CVEs we hold for Ai
Records whose assigning authority named Ai as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-9810AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuthUnknown AI Copilot
CVE-2026-86670aircheng-org iWebShop-5 Authentication Storage admin.php weak password hashaircheng-org iWebShop-5
CVE-2026-86669aircheng-org iWebShop-5 systemseller.php login improper authenticationaircheng-org iWebShop-5
CVE-2026-86668aircheng-org iWebShop-5 pic.php uploadFile cross site scriptingaircheng-org iWebShop-5
CVE-2026-8617SearchPlus <= 1.7.1 - Missing Authorization to Unauthenticated Settings Modification and Deletion via…ailchev SearchPlus
CVE-2026-85678AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScriptUnknown AI Builder
CVE-2026-84431AirAsia MOVE App com.airasia.mobile com.airasia.core.utils.RealPathUtil.getRealPath path traversalAirAsia MOVE App
CVE-2026-8319aiwaves-cn agents cheshire_cat_core stray_cat.py recall_relevant_memories_to_working_memory resource consumptionaiwaves-cn agents
CVE-2026-82923AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST RoutesUnknown AI Website Builder (GitHub build)
CVE-2026-81101Airtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpointairtable-mcp-cli
CVE-2026-80049Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceIdairbytehq airbyte-platform
CVE-2026-76164Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resourcesail-project ail-framework
CVE-2026-75798AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor AssistantUnknown AI Engine
CVE-2026-75797AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' ParameterUnknown AI Engine
CVE-2026-75796AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User ToolsUnknown AI Engine
CVE-2026-71447Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-frameworkail-project ail-framework
CVE-2026-71446Stored Cross-Site Scripting in AIL Framework Domain Screenshot Viewail-project ail-framework
CVE-2026-71445Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-frameworkail-project ail-framework
CVE-2026-71264WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock StateAircoookie WLED
CVE-2026-69702SnailJob 1.7.0 Denial of Service via FuryUtil.deserialize OOMaizuda SnailJob (snail-job)
CVE-2026-69244AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)aio-libs aiohttp
CVE-2026-65883Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0aimy-extensions.com Aimy Captcha-Less Form Guard plugin for…
CVE-2026-59881AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflateaio-libs aiohttp
CVE-2026-59510Authenticated Path Traversal in AIL Framework PDF Object Handling Enables Potential Arbitrary File Readail-project ail-framework
CVE-2026-56450AIL Framework - Missing Rate Limiting Enables Brute-Force Attacks Against Two-Factor Authentication Codesail framework
CVE-2026-56448Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Readail framework
CVE-2026-56138Authenticated Path Traversal in AIL framework /objects/item/diff Allows Reading Gzip-Compressed Filesail-project ail-framework
CVE-2026-54280AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnectaio-libs aiohttp
CVE-2026-54279AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistenceaio-libs aiohttp
CVE-2026-54278AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanupaio-libs aiohttp
CVE-2026-54276AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challengesaio-libs aiohttp
CVE-2026-54275AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connectionsaio-libs aiohttp
CVE-2026-49262Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxyaimeos pagible
CVE-2026-44483RVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)airjp73 rvf; @rvf set-get
CVE-2026-39961Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSourceaiven-operator
CVE-2026-39416Stored XSS in modal item preview for long item content in AIL Frameworkail-project ail-framework
CVE-2026-34520AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection /…aio-libs aiohttp
CVE-2026-34518AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirectaio-libs aiohttp
CVE-2026-34517AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoSaio-libs aiohttp
