CVE-2026-92160: Integer Overflow or Wraparound

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because the wrapping sum bypasses file-range validation, becomes mendOffset, and leaves mbyteOffs...

PT-2026-114336

Name of the Vulnerable Software and Affected Versions F´ F Prime versions prior to 4.2.0 Description Svc::GenericHub fromBufferDriver handler deserialization is flawed because the receive handler uses FW ASSERT for type validation and deserialization status influenced by external sources, and...

CVE-2026-92153: Improper Limitation of a Pathname to a Restricted Directory

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing...

CVE-2026-92155: Reachable Assertion

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its ran...

CVE-2026-92158: Integer Overflow or Wraparound

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound ...

CVE-2026-92156: Incorrect Calculation of Buffer Size

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueueinternalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet...

CVE-2026-92157: Integer Overflow or Wraparound

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrappe...

CVE-2026-92154: Integer Overflow or Wraparound

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic a...

CVE-2026-92151: Reachable Assertion

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataInhandler is vulnerable because the handler treats the minimum packet-length condition as FWASSERT rather than rejecting a...

CVE-2026-92150: Reachable Assertion

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriverhandler deserialization is vulnerable because the receive handler uses FWASSERT for externally influenced deserialization stat...

CVE-2026-92159: Improper Handling of Length Parameter Inconsistency

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecvhandler fixed-slot copy TlmRecvhandler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime...

EUVD-2026-98313

A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function moveuploadedfile of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can be initiated remotely. The exploit has be...

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

SUMMARY Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP incl. SIPLUS variant. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not...

CVE-2026-62176

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

CVE-2026-62176 PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

CVE-2026-62176

The PraisonAI multi-agent system is vulnerable to code injection in versions prior to 4.6.78 . The flaw exists in the deploy/api.py and deploy/docker.py modules, where the agents_file parameter is directly interpolated into an f-string without sanitization. This generated code is then written to ...

CVE-2026-62176 PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

EUVD-2026-94521

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

CVE-2026-62176 PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

Summary The deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile value via CLI argument, configuration, or upstream API can...