drm/msm/dpu: don't mix devm and drmm functions

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: don't mix devm and drmm functions Mixing devm and drmm functions will result in a use-after-free on msm driver teardown if userspace keeps a reference on the drm device: The WB connector data will be destroyed because of the use of devm_kzalloc()), while the usersoace still can try interacting with the WB connector (which uses drmm_ functions). Change dpu_writeback_init() to use drmm_. Patchwork: https://patchwork.freedesktop.org/patch/722656/

accel/qaic: Add overflow check to remap_pfn_range during mmap

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remap_pfn_range during mmap The call to remap_pfn_range in qaic_gem_object_mmap is susceptible to (re)mapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap() unmaps only the VMA region and not the additional mappings. To prevent this, check the remaining size of the VMA before remapping and truncate the remapped length if sg->length is too large. [jhugo: fix braces from checkpatch --strict]

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

jsbroks COCO Annotator Data Endpoint datasets.py path traversal

A weakness has been identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/datasets.py of the component Data Endpoint. Executing a manipulation of the argument folder can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.

Low-privilege users may remove protected Artifactory metadata

A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.

Deleted users may temporarily retain access to JFrog Artifactory

Credentials for a deleted user may remain valid for a short period under specific conditions.

Anonymous users may access restricted Artifactory repository information

An unauthenticated user may access restricted repository information under specific conditions.

Authenticated users may access private NuGet metadata

An authenticated user without repository read permission may access private NuGet metadata under specific conditions.

Authenticated users may access private OCI referrer metadata

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.

Repository readers may access content outside configured upstream paths

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.

Authenticated users may write files outside the intended Artifactory work directory

An authenticated user may write files outside the intended Artifactory work directory under specific conditions.

Project Resource Managers may escalate privileges in JFrog Artifactory

A Project Resource Manager may gain broader administrative privileges under specific conditions.

Anonymous users may access restricted Artifactory content under specific configurations

An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.

Publishers without delete permission can overwrite docker layer information

A repository publisher without delete permission may modify protected package content under specific conditions.

Bundle writers may alter trusted release information in JFrog Artifactory

A bundle writer may create misleading release promotion information under specific conditions.

Potential insecure deserialization in JFrog Artifactory

A party with write access to stored session data may affect JFrog Artifactory under specific conditions.

Potential improper SAML signature verification in JFrog Artifactory

A user with access to a valid SAML response may impersonate another user under specific conditions.

Potential remember-me authentication bypass in JFrog Artifactory

An unauthenticated user may bypass authentication under specific cache conditions.