Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write…

systeminformation has Command Injection via Unsanitized `locate` Output in `versions()`

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path

fast-uri vulnerable to path traversal via percent-encoded dot segments

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

path-to-regexp vulnerable to Denial of Service via sequential optional groups

undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

Koa has Host Header Injection via `ctx.hostname`