Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

fast-uri vulnerable to path traversal via percent-encoded dot segments

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

Black: Arbitrary file writes from unsanitized user input in cache file name

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Pillow has an out-of-bounds write when loading PSD images

Axios affected by Denial of Service via __proto__ Key in mergeConfig

pyasn1 has a DoS vulnerability in decoder

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

AIOHTTP Vulnerable to Deserialization of Untrusted Data