fast-uri vulnerable to path traversal via percent-encoded dot segments

Pillow is vulnerable to a FITS GZIP decompression bomb

Unexpected work during chain building in crypto/x509

Vite has a `server.fs.deny` bypass with queries

Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

path-to-regexp vulnerable to Denial of Service via sequential optional groups

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

Black: Arbitrary file writes from unsanitized user input in cache file name

Incorrect enforcement of email constraints in crypto/x509

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Pillow has an out-of-bounds write when loading PSD images

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Python-Multipart has Arbitrary File Write via Non-Default Configuration

pyasn1 has a DoS vulnerability in decoder

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Awx: project archive extraction allows path traversal file writes

Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fields, and host names, reaching ansible-core templating in the execution environment

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

Aap-gateway: improper path validation in gateway allows credential exfiltration

Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams

Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda

Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames

Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass

Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions

ip-address: XSS in Address6 HTML-emitting methods

React Router vulnerable to XSS via Open Redirects

pip can extract console_scripts and gui_scripts outside installation directory

wheel Allows Arbitrary File Permission Modification via Path Traversal

Potential SQL injection via QuerySet.order_by and FilteredRelation

Potential SQL injection in column aliases via control characters

Potential SQL injection via raster lookups on PostGIS

Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates

Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership

Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure

Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration

Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust

Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/

Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api

Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod