CVE Vulnerability Catalog

In the Linux kernel, pfcp_session_recv() read the 8-byte SEID without ensuring it was in the linear area. A short PFCP packet with the S flag set, or one with the session header in a fragment, caused an out-of-bounds read of packet data.

In the Linux kernel HID steam driver, a narrow window existed during teardown where callbacks could still be scheduled and then reference the freed steam struct (dangling pointer). The fix rearranges the teardown sequence and moves rumble and mode switch work cancellation into steam_unregister.

In the Linux kernel HID steam driver, the registration/unregistration flow was simplified, replacing the serial number assumption with a boolean flag. A bug was also fixed where a battery was not unregistered if later registration steps failed, leaving a power_supply object after the steam object was torn down.

In the Linux kernel, ext4 fails to disable large folios on encrypted inodes when the encrypt feature is enabled on a mounted filesystem, bypassing the mount-time check. Writing encrypted data then triggers a kernel NULL pointer dereference crash. This affects kernels between v6.19 and v7.2.

In the Linux kernel, a use-after-free in the EDAC/altera driver's error paths was fixed. The dci structure was freed before releasing the devres group, allowing an IRQ to dereference freed memory.

In the Linux kernel, KVM on arm64 (nv) fixed the life cycle of the nested_mmus array. The array holding shadow page tables could be relocated during VCPU_INIT while another vCPU was running, leaving a dangling pointer to freed memory.

An incomplete path traversal fix in pghoard, a PostgreSQL backup daemon, allows an attacker with write access to the backup object storage (S3, GCS, Azure) to write arbitrary files and create directories outside the PostgreSQL data directory. A malicious delta backup manifest with path traversal sequences can write arbitrary payloads to the host during a restore operation. The issue is patched in version 2.7.2.

In Heimdall, when trusted_proxies is configured, client IP addresses are extracted from Forwarded and X-Forwarded-For headers and exposed as Request.ClientIPAddresses without syntactic validation. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values are accepted, and the Forwarded header parser mishandles quoted strings, potentially parsing a single value as multiple entries. The issue is patched in version 0.17.17.

In Heimdall proxy mode, the Forwarded HTTP header is constructed by inserting the incoming Host header value without sanitizing commas or semicolons. An attacker can inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. The issue is patched in version 0.17.17.

In PraisonAI from version 4.5.115 to before 4.6.61, the documented CLI entrypoint still exposes A2U subscription and event routes without authentication. The CLI wrapper does not expose --api-key, does not install API-key middleware, and does not generate a token for A2U; if A2U_AUTH_TOKEN is missing, authentication is treated as disabled. The issue is patched in version 4.6.61.

In PraisonAI from version 4.5.110 to before 4.6.61, SandlockSandbox, intended as a kernel-enforced sandbox, does not fail closed when the optional sandlock module imports but reports Landlock unavailable. Its execute() and run_command() methods silently fall back to SubprocessSandbox, which does not enforce filesystem or network boundaries. The issue is patched in version 4.6.61.

In PraisonAI from version 4.5.87 to before 4.6.61, the dangerous-tool policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, workflow.yaml is loaded by YAMLWorkflowParser, which resolves agent-level tools and preserves top-level approve:, allowing an untrusted recipe to declare execute_command and self-approve it without allow_dangerous_tools=True. The issue is patched in version 4.6.61.

In praisonai-platform from version 0.1.4 to before 0.1.5, a workspace member can permanently delete any resource (projects, agents, issues, labels, issue dependencies, and issue-label attachments) created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. The issue is patched in version 0.1.5.

In PraisonAI versions 4.6.10 to before 4.6.59, the LocalManagedAgent / SandboxedAgent bridging converts file operations (read_file, list_files, write_file) into shell command strings using raw path arguments. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment (host or Docker container).

In PraisonAI versions 4.5.126 to before 4.6.59, the Async Jobs API validates webhook_url at parse time and job construction but not at send time. An attacker-controlled hostname can resolve to a public IP during validation and later to loopback/private/cloud-metadata infrastructure during webhook delivery, bypassing the SSRF guard. This is an incomplete fix / patch bypass for GHSA-8frj-8q3m-xhgm.

In PraisonAI versions 2.6.0 to before 4.6.59, the template loader accepts GitHub template URIs with refs and stores the user-controlled path and ref verbatim, joining them into the cache path without normalization or containment checks. A crafted ref with ../ sequences escapes the cache directory, can write .cache_meta.json outside the cache, and under certain conditions reaches shutil.rmtree to delete an attacker-selected outside directory.

In XDG Desktop Portal before version 1.22.1, malicious sandboxed applications can use FileTransfer.RetrieveFiles to redirect drag-and-drop and copy-paste data intended for other applications to themselves. Access tokens were generated with g_random_int or g_uuid_string_random based on Mersenne Twister, allowing recovery of PRNG state and prediction of subsequent tokens.

In XDG Desktop Portal before version 1.22.1, malicious sandboxed applications can use FileChooser.SaveFiles to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). Filenames are not validated by the frontend or common backends, which are supposed to check that the file does not already exist.

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.

The KALLYAS WordPress theme (Hogash) in versions up to 4.25.0 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker can trick a user into clicking a crafted link, leading to execution of malicious script in the victim's browser.