Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

vLLM: OpenAI auth bypass

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

fast-uri vulnerable to host confusion via failed IDN canonicalization

ws: Memory exhaustion DoS from tiny fragments and data chunks

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

ws: Uninitialized memory disclosure

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Pillow is vulnerable to a FITS GZIP decompression bomb

LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Docker: `PUT /containers/{id}/archive` executes container binary on the host

LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers