path-to-regexp vulnerable to Denial of Service via sequential optional groups

NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app

lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

flatted: Unbounded recursion DoS in parse() revive phase

Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown…

Path Traversal in nltk/nltk

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component

Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery

Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversal

Pulp-ansible: bearer tokens are reused across remotes in a worker

Pulp-container: registry credentials are reused across remotes in a worker

Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter oracle

Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure

LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

Golang-fips: golang fips zeroed buffer

Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)

Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction

Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions

Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential

Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directory

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification

Jwcrypto: jwcrypto: denial of service via malformed jwe tokens

pip can extract console_scripts and gui_scripts outside installation directory

Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)

Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration

Aap-mcp-server: aap mcp server: log injection allows social engineering attacks via unsanitized input

Awxkit: path traversal via yaml !include directive

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api key