CVE Vulnerability Catalog

Ekia File Manager 1.2.7 exposes an exported ContentProvider OpenFileProvider without requiring caller permissions. Another local application can map a URI path to an arbitrary file path and perform read, create, overwrite, or delete operations in the context of the File Manager process.

In PraisonAI prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments using the advertised opt-out can expose registered agents and their connected tools or private context to unauthenticated invocation.

In PraisonAI prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is configured, otherwise parsing and dispatching unsigned request bodies. A remote unauthenticated client reaching the webhook route can forge messages, comments, or agent-session events, impersonate platform users, and disrupt bot processing.

In PraisonAI prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files accessible to the service account, exposing credentials, keys, environment variables, and other local data.

In PraisonAI prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforce path containment only for a truthy workspace. An application exposing code_read_file, code_search_replace, or code_apply_diff before set_workspace can let prompt-influenced calls read and modify files outside the intended project directory.

In OpenTelemetry Operator prior to 0.152.0, TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as HTTPClientConfig.Authorization.CredentialsFile. A tenant who can create or update a ServiceMonitor matched by selectors can point bearerTokenFile at a file in the Collector pod, including the service account token, and direct scraping to a tenant-controlled endpoint, disclosing the Collector's service-account JWT or other mounted files.

A weakness has been identified in itsourcecode Leave Management System 1.0. Affected is some unknown functionality of the file /login.php. Manipulation of the user_email argument can lead to SQL injection. The attack may be launched remotely, and the exploit has been made available to the public.

Three separate mechanisms in Apache Storm's HTTP components allowed a web page on an unrelated origin to read responses served to an authenticated user. The Logviewer reflected the request's Origin header in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true, the shared CORS filter was misconfigured (a response header name was supplied where an initialisation parameter name was expected, so the container applied its own credential-allowing defaults), and the UI and Logviewer wrapped API responses in a caller-supplied JSONP callback for every GET request. In each case, a page visited by an authenticated operator can read cluster, topology and log data on their behalf.

In Apache Storm before 3.1.0, the rebalance operation does not revalidate the blobstore map for permissions, and listBlobs lacks authorization checks, allowing an authorized user to access disallowed blobs and disclose metadata.

In CVE-2026-82430 in Apache Storm, the setuid-root `worker-launcher` first changes ownership of the entire worker directory to the untrusted topology user and only afterwards reads the command file written into that directory. The file is opened without `O_NOFOLLOW` and without re-verifying its owner, so the tenant can replace its contents in the window between the ownership change and the read. On the Docker path the rewritten command is executed with real uid 0, and on the OCI path arbitrary host paths can be bind-mounted read-write into the container.

A time-of-check-time-of-use (TOCTOU) vulnerability exists in the setuid-root worker-launcher binary in Apache Storm. While walking worker directory trees, it calls lchown and chmod on full pathnames that are re-resolved after FTS classification. A malicious topology user can replace an intermediate directory with a symbolic link and redirect the privileged operation to an arbitrary file on the host.

This vulnerability in Apache Storm affects the `storm jar --artifacts` feature, where dependency artifacts are stored under a blob key derived solely from the Maven coordinate, making it predictable and shared across all users. If the blob already exists, it is silently reused without owner verification, allowing an attacker to control the data that other submitters receive, leading to code execution in another tenant's topology.

A vulnerability in Apache Storm allows an attacker to use relative path segments (../) in the `topology.blobstore.map` to force deletion and symlink creation at arbitrary locations, acting as the supervisor user. This can lead to recursive deletion of data and replacement of symlinks, which when workers are launched enables execution of attacker-chosen code as another tenant's OS user, breaking isolation.

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the hookActionObjectProductUpdateBefore, hookActionObjectCategoryUpdateBefore, and hookActionObjectCategoryAddAfter hook methods. The module inserts values of the POST parameters alior_product_promotion, alior_category_promotion, and alior_category_enabled directly into SQL UPDATE queries without sanitization or validation. An attacker with access to product or category add/edit functionality in the PrestaShop backoffice can inject arbitrary SQL, potentially allowing unauthorized access to and modification of database contents.

On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls.

In PraisonAI prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when search_emails, reply_email, or archive_email is exposed to an agent with configured email credentials, allowing mailbox data access, modification, deletion, or connection disruption.

In praisonaiagents prior to 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, keys, environment files, source code, and system configuration. This issue is fixed in praisonaiagents 1.6.59.

In praisonaiagents prior to 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, or URL-mention fetches connect. An attacker-controlled hostname resolving to a loopback, private, link-local, or cloud-metadata address therefore bypasses the SSRF policy without a rebinding race and can expose internal responses to the agent. This issue is fixed in praisonaiagents 1.6.58.

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.