Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Apache Thrift: C++ JSON OOB read

Ffmpeg: ffmpeg: denial of service and potential arbitrary code execution via signed integer overflow in dvd subtitle parser

vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing

Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials

pip can extract console_scripts and gui_scripts outside installation directory

Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern

Apache Thrift: c_glib dispatch stack overflow

Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations