pytorch: Deserialization of Untrusted Data in pytorch/pytorch

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

ollama: Remote Code Execution via ZipSlip in ollama/ollama

** REJECT ** DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-45436. Notes: All CVE users should reference CVE-2024-45436 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage.

CyberData 011209 SIP Emergency Intercom Missing Authentication for Critical Function

CyberData  011209 Intercom exposes features that could allow an unauthenticated to gain access and cause a denial-of-service condition or system disruption.

Admin Audit Trail - Less critical - Denial of Service - SA-CONTRIB-2025-068

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affects Admin Audit Trail: from 0.0.0 before 1.0.5.

kiCode111 like-girl aboutPost.php sql injection

A vulnerability classified as critical was found in kiCode111 like-girl 5.2.0. This vulnerability affects unknown code of the file /admin/aboutPost.php. The manipulation of the argument title/aboutimg/info1/info2/info3/btn1/btn2/infox1/infox2/infox3/infox4/infox5/infox6/btnx2/infof1/infof2/infof3/infof4/btnf3/infod1/infod2/infod3/infod4/infod5 leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

kiCode111 like-girl ImgUpdaPost.php sql injection

A vulnerability, which was classified as critical, has been found in kiCode111 like-girl 5.2.0. This issue affects some unknown processing of the file /admin/ImgUpdaPost.php. The manipulation of the argument id/imgText/imgDatd/imgUrl leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

org.jboss.hal-hal-parent: Stored Cross-Site Scripting (XSS) in JBoss EAP Management Console

This vulnerability is redundant to CVE-2025-23366 and CVE-2024-10234.

Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001

Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.

ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exe h parameter. This results in reflected data and injection of malicious code into a downloaded executable. The executable can be used to execute malicious queries or as a denial-of-service vector. NOTE: this CVE Record is only about the parameters, such as the h parameter (this CVE Record is not about the separate issue of signed executable files that are supposed to have unique configurations across customers' installations).

In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a (different) attacker-controlled executable file. It is plausible that the end user may allow the download and execution of this file to proceed. There are ConnectWise Control configuration options that add mitigations.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

kernel: drm/amd/display: Don't refer to dc_sink in is_dsc_need_re_compute

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

kernel: drm/amdgpu: Init zone device and drm client after mode-1 reset on reload

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

kernel: usb: dwc2: gadget: don't reset gadget's driver->bus

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

kernel: drm/amd/amdgpu: fix refcount leak

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

kernel: drm/amdkfd: wq_release signals dma_fence only when available

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

kernel: bpf: put bpf_link's program when link is safe to be deallocated

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

kernel: drm/amdgpu/mes: fix mes ring buffer overflow

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

kernel: drm/amd/display: Fix bounds check for dcn35 DcfClocks

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

media: ir_toy: fix a memleak in irtoy_tx

In the Linux kernel, the following vulnerability has been resolved: media: ir_toy: fix a memleak in irtoy_tx When irtoy_command fails, buf should be freed since it is allocated by irtoy_tx, or there is a memleak.