Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:ai_engine:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Ai Engine (f2c444f5-d558-5850-ba45-0dc9003d0aa1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-16954 |
vulnerable | 2026-09-16 04:32:57.083132 |
AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens
The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.
Published: 2026-08-06T06:00:10.802Z
Updated: 2026-08-06T14:27:40.015Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16955 |
vulnerable | 2026-09-16 04:32:56.952337 |
AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription
The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.
Published: 2026-08-08T06:00:13.729Z
Updated: 2026-08-11T19:40:52.619Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16953 |
vulnerable | 2026-09-16 04:32:56.618330 |
AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie
The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.
Published: 2026-08-08T06:00:13.553Z
Updated: 2026-08-11T19:39:59.256Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12511 |
vulnerable | 2026-07-29 00:23:32.393540 |
AI Engine < 3.5.5 - Editor+ Arbitrary File Write via Path Traversal
The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.
Published: 2026-07-14T06:00:02.489Z
Updated: 2026-07-14T12:59:54.068Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12510 |
vulnerable | 2026-07-29 00:23:32.393197 |
AI Engine < 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR
The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.
Published: 2026-07-16T06:00:03.590Z
Updated: 2026-07-16T15:33:27.561Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6723 |
vulnerable | 2026-06-08 06:58:20.253139 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6451 |
vulnerable | 2026-06-08 06:58:19.492821 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10499 |
vulnerable | 2026-06-08 06:23:46.790454 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.