75 matches found
CVE-2025-59321
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to be unsealed via an unintended execution path or from another hardware platform...
CVE-2025-59321: Initialization of a Resource with an Insecure Default
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to be unsealed via an unintended execution path or from another hardware platform...
PT-2026-71069
Name of the Vulnerable Software and Affected Versions CryptoPro Secure Disk for Bitlocker versions prior to 7.7.4 Description The software contains a default TPM PCR policy that fails to consider the system boot state. This flaw allows the Trusted Platform Module TPM, a specialized chip used to...
PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml
SummaryPraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allowdangeroustools=True. That policy only checks tools declared in TEMPLATE.yaml requires.tools.For steps-based recipes, the actual execution path load...
PT-2026-64123
PraisonAI recipe.run stream skips dangerous-tool policy enforcement Summary PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow dangerous tools=True. The normal recipe.run path enforces this with check tool policy. The streaming path,...
NPM: OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
NPM: OpenClaw: Workspace .env npmexecpath could influence bundled runtime dependency install vulnerability discovered by ? in WordPress Npm openclaw versions 2026.4.29...
PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
PraisonAI recipe.runstream skips dangerous-tool policy enforcement Summary PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allowdangeroustools=True. The normal recipe.run path enforces this with checktoolpolicy. The streaming path,...
SUSE CVE-2026-45982
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix NULL pointer dereference in acpievaddressspacedispatch Cover a missed execution path with a new check...
CVE-2026-41256
jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before...
CVE-2026-34426 OpenClaw - Approval Bypass via Environment Variable Normalization
OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths, allowing attackers to inject attacker-controlled environment variables into execution without approval system validation...
CVE-2026-34426
OpenClaw is affected in versions prior to commit b57b680, due to inconsistent environment variable normalization between approval and execution paths. This allows attackers to inject attacker-controlled environment variables into execution without proper approval validation, by exploiting differi...
CVE-2026-34426 OpenClaw - Approval Bypass via Environment Variable Normalization
OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths, allowing attackers to inject attacker-controlled environment variables into execution without approval system validation...
CVE-2025-67906
In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path...
EUVD-2025-203326
In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path...
CVE-2025-67906
In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path...
PT-2025-51190
Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.28 Description The software contains a flaw in the workflow execution path due to improper handling of user-supplied data. Specifically, the executionPath.ctp element within the application allows for Cross-Site...
PT-2026-2534
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the drm/xe subsystem related to handling the num syncs parameter in the exec and vm bind ioctl calls. Without proper bounds checking, a large num...
FACTION 安全漏洞
Faction is an open source pen inspection report generation and evaluation collaboration framework from Faction Security. A security vulnerability exists in FACTION versions prior to 1.7.1 that stems from an extension execution path that allows untrusted extension code to execute arbitrary system...