CVE-2025-47410 Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This...

`unic-char-range` is unmaintained

All Unicode crates that are part of https://github.com/open-i18n/rust-unic are unmaintained. Recommended alternatives - Since version 1.45.0 Rust supports using char with ops::Range, RangeFrom, RangeFull, RangeInclusive, RangeTo to iterate over a range of codepoints...

RUSTSEC-2025-0075 `unic-char-range` is unmaintained

All Unicode crates that are part of https://github.com/open-i18n/rust-unic are unmaintained. Recommended alternatives - Since version 1.45.0 Rust supports using char with ops::Range, RangeFrom, RangeFull, RangeInclusive, RangeTo to iterate over a range of codepoints...

add_space (>=0.1.2, <=0.1.8), ale_python_parser (>=0.1.0, <=0.1.3) +246 more potentially affected by unknown CVE via unic-char-range (>=0.6.0, <=0.9.0)

unic-char-range CARGO version =0.6.0, =0.1.2, =0.1.0, =0.3.0, =0.5.0, =0.5.0, =0.1.0-alpha.4, =0.3.0, =1.0.0, =0.1.0, =0.0.4, =0.1.0, =0.2.6, =0.0.15, =0.2.0, =1.8.4 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0075...

unic (>=0.5.0, <=0.6.0), unic-bidi (>=0.1.0, <=0.6.0) +10 more potentially affected by unknown CVE via unic-ucd-core (>=0.1.1, <=0.6.0)

unic-ucd-core CARGO version =0.1.1, =0.5.0, =0.1.0, =0.1.1, =0.4.0, =0.1.0, =0.5.0, =0.3.0, =0.1.0, =0.5.0, =0.1.0, =0.6.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0103...

CVE-2025-49655

Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being...

drm/amdkfd: svm range restore work deadlock when process exit

...

Keras security vulnerabilities

Keras is a multi-backend deep learning framework open-sourced by Keras. A security vulnerability exists in Keras versions 3.11.0 up to and including 3.11.3, which stems from deserialization of untrustworthy data and could lead to the execution of arbitrary code...

CVE-2025-9559

Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data...

CVE-2024-56143

Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset...

CVE-2024-56143 Strapi Allows Unauthorized Access to Private Fields via parms.lookup

Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset...

Git LFS post-linkage vulnerability

Git Lfs is a command line tool from the Git Lfs team for working with large files in git projects. A backlink vulnerability exists in Git Lfs versions 0.5.2 through 3.7.0, which stems from an unchecked symbolic link that could result in writing to an arbitrary file system location...

@avorati/strapi-plugin-preview (1.0.1), @futurebrand/helpers-strapi (>=2.0.0, <=2.5.4) +5 more potentially affected by CVE-2025-3930 via @strapi/strapi (>=5.0.0-rc.10, <=5.16.1)

@strapi/strapi NPM version =5.0.0-rc.10, =2.0.0, =2.0.0, =3.0.0-beta.1, =3.0.0-beta.2 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2025-3930 Source advisory: OSV:GHSA-4R8W-3JWW-M2RP...

CVE-2025-6338

There is an incomplete cleanup vulnerability in Qt Network's Schannel support on Windows which can lead to a Denial of Service over a long period. This issue affects Qt from 5.15.0 through 6.8.3, from 6.9.0 before 6.9.2...

CVE-2025-24833

Stored cross-site scripting XSS vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser...

CVE-2025-58426

desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications...

Matrix Authentication Service security vulnerability

Matrix Authentication Service is a user management and authentication system from Element Open Source. A security vulnerability exists in Matrix Authentication Service versions 0.20.0 through 1.4.0, which stems from a logic flaw that could allow an attacker to perform sensitive operations without...

EUVD-2022-55090

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: svm range restore work deadlock when process exit kfdprocessnotifierrelease flush svmrangerestorework which calls svmrangelistlockandflushwork to flush deferredlist work, but if deferredlist work mmput release the las...

EUVD-2025-34686

gnark-crypto doesn't range check input values during ECDSA and EdDSA signature deserialization...

GHSA-FR8M-434R-G3XP gnark-crypto doesn't range check input values during ECDSA and EdDSA signature deserialization

Impact During deserialization of ECDSA and EdDSA signatures gnark-crypto did not check that the values are in the range 1, n-1 with n being the corresponding modulus either base field modulus in case of R in EdDSA, and scalar field modulus in case of s,r in ECDSA and s in EdDSA. As this also...