CVE-2025-41258

LibreChat 0.8.1-rc2 uses the same JWT secret for user sessions and the RAG API, leading to service-level authentication bypass of the RAG API. Affected component: JWT-based session mechanism; Root cause: shared secret across authentication domains. Impact: unauthorized access to RAG API due to co...

CVE-2025-41258 LibreChat RAG API Authentication Bypass

LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API...

The vulnerability of the mlx5_revoke_mr() function in the drivers/infiniband/hw/mlx5/mr.c file of the Linux kernel’s InfiniBand support driver allows a attacker to cause a service failure.

The vulnerability of the mlx5revokemr function in the drivers/infiniband/hw/mlx5/mr.c file of the Linux kernel’s InfiniBand support module is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

VulnCheck KEV: CVE-2025-43510

A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpect...

The vulnerability of the amdgpu_vm_sdma_update() function in the drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c file of the Direct Rendering Infrastructure (DRI) driver for AMD GPU cores in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the amdgpuvmsdmaupdate function in the drivers/gpu/drm/amd/amdgpu/amdgpuvmsdma.c file of the Direct Rendering Infrastructure DRI driver for AMD GPU cores in the Linux operating system is related to access violations when using shared resources. Exploiting this vulnerability c...

The vulnerability of the proc_dou8vec_minmax() function in the Linux kernel/sysctl.c module allows a hacker to trigger a service failure.

The vulnerability of the procdou8vecminmax function in the Linux kernel/sysctl.c module is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the xsk_generic_rcv() function in the net/xdp/xsk.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the xskgenericrcv function in the net/xdp/xsk.c module of the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of...

CVE-2026-32267 Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user or an unauthenticated user who has been sent a shared URL can escalate their privileges to admin by abusing...

CVE-2026-32267 Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user or an unauthenticated user who has been sent a shared URL can escalate their privileges to admin by abusing...

CVE-2026-32267 Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user or an unauthenticated user who has been sent a shared URL can escalate their privileges to admin by abusing...

CVE-2026-25083

GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows a shared AI assistant's identifier may view and/or tamper the other user's threads/messages...

Malicious code in @storylane/shared-packages (npm)

The package '@storylane/shared-packages' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-1500 Malicious code in @storylane/shared-packages (npm)

The package '@storylane/shared-packages' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

The vulnerability of the pure_initcall() function in the kernel/bpf/core.c module, which supports the BPF interpreter for Linux kernels, allows a attacker to cause a service failure.

The vulnerability of the pureinitcall function in the kernel/bpf/core.c module, which supports the BPF interpreter for Linux kernels, is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

Weseek Growi 安全漏洞

Weseek Growi is an open-source wiki system developed by the Japanese company Weseek, which can be written in Markdown format. Versions of Weseek Growi prior to v7.4.5 contained security vulnerabilities. These vulnerabilities stemmed from the OpenAI thread/message API endpoints not performing...

The vulnerability of the padata_reorder() function in the kernel/padata.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the padatareorder function in the kernel/padata.c module of the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

EUVD-2026-11915

Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Subrata Mal TeraWallet – For WooCommerce woo-wallet allows Leveraging Race Conditions.This issue affects TeraWallet – For WooCommerce: from n/a through = 1.5.15...

OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes

Summary A logic flaw in the OpenClaw gateway WebSocket connect path allowed certain device-less shared-token or password-authenticated backend connections to keep client-declared scopes without server-side binding. A shared-authenticated client could present elevated scopes such as operator.admin...

GHSA-RQPP-RJJ8-7WV8 OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes

Summary A logic flaw in the OpenClaw gateway WebSocket connect path allowed certain device-less shared-token or password-authenticated backend connections to keep client-declared scopes without server-side binding. A shared-authenticated client could present elevated scopes such as operator.admin...

CVE-2026-32398

Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Subrata Mal TeraWallet – For WooCommerce woo-wallet allows Leveraging Race Conditions.This issue affects TeraWallet – For WooCommerce: from n/a through = 1.5.15...