Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm

ws: Uninitialized memory disclosure

Python-Multipart: Denial of Service via unbounded multipart part headers

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Next.js: Denial of Service via connection exhaustion in applications using Cache Components

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Next.js: Middleware / Proxy bypass in Pages Router applications using i18n

protobufjs: Denial of service through unbounded protobuf recursion

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

No description published yet

Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure

ReDoS in multipart 1.3.0 - `parse_options_header()`

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

xgrammar: Multi-layer nesting causes DoS

Pillow has an out-of-bounds write when loading PSD images

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Fastify's Content-Type header tab character allows body validation bypass

Python-Multipart has Arbitrary File Write via Non-Default Configuration

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Apache Thrift: Swift Compact Protocol integer overflow

Instructlab: instructlab: path traversal allows arbitrary directory creation and file write

vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`

Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move()

Apache Thrift: C++ JSON OOB read

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

Ffmpeg: ffmpeg: denial of service and potential arbitrary code execution via signed integer overflow in dvd subtitle parser

ip-address: XSS in Address6 HTML-emitting methods

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

Next.js: Denial of Service in the Image Optimization API

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

pip can extract console_scripts and gui_scripts outside installation directory

wheel Allows Arbitrary File Permission Modification via Path Traversal

Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursor

Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL

Apache Thrift: c_glib dispatch stack overflow

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled