Astra Linux - уязвимость в linux-5.10, linux-6.1, linux, linux-5.15

In the Linux kernel, the following vulnerabilities have been resolved: Net: rose: fixed the issue where timers race against user threads. The Rose timers only acquire the socket spinlock, without checking whether the socket is owned by a specific user thread. A check should be added, and the time...

PraisonAI SQL Injection Vulnerability

PraisonAI is a low-code multi-intelligent body collaboration framework. PraisonAI suffers from a SQL injection vulnerability that stems from the getalluserthreads function constructing raw SQL queries using unescaped thread IDs, which can be exploited by an attacker to cause SQL injection and gai...

CVE-2018-25250

CVE-2018-25250 affects the MyBB plugin “Last User’s Threads in Profile” version 1.2. The issue is a persistent XSS vulnerability whereby an attacker can inject malicious scripts by supplying script tags in the subject field of new threads. When users visit the attacker's profile page, the payload...

CVE-2026-34934

CVE-2026-34934 is reserved, but connected data details a concrete vulnerability in PraisonAI. The GitHub advisory GHSA-9CQ8-3V94-434G reports a second-order SQL injection in PraisonAI’s get_all_user_threads flow. The flaw: get_all_user_threads builds raw SQL via f-strings using unescaped thread I...

CVE-2026-34934 PraisonAI: Second-Order SQL Injection in `get_all_user_threads`

PraisonAI is a multi-agent teams system. Prior to version 4.5.90, the getalluserthreads function constructs raw SQL queries using f-strings with unescaped thread IDs fetched from the database. An attacker stores a malicious thread ID via updatethread. When the application loads the thread list, t...

EUVD-2025-5216

Malicious code in bioql PyPI...

CVE-2025-38689

CVE-2025-38689 affects the Linux kernel’s x86 FPU code. When CONFIG_X86_DEBUG_FPU is enabled, AVX-512 timestamp handling calls x86_task_fpu() without a NULL check, returning NULL for kernel threads (PF_KTHREAD) and triggering a NULL pointer dereference when reading /proc/[kthread]/arch_status. Th...

net: rose: fix timer races against user threads

...

SUSE CVE-2025-21718

In the Linux kernel, the following vulnerability has been resolved: net: rose: fix timer races against user threads Rose timers only acquire the socket spinlock, without checking if the socket is owned by one user thread. Add a check and rearm the timers if needed. BUG: KASAN: slab-use-after-free...