lodash vulnerable to Code Injection via `_.template` imports key names

Handlebars.js has JavaScript Injection via AST Type Confusion

Locutus: RCE via unsanitized input in create_function()

simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Prometheus Azure AD remote write OAuth client secret exposed via config API

Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser

Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

Forge has signature forgery in Ed25519 due to missing S > L check

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Denial of service in github.com/buger/jsonparser

path-to-regexp vulnerable to Denial of Service via sequential optional groups

flatted: Unbounded recursion DoS in parse() revive phase

Incorrect enforcement of email constraints in crypto/x509

Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing