Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

vm2: Sandbox Breakout Through Inspect

protobufjs has an arbitrary code execution issue

Handlebars.js has JavaScript Injection via AST Type Confusion

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write…

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

fast-uri vulnerable to path traversal via percent-encoded dot segments

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

path-to-regexp vulnerable to Denial of Service via sequential optional groups

pip can extract console_scripts and gui_scripts outside installation directory

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain