Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder

Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components

vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out

FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()

Apache Thrift: Swift Range crash in skip()

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

vLLM - Denial of Service via Unvalidated Multimodal Embeddings

Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm

Python-Multipart: Denial of Service via unbounded multipart part headers

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Apache Thrift: Go TFramedTransport uint32 overflow

Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.

Pillow is vulnerable to a FITS GZIP decompression bomb

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Apache Thrift: TSSLTransportFactory.java hostname verification

Apache Thrift: Swift Compact Protocol integer overflow

Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames

Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack