Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection

zlib <= 1.3.1.2 untgz Global Buffer Overflow in TGZfname()

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Prometheus Azure AD remote write OAuth client secret exposed via config API

Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser

Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

Forge has signature forgery in Ed25519 due to missing S > L check

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Denial of service in github.com/buger/jsonparser

path-to-regexp vulnerable to Denial of Service via sequential optional groups

flatted: Unbounded recursion DoS in parse() revive phase

Incorrect enforcement of email constraints in crypto/x509

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Gix-date: gix-date: undefined behavior due to invalid string generation