漏洞公告

nimiq-blockchain: Genesis batch set request

nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve points

nimiq-primitives: BlockInclusionProof interlink issue when hops are empty

lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out

Crawlee for Python: SSRF via sitemap-derived URLs

Apache Fory PyFory Deserialization of Untrusted Data

@sveltejs/kit: `query.batch` cross-talk

md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)

Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler

Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path

LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization

samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions

androidqf: APK download Path Traversal in device APK paths

androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers)

Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing

Klever-Go KVM read-only execution can commit contract delete and upgrade side effects

Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users

Apache Camel K: Kubernetes namespace authorized users can create a Build resource

Mattermost has a Path Traversal issue

Mattermost has an Incorrect Authorization issue

MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks

Drupal Core has a SQL Injection issue