CVE-2026-34515AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windowsaio-libs aiohttp
CVE-2026-34514AIOHTTP: CRLF injection in multipart part content type header constructionaio-libs aiohttp
CVE-2026-34513AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnectoraio-libs aiohttp
CVE-2026-33308mod_gnutls missing key purpose check in client certificate verificationairtower-luna mod_gnutls
CVE-2026-33307mod_gnutils has stack-based buffer overflow caused by a long client certificate chainairtower-luna mod_gnutls
CVE-2026-27338WordPress Car Zone theme <= 3.7 - Deserialization of untrusted data vulnerabilityAivahThemes Car Zone
CVE-2026-23529Arbitrary File Read in Google BigQuery Sink connectorAiven-Open bigquery-connector-for-apache-kafka
CVE-2026-22815AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headersaio-libs aiohttp
CVE-2026-16955AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio TranscriptionUnknown AI Engine
CVE-2026-16954AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer TokensUnknown AI Engine
CVE-2026-16953AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session CookieUnknown AI Engine
CVE-2026-15241ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_responseUnknown AI ChatBot for WooCommerce
CVE-2026-15193AidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injectionAidanPark openclaw-android
CVE-2026-14748AIAnytime Awesome-MCP-Server mcp-wiki/wiki-summary server.py server-side request forgeryAIAnytime Awesome-MCP-Server
CVE-2026-13493AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injectionAIDC-AI ComfyUI-Copilot
CVE-2026-12510AI Engine < 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDORUnknown AI Engine
CVE-2026-12106Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tagsairani Auto Upload Images
CVE-2026-1103AIKTP <= 5.0.04 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator ActionsAIKTP
CVE-2026-10531AI Share & Summarize < 2.0.4 - Contributor+ Stored XSS via title_style Shortcode AttributeUnknown AI Share & Summarize
CVE-2026-10177Aider-AI Aider AWS EC2 Metadata Endpoint api_docs.py requests.get server-side request forgeryAider-AI Aider
CVE-2025-8064Bible SuperSearch <= 6.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via selector_height Parameteraicwebtech Bible SuperSearch
CVE-2025-7024Local privilege escalation in Windows Server OS through installed Tetra Connectivity Server (TCS)AIRBUS TETRA Connectivity Server (TCS)
CVE-2025-69226AIOHTTP allows for a brute-force leak of internal static filepath componentsaio-libs aiohttp
CVE-2025-69224AIOHTTP's Unicode processing of header values could cause parsing discrepanciesaio-libs aiohttp
CVE-2025-69223AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bombaio-libs aiohttp
CVE-2025-69139WordPress Car Zone theme <= 3.7 - Arbitrary File Deletion vulnerabilityAivahThemes Car Zone
CVE-2025-68907WordPress Hostme v2 theme <= 7.0 - Arbitrary File Deletion vulnerabilityAivahThemes Hostme v2
CVE-2025-67962WordPress Broken Link Checker plugin <= 1.2.6 - SQL Injection vulnerabilityAIOSEO Plugin Team Broken Link Checker
CVE-2025-67931WordPress BulletProof Security plugin <= 6.9 - Sensitive Data Exposure vulnerabilityAITpro BulletProof Security
CVE-2025-67721Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output bufferairlift aircompressor
CVE-2025-66562TUUI vulnerable to Remote Code Execution (RCE) via XSS in Markdown ECharts RenderingAI-QL tuui
CVE-2025-66468Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editorsaimeos ai-cms-grapesjs
CVE-2025-62979WordPress ACF to REST API plugin <= 3.3.4 - Sensitive Data Exposure vulnerabilityairesvsg ACF to REST API
CVE-2025-62611aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL serveraio-libs aiomysql
CVE-2025-58829WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin <= 2.3.3 - Server Side…aitool Ai Auto Tool Content Writing Assistant (Gemini…
CVE-2025-55283aiven-db-migrate allows Privilege Escalation through use of psql during migrationaiven-db-migrate
CVE-2025-55282aiven-db-migrate allows Privilege Escalation via unrestricted search_path during migrationaiven-db-migrate
CVE-2025-54409AIDE null pointer dereference when reading incorrectly encoded xattr attributes from database (local DoS)aide
CVE-2025-53643AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sectionsaio-libs aiohttp
CVE-2025-5321aimhubio aim run_view Object query.py RestrictedPythonQuery privilege escalationaimhubio aim
CVE-2025-31564WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin <= 2.2.6 - SQL Injection…aitool Ai Auto Tool Content Writing Assistant (Gemini…
CVE-2025-31480aiven-extras allows PostgreSQL Privilege Escalation through format functionaiven-extras
CVE-2025-2622aizuda snail-job Workflow-Task Management Module check-node-expression getRuntime deserializationaizuda snail-job
CVE-2025-22297WordPress AI WP Writer plugin <= 3.8.4.4 - Cross Site Request Forgery (CSRF) vulnerabilityaipost AI WP Writer
CVE-2025-2208aitangbao springboot-manager Filename upload cross site scriptingaitangbao springboot-manager
CVE-2025-2206aitangbao springboot-manager permission cross site scriptingaitangbao springboot-manager
CVE-2025-14674aizuda snail-job QLExpressEngine.java QLExpressEngine.doEval injectionaizuda snail-job
CVE-2025-1264Broken Link Checker by AIOSEO <= 1.2.3 - Authenticated (Contributor+) SQL InjectionAIOSEO – Easily Fix/Monitor Internal and External links
CVE-2025-12156Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One 2.0.7 - 2.2.6 - Missing Authorization to…aitool Ai Auto Tool Content Writing Assistant (Gemini…
CVE-2025-12030ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option…airesvsg ACF to REST API
CVE-2025-11734Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links <= 1.2.5 - Missing Authorization to…AIOSEO – Easily Fix/Monitor Internal and External links
CVE-2025-0329AI ChatBot for WordPress – WPBot < 6.2.4 - Admin+ Stored XSSUnknown AI ChatBot for WordPress
CVE-2024-8863aimhubio aim Text Explorer textbox.tsx dangerouslySetInnerHTML cross site scriptingaimhubio aim
CVE-2024-7714AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX CallsUnknown AI ChatBot with ChatGPT and Content Generator by AYS
CVE-2024-7713AI Chatbot with ChatGPT by AYS <= 2.0.9 - Unauthenticated OpenAI Key DisclosureUnknown AI ChatBot with ChatGPT and Content Generator by AYS
CVE-2024-7408Information Disclosure Vulnerability in Airveda Air Quality MonitorAirveda Air Quality Monitor PM2.5 PM10
CVE-2024-54307WordPress AIcomments plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerabilityaipost AIcomments
CVE-2024-54306WordPress AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot plugin <= 1.6.2 - Cross Site Request Forgery…aitool AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best…
CVE-2024-52383WordPress Ai Auto Tool Content Writing Assistant plugin <= 2.1.2 - Broken Access Control vulnerabilityaitool Ai Auto Tool Content Writing Assistant (Gemini…
CVE-2024-52304aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensionsaio-libs aiohttp
CVE-2024-52303aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed methodaio-libs aiohttp
CVE-2024-47173Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setupsaimeos ai-admin-graphql
CVE-2024-42367In aiohttp, compressed files as symlinks are not protected from path traversalaio-libs aiohttp
CVE-2024-39325aimeos/ai-controller-frontend doesn't reset payment status in basketaimeos ai-controller-frontend
CVE-2024-39324aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own servicesaimeos ai-admin-graphql
CVE-2024-39323aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin accountaimeos ai-admin-graphql
CVE-2024-39322aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required recordsaimeos ai-admin-jsonadm
CVE-2024-39319aimeos/ai-controller-frontend has IDOR vulnerability in account profile pageaimeos ai-controller-frontend
CVE-2024-38516Aimeos HTML client may potentially reveal sensitive information in error logaimeos ai-client-html
CVE-2024-38363Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyteairbytehq airbyte
CVE-2024-37296Aimeos HTML client vulnerable to digital products download without proper payment status checkaimeos ai-client-html
200 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.