CVE Vulnerability Catalog

In the Linux kernel on parisc, the default kernel stack size (THREAD_SIZE_ORDER) was increased to 32 kB for 64-bit kernels to avoid kernel panics caused by stack overflow, observed for example when building the debian vtk9 package with gcc 17.

An incomplete path traversal fix in pghoard, a PostgreSQL backup daemon, allows an attacker with write access to the backup object storage (S3, GCS, Azure) to write arbitrary files and create directories outside the PostgreSQL data directory. A malicious delta backup manifest with path traversal sequences can write arbitrary payloads to the host during a restore operation. The issue is patched in version 2.7.2.

In Heimdall, when trusted_proxies is configured, client IP addresses are extracted from Forwarded and X-Forwarded-For headers and exposed as Request.ClientIPAddresses without syntactic validation. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values are accepted, and the Forwarded header parser mishandles quoted strings, potentially parsing a single value as multiple entries. The issue is patched in version 0.17.17.

In Heimdall proxy mode, the Forwarded HTTP header is constructed by inserting the incoming Host header value without sanitizing commas or semicolons. An attacker can inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. The issue is patched in version 0.17.17.

In PraisonAI from version 4.5.115 to before 4.6.61, the documented CLI entrypoint still exposes A2U subscription and event routes without authentication. The CLI wrapper does not expose --api-key, does not install API-key middleware, and does not generate a token for A2U; if A2U_AUTH_TOKEN is missing, authentication is treated as disabled. The issue is patched in version 4.6.61.

In PraisonAI from version 4.5.110 to before 4.6.61, SandlockSandbox, intended as a kernel-enforced sandbox, does not fail closed when the optional sandlock module imports but reports Landlock unavailable. Its execute() and run_command() methods silently fall back to SubprocessSandbox, which does not enforce filesystem or network boundaries. The issue is patched in version 4.6.61.

In PraisonAI from version 4.5.87 to before 4.6.61, the dangerous-tool policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, workflow.yaml is loaded by YAMLWorkflowParser, which resolves agent-level tools and preserves top-level approve:, allowing an untrusted recipe to declare execute_command and self-approve it without allow_dangerous_tools=True. The issue is patched in version 4.6.61.

In praisonai-platform from version 0.1.4 to before 0.1.5, a workspace member can permanently delete any resource (projects, agents, issues, labels, issue dependencies, and issue-label attachments) created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. The issue is patched in version 0.1.5.

In PraisonAI versions 4.6.10 to before 4.6.59, the LocalManagedAgent / SandboxedAgent bridging converts file operations (read_file, list_files, write_file) into shell command strings using raw path arguments. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment (host or Docker container).

In PraisonAI from version 4.2.1 to before 4.6.59, the AgentOS FastAPI deployment surface remains unauthenticated despite the earlier fix for CVE-2026-40151. The chat route directly calls agent.chat(request.message), and both no-auth and wrong-bearer requests execute the deployed agent.

In PraisonAI versions 4.5.126 to before 4.6.59, the Async Jobs API validates webhook_url at parse time and job construction but not at send time. An attacker-controlled hostname can resolve to a public IP during validation and later to loopback/private/cloud-metadata infrastructure during webhook delivery, bypassing the SSRF guard. This is an incomplete fix / patch bypass for GHSA-8frj-8q3m-xhgm.

In PraisonAI versions 2.6.0 to before 4.6.59, the template loader accepts GitHub template URIs with refs and stores the user-controlled path and ref verbatim, joining them into the cache path without normalization or containment checks. A crafted ref with ../ sequences escapes the cache directory, can write .cache_meta.json outside the cache, and under certain conditions reaches shutil.rmtree to delete an attacker-selected outside directory.

In XDG Desktop Portal before version 1.22.1, malicious sandboxed applications can use FileTransfer.RetrieveFiles to redirect drag-and-drop and copy-paste data intended for other applications to themselves. Access tokens were generated with g_random_int or g_uuid_string_random based on Mersenne Twister, allowing recovery of PRNG state and prediction of subsequent tokens.

In XDG Desktop Portal before version 1.22.1, malicious sandboxed applications can use FileChooser.SaveFiles to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). Filenames are not validated by the frontend or common backends, which are supposed to check that the file does not already exist.

conda-forge repositories at commits 85748ad2368a and prior contain two React components that render externally-sourced strings directly as HTML using dangerouslySetInnerHTML without sanitization. Error/status strings embed raw output from build processes (logs, patches, tracebacks) which the website renders verbatim as HTML.

Event Schedule versions 1.0.0 and prior contain a bypass of the SSRF guard App\Utils\UrlUtils::isUrlSafe() applied to user-supplied import URLs. Two bypass methods reach internal/localhost services when the URL is later fetched by ImportCuratorEvents (Http::get) and file_get_contents for ogImage.

pghoard, a PostgreSQL backup daemon, prior to version 2.7.1 logs database connection information including username and password at debug level when using .pgpass. The issue is patched in version 2.7.1.

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains an SSRF vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, with image responses stored and served via the admin UI.

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains an SSRF vulnerability that bypasses the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers controlling an OpenAPI spec URL or redirect target can append a root dot to a blocked hostname to fetch content from operator-blocked hosts.

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability because safeFetch() forwards Authorization and Cookie headers on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL() spec requests to their own origin to steal bearer tokens or cookies.