CVE Vulnerability Catalog

The Helion WordPress theme (ThemeREX Group) in versions up to 1.1.12 contains a Deserialization of Untrusted Data vulnerability allowing Object Injection. This may lead to unexpected application behavior or code execution depending on available gadgets.

The Your Dress WordPress theme (AncoraThemes) in versions up to 1.4.1 contains a PHP Local File Inclusion vulnerability due to improper control of filename in include/require statements. An attacker may include local PHP files, potentially leading to code execution or information disclosure.

The Hostme v2 WordPress theme (AivahThemes) in versions up to 7.0 contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker can trick a user into interacting with a crafted page, leading to execution of malicious script in the victim's browser.

In the Linux kernel, the dpaa2-switch driver's error path in dpaa2_switch_rx() incorrectly called dpaa2_switch_free_fd(), which is intended for Tx frame descriptors and expects an skb pointer. The fix moves dma_unmap_page() into dpaa2_switch_rx() and uses free_pages() or kfree_skb() depending on the error stage.

In the Linux kernel, the netfilter ipset subsystem does not properly mark RCU-locked areas. After incrementing the uref counter, there is no need to hold the RCU lock because the referenced hash table cannot disappear. The fix corrects RCU lock and spinlock usage in mtype_gc.

In the Linux kernel, the net/mlx5 HWS driver has an issue when destroying a table that has a miss table created by mlx5hws_table_set_default_miss. The miss table keeps the table pointing to it in a list. When such a table is deleted, it is not removed from the miss table list, leaving a node with garbage data.

In the Linux kernel, the wifi iwlwifi mvm scheduled scan built the probe request before iwl_mvm_scan_fits(), so oversized IEs could be copied into the fixed preq buffer before length validation. The fix moves iwl_mvm_build_scan_probe() after the fits check and advertises max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len() so userspace limits account for driver-inserted DS/TPC bytes.

In the Linux kernel, the ksmbd server removed a connection's channels from other sessions' lists only while conn->binding was set, leaving stale channels pointing to a freed ksmbd_conn after the flag was cleared. This led to a use-after-free on teardown and session leak. The fix removes the conn->binding gate.

In PraisonAI, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL, the script runs in the dashboard origin and can POST to the same request's /approve/{request_id}/decide endpoint, causing HTTPApproval to return approved=True.

In PraisonAI, the normal recipe.run() path enforces the dangerous-tool policy via _check_tool_policy(), but the streaming path recipe.run_stream() loads the same recipe and calls _execute_recipe() without running that check. As a result, a recipe declaring execute_command in requires.tools is denied by recipe.run() but reaches the execution engine through recipe.run_stream() with allow_dangerous_tools=False.

In PraisonAI, LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, _handle_webhook() skips Linear-Signature verification entirely. An unauthenticated network caller can submit a forged Linear-Event: AgentSession request, which is parsed, scheduled, and passed into BotSessionManager.chat().

In PraisonAI, the praisonai recipe serve command dispatches to a deprecated Typer command that can start the Recipe HTTP server on a non-localhost interface with no authentication. Because config.auth is absent, create_app() does not attach API-key or JWT middleware. Unauthenticated requests can reach the recipe API and, when enabled, /admin/reload.

In PraisonAI, the Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent app_mention event handler. A Slack workspace user who can mention the bot can trigger the agent even when the sender is not in allowed_users, the channel is not in allowed_channels, and unknown_user_policy="deny".

In PraisonAI, the Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools() that do not enforce that the supplied artifact_path is an artifact created by the configured store or lives under the configured artifact base directory. The artifact_head, artifact_tail, artifact_grep, and artifact_chunk tools wrap the caller-supplied path into an ArtifactRef and read it from the host filesystem, allowing reads of files readable by the PraisonAI process such as .env files, cloud credentials, and SSH keys.

In PraisonAI, the Dynamic Context module provides filesystem-backed history and terminal-log storage and exports agent-callable tool factories. These tools accept run_id and agent_id arguments, and the underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Since run_id can be an absolute path and agent_id can contain traversal, a lower-trust caller can read .jsonl and .log files outside the configured Dynamic Context base directory.

In PraisonAI, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in the approval channel can approve a pending high-risk tool call by sending yes after the approval message appears.

AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. An attacker who reaches the server port and obtains the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges.

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges.

Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner. A malicious active partner can declare an unvalidated BSend total length (up to 65535 bytes) and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller accept a file GET parameter and concatenate it directly to DIR_BACKUP without calling sanitizeFileName(). This allows an authenticated administrator to read arbitrary files on the server (via nextRestore) and write SQL dump content to arbitrary locations (via nextBackup).