漏洞公告

Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases

Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

Decompress: Archive extraction can create files and links outside of the target directory

printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

uucore: safe_traversal TOCTOU protection only enabled on Linux

mv: symlinks expanded during cross-device move (resource exhaustion / data duplication)

cp: -R reads device nodes as streams, destroying device semantics

rm: 'rm -rf ./' (and ./// variants) silently deletes current directory contents, bypassing dot protection

comm: FIFO/pipe inputs are drained before comparison (data loss / hang)

id: groups= computed from real GID instead of effective GID

mkdir: -m exposes directory with umask perms before chmod (race window)

rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)

id: pretty-print uses effective GID instead of effective UID for name lookup

kill: 'kill -1' parsed as PID -1, sending SIGTERM to all processes (system crash / DoS)

install -D: symlink race in directory creation allows arbitrary file overwrite

cut: -s (only-delimited) ignored when delimiter is a newline

install: TOCTOU symlink race (unlink-then-create without O_EXCL) allows arbitrary file overwrite

ln: rejects non-UTF-8 source filenames in target-directory mode

comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output

mktemp: empty TMPDIR creates temp files in CWD instead of /tmp

chmod: recursive mode returns exit code 0 even when some files fail (last-file-wins)