CVE Vulnerability Catalog

In the Linux kernel, host1x_device_init() error teardown paths did not check client->ops before dereferencing it, unlike the init paths. This could result in a NULL pointer dereference if client->ops was NULL. The fix adds the missing check in the teardown and teardown_late labels.

In the Linux kernel, the drm/nouveau/gsp driver lacked a SEC2 entry in the GA100 chip table. During tu102_gsp_oneinit(), the booter constructor needs device->sec2 to access the SEC2 falcon; without the entry, device->sec2 is NULL and this dereference crashes during GSP-RM boot.

In the Linux kernel, the iwlwifi (mld) driver triggered WARN_ON() when suspending with WoWLAN configured but not connected to a network and without netdetect. The fix removes the warning and lets the driver cleanly handle this case by returning 1 to disconnect and suspend.

In the Linux kernel, the netfilter nf_conntrack_expect module did not zero expectation structures at allocation time, potentially leaking uninitialized data to userspace via ctnetlink. The fix zeroes memory at allocation time.

In the Linux kernel, the freevxfs filesystem called BUG() when encountering an unknown typed-extent type in vxfs_bmap_typed(), causing a kernel crash. The fix replaces BUG() with WARN_ON_ONCE() and returns 0, so ioctl(FIBMAP) fails cleanly.

In the Linux kernel, the crypto ccp driver called rmp_mark_pages_firmware() with locked=false while the parent function already held sev_cmd_mutex. On an RMPUPDATE failure, the cleanup path could deadlock in sev_do_cmd. The fix passes locked=true.

In the Linux kernel, the ksmbd server removed a connection's channels from other sessions' lists only while conn->binding was set, leaving stale channels pointing to a freed ksmbd_conn after the flag was cleared. This led to a use-after-free on teardown and session leak. The fix removes the conn->binding gate.

A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability.

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.

In PraisonAI, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL, the script runs in the dashboard origin and can POST to the same request's /approve/{request_id}/decide endpoint, causing HTTPApproval to return approved=True.

In PraisonAI, the normal recipe.run() path enforces the dangerous-tool policy via _check_tool_policy(), but the streaming path recipe.run_stream() loads the same recipe and calls _execute_recipe() without running that check. As a result, a recipe declaring execute_command in requires.tools is denied by recipe.run() but reaches the execution engine through recipe.run_stream() with allow_dangerous_tools=False.

In PraisonAI, LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, _handle_webhook() skips Linear-Signature verification entirely. An unauthenticated network caller can submit a forged Linear-Event: AgentSession request, which is parsed, scheduled, and passed into BotSessionManager.chat().

In PraisonAI, the praisonai recipe serve command dispatches to a deprecated Typer command that can start the Recipe HTTP server on a non-localhost interface with no authentication. Because config.auth is absent, create_app() does not attach API-key or JWT middleware. Unauthenticated requests can reach the recipe API and, when enabled, /admin/reload.

In PraisonAI, the Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent app_mention event handler. A Slack workspace user who can mention the bot can trigger the agent even when the sender is not in allowed_users, the channel is not in allowed_channels, and unknown_user_policy="deny".

In PraisonAI, the Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools() that do not enforce that the supplied artifact_path is an artifact created by the configured store or lives under the configured artifact base directory. The artifact_head, artifact_tail, artifact_grep, and artifact_chunk tools wrap the caller-supplied path into an ArtifactRef and read it from the host filesystem, allowing reads of files readable by the PraisonAI process such as .env files, cloud credentials, and SSH keys.

In PraisonAI, the Dynamic Context module provides filesystem-backed history and terminal-log storage and exports agent-callable tool factories. These tools accept run_id and agent_id arguments, and the underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Since run_id can be an absolute path and agent_id can contain traversal, a lower-trust caller can read .jsonl and .log files outside the configured Dynamic Context base directory.

In PraisonAI, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in the approval channel can approve a pending high-risk tool call by sending yes after the approval message appears.

AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. An attacker who reaches the server port and obtains the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges.

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges.

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts.