Fastify's Content-Type header tab character allows body validation bypass

Python-Multipart has Arbitrary File Write via Non-Default Configuration

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Apache