Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on.
The OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected.
This issue affects req_llm: from 1.9.0 before 1.29.0.
Chatwoot versions before 4.17.0 have an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by using a foreign contact inbox source_id. This enables attackers to create or retrieve conversations and post messages on behalf of other accounts.
CVE-2026-95620 is a use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support within the Qt Network module. This flaw allows a malicious or compromised HTTP/2 server to cause the client application to crash, impacting availability. The vulnerability affects Qt versions from 6.9.0 up to but not including 6.11.3. The CVSS 4.0 base score is 2.1, indicating a low severity level. There are no known exploits in the wild and no patch information is provided in the input data.
A use-after-free vulnerability in the Linux kernel's ksmbd component was resolved by ensuring that stale channels are always removed from all sessions on connection teardown. Previously, channels could remain linked to sessions after a connection's binding flag was cleared, leading to dereferencing freed memory and leaking sessions.
A vulnerability in the Linux kernel's irqchip/gic-v4 component was resolved. The issue occurs when the kernel parameter kvm-arm.vgic_v4_enable=1 is set on a system lacking an MSI controller device tree node and GICv4, causing a NULL pointer dereference and kernel panic. The fix involves disabling vLPI support at initialization if the host has no ITS, preventing the kernel from accessing a NULL gic_domain pointer.
A deadlock vulnerability in the Linux kernel's crypto CCP SEV initialization failure path has been resolved. The issue occurs when the function __sev_platform_init_handle_init_ex_path() calls rmp_mark_pages_firmware() with an incorrect lock status, leading to a potential deadlock during cleanup after an RMPUPDATE failure. This deadlock happens because the parent function already holds the sev_cmd_mutex lock, but the called function does not honor this lock state. The fix involves passing the correct lock status to prevent the deadlock.
A vulnerability in the Linux kernel's freevxfs filesystem code caused a kernel crash when encountering unknown typed-extent types during ioctl(FIBMAP) operations on regular files. The issue was due to the vxfs_bmap_typed() function calling BUG() on unexpected extent types, leading to a kernel panic. The vulnerability has been resolved by replacing the BUG() call with WARN_ON_ONCE() and returning 0 to fail cleanly without crashing the kernel.
A vulnerability in the Linux kernel's drm/nouveau/gsp component related to the SEC2 falcon on GA100 chip tables has been resolved. The issue involved a NULL pointer dereference during the GSP-RM boot process caused by missing .sec2 entries, leading to a crash. This was fixed by adding SEC2 to the GA100 chip table to ensure proper device->sec2 access during booter initialization.
A vulnerability in the Linux kernel's network bridge code was resolved by removing a stale rcu_barrier() call in the br_multicast_dev_del() function. The obsolete rcu_barrier() caused excessive RTNL (runtime network link) pressure and could lead to task blocking and performance issues. This fix addresses the problem by eliminating the unnecessary synchronization call that originated from older code patterns.
A vulnerability in the Linux kernel's host1x driver was fixed by adding a missing null check for client->ops during error teardown. Without this check, a NULL pointer dereference could occur if client->ops was NULL during teardown, potentially causing a kernel crash.
A vulnerability in the Linux kernel's iwlwifi driver related to WoWLAN suspend behavior without netdetect configuration has been resolved. The issue involved the driver issuing a WARN_ON() warning when suspending WoWLAN without an active network connection or netdetect configured. The fix removes this warning and ensures the driver cleanly handles suspension in this scenario.
A vulnerability in the Linux kernel's netfilter subsystem related to nf_conntrack_expect was resolved. The issue involved occasional leaking of uninitialized data to userspace via ctnetlink due to missing zeroing at allocation time. The fix involved zeroing the expectation structure at allocation to prevent data leakage. This vulnerability affects the kernel's connection tracking expectations, which are infrequently used. No CVSS score is available for this issue.
A vulnerability in the Linux kernel MMC core was resolved by adding validation for the host-provided max_segs field. The max_segs field is an unsigned short, and if set to an excessively large value by a host driver, it may be truncated to zero. This causes a zero-size allocation request in mmc_alloc_sg(), leading to undefined behavior and a kernel crash due to invalid memory access. The fix adds a validation check to detect zero sg_len and returns an error instead of crashing.
A vulnerability in the Linux kernel's chips-media wave5 driver was fixed by adding range checks to the dec_output_info structure. Without these checks, invalid data could cause the driver to write to invalid memory, leading to a buffer overflow condition. This issue was identified by a static analysis tool (smatch) and corrected to prevent potential memory corruption.
A vulnerability in the Linux kernel's 8250 serial driver related to the recognition of UPIO_AU (type 4) on MIPS Alchemy systems has been resolved. The issue caused warnings during the probe of the 8250 driver due to unsupported UART type 4. The fix involves recognizing UPIO_AU in the set_io_from_upio() function and taking no action since parameters are already set in the platform-specific setup. This fix has been tested on the Alchemy Au1300 platform.
A vulnerability in the Linux kernel's ntfs3 driver related to improper handling of set_blocksize failures has been resolved. The ntfs3 driver uses buffer_heads, which do not handle block sizes larger than PAGE_SIZE correctly. This can cause a kernel BUG_ON failure during mounting due to an invalid offset check in folio_set_bh on the first __bread_gfp call.
A vulnerability in the Linux kernel's drm/gma500 driver for Oaktrail HDMI I2C reads could cause indefinite waiting during I2C transactions due to improper handling of timeouts and interrupts. The issue has been resolved by returning appropriate error codes when timeouts or interrupts occur during the I2C transaction wait, preventing infinite loops.
A vulnerability in the Linux kernel's IMA subsystem was resolved that caused errors during early boot when attempting to change file extended attributes (xattrs) on read-only filesystems. Specifically, on ext4 filesystems, attempts to change xattrs triggered a failing ext4 transaction, leading to kernel warnings and potential boot issues. The fix ensures the system detects the read-only state early and returns an error without starting a failing transaction.
A vulnerability in the Linux kernel's isofs filesystem code was resolved. The issue involved improper handling of set_blocksize failures because isofs uses buffer_heads, which do not handle block sizes larger than PAGE_SIZE correctly. This could cause a kernel BUG_ON failure during mounting due to an offset exceeding the folio size.
A vulnerability in the Linux kernel's mac80211_hwsim component allowed undersized HWSIM_ATTR_TX_INFO attributes to be accepted, leading to out-of-bounds reads. The issue was due to insufficient length validation of the attribute payload before casting and reading it as a struct hwsim_tx_rate pointer. This flaw has been resolved by enforcing exact length checks in the attribute policy to reject malformed inputs.