CVE-2025-69286 RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability

RAGFlow is an open-source RAG Retrieval-Augmented Generation engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta assistant/agent share auth token generation process allows these tokens to be mutually derivable. Specifically, both tokens are...

CVE-2025-69286

RAGFlow prior to 0.22.0 uses an insecure key generation algorithm for API keys and beta tokens. Both tokens are generated with the same URLSafeTimedSerializer and predictable inputs, so a user with the shared assistant/agent URL can derive the personal API key, granting full control over the owne...

PYSEC-2025-90

cbor2 provides encoding and decoding for the Concise Binary Object Representation CBOR serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag 28 persist in memory an...

PYSEC-2025-90

cbor2 provides encoding and decoding for the Concise Binary Object Representation CBOR serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag 28 persist in memory an...

SUSE CVE-2023-54267

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Rework lppacasharedproc to avoid DEBUGPREEMPT lppacasharedproc takes a pointer to the lppaca which is typically accessed through getlppaca. With DEBUGPREEMPT enabled, this leads to checking if preemption is...

PT-2025-54469

Name of the Vulnerable Software and Affected Versions RAGFlow versions prior to 0.22.0 Description RAGFlow is a Retrieval-Augmented Generation engine. Versions prior to 0.22.0 utilize an insecure key generation algorithm when creating API keys and beta tokens assistant/agent share auth. This allo...

Linux Distros Unpatched Vulnerability : CVE-2023-54267

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - powerpc/pseries: Rework lppacasharedproc to avoid DEBUGPREEMPT lppacasharedproc takes a pointer to the lppaca which is typically accessed through getlppaca. Wit...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992851)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992851 advisory. In the Linux kernel, the following vulnerability has been resolved: tee: add overflow check in registershmhelper With special lengths supplied by user space,...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993145)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993145 advisory. In the Linux kernel, the following vulnerability has been resolved: pnode: terminate at peers of source The propagatemnt function handles mount propagation when...

Malicious code in react-devtools-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd222e067bee8f9d675a2d56e5e8eb63a00a76038df2d777aae7f5659bf3b0c6 The package react-devtools-shared was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-205792

Malicious code in react-devtools-shared npm...

Malicious Package

Overview react-devtools-shared is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-192972 Malicious code in react-devtools-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd222e067bee8f9d675a2d56e5e8eb63a00a76038df2d777aae7f5659bf3b0c6 The package react-devtools-shared was found to contain malicious code. Source: ghsa-malware...

EUVD-2023-60374

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Rework lppacasharedproc to avoid DEBUGPREEMPT lppacasharedproc takes a pointer to the lppaca which is typically accessed through getlppaca. With DEBUGPREEMPT enabled, this leads to checking if preemption is...

EUVD-2022-55856

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Check whether transferred 2D BO is shmem Transferred 2D BO always must be a shmem BO. Add check for that to prevent NULL dereference if userspace passes a VRAM BO...

CVE-2023-54267

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Rework lppacasharedproc to avoid DEBUGPREEMPT lppacasharedproc takes a pointer to the lppaca which is typically accessed through getlppaca. With DEBUGPREEMPT enabled, this leads to checking if preemption is...

UBUNTU-CVE-2023-54267

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Rework lppacasharedproc to avoid DEBUGPREEMPT lppacasharedproc takes a pointer to the lppaca which is typically accessed through getlppaca. With DEBUGPREEMPT enabled, this leads to checking if preemption is...

CVE-2022-50842

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Check whether transferred 2D BO is shmem Transferred 2D BO always must be a shmem BO. Add check for that to prevent NULL dereference if userspace passes a VRAM BO...

CVE-2023-54267

Technical details for CVE-2023-54267 are not publicly available in the provided documents. The initial entry mentions a Linux kernel fix in powerpc/pseries and lppaca_shared_proc() but does not specify affected products/versions or remediation specifics beyond generic description; monitor for upd...

CVE-2023-54267 powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Rework lppacasharedproc to avoid DEBUGPREEMPT lppacasharedproc takes a pointer to the lppaca which is typically accessed through getlppaca. With DEBUGPREEMPT enabled, this leads to checking if preemption is...