cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

Pillow is vulnerable to a FITS GZIP decompression bomb

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

pyasn1 has a DoS vulnerability in decoder

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames

Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

ip-address: XSS in Address6 HTML-emitting methods

webbrowser.open() allows leading dashes in URLs