Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

LiteLLM: Authentication Bypass via Host Header Injection

BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication

Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations

vLLM: OpenAI auth bypass

LiteLLM < 1.83.10 Privilege Escalation via User Update

LiteLLM < 1.83.14 Privilege Escalation via API Key Generation

Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service

Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering

NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read

Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI

Python-Multipart: Denial of Service via unbounded multipart part headers

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Docker: `PUT /containers/{id}/archive` executes container binary on the host

Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache

Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus

ip-address: XSS in Address6 HTML-emitting methods

pip can extract console_scripts and gui_scripts outside installation directory

Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver

opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers