Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

fast-uri vulnerable to host confusion via failed IDN canonicalization

ws: Memory exhaustion DoS from tiny fragments and data chunks

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

ws: Uninitialized memory disclosure

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Pillow is vulnerable to a FITS GZIP decompression bomb

LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app

lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

Black: Arbitrary file writes from unsanitized user input in cache file name

ReDoS in multipart 1.3.0 - `parse_options_header()`

Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

Incorrect enforcement of email constraints in crypto/x509

Path Traversal in nltk/nltk

MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Docker: `PUT /containers/{id}/archive` executes container binary on the host