Path Traversal in nltk/nltk

Pillow has an out-of-bounds write when loading PSD images

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Python-Multipart has Arbitrary File Write via Non-Default Configuration

WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect

pyasn1 has a DoS vulnerability in decoder

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component