Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

lodash vulnerable to Code Injection via `_.template` imports key names

pyOpenSSL DTLS cookie callback buffer overflow

Eda-server: websocket missing authorization allows credential theft via activation_id spoofing

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

fast-uri vulnerable to path traversal via percent-encoded dot segments

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

Black: Arbitrary file writes from unsanitized user input in cache file name

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions

pip can extract console_scripts and gui_scripts outside installation directory

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions