CVE-2025-31677

The Drupal AI (Artificial Intelligence) module is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in versions 1.0.0 through 1.0.1 . This flaw allows an attacker to trick an authenticated user into performing unintended actions on the web application without their consent. To remed...

CVE-2025-31692

The Drupal AI (Artificial Intelligence) component is vulnerable to OS Command Injection due to the improper neutralization of special elements used in an OS command. This flaw affects versions 0.0.0 through 1.0.4 . An attacker can exploit this vulnerability to execute arbitrary operating system c...

CVE-2025-31693

The Drupal AI (Artificial Intelligence) software is vulnerable to an OS Command Injection vulnerability (CWE-78) due to the improper neutralization of special elements used in an OS command. This flaw affects versions 0.0.0 through 1.0.4 . Successful exploitation could allow an attacker to execut...

CVE-2026-13235

The Drupal AI (Artificial Intelligence) module is vulnerable to a Missing Authorization flaw, which allows for Forceful Browsing . The root cause is that certain Drupal core actions, when exposed as agent tools, lack correct access validation, and some core actions are missing associated access-l...

CVE-2026-13236

The Drupal AI Agents module (versions 0.0.0–1.1.4, 1.2.0–1.2.5, and 1.3.0–1.3.1) contains a missing authorization (CWE-863) vulnerability that enables Forceful Browsing . The root cause is that the module fails to sufficiently check required permissions when a tool loads content entities. An atta...

CVE-2026-13234

The Drupal AI module and its submodules (AI Automators , AI Translate , AI API Explorer , and AI Content Suggestions ) are vulnerable to Cross-Site Scripting (XSS) and potential information disclosure . The root cause is the improper neutralization of input during the rendering of HTML or Markdow...

CVE-2026-13237

The Drupal AI Agents module (specifically versions 0.0.0 to 1.1.4 , 1.2.0 to 1.2.5 , and 1.3.0 to 1.3.1 ) is vulnerable to an Incorrect Authorization issue. The root cause is that, under certain circumstances, an agent may inherit deterministic parameters when invoking the same tool within a sing...

CVE-2026-3573

The Drupal AI (Artificial Intelligence) module and its submodules (AI Automators , AI Translate , AI API Explorer , and AI Content Suggestions ) are vulnerable to an Incorrect Authorization issue. This flaw allows for Resource Injection , where rendering generated HTML or Markdown in a browser ca...

CVE-2025-13981

The Drupal AI (Artificial Intelligence) module is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The root cause is the module's failure to sufficiently filter responses from Large Language Model (LLM) providers. An attacker can leverag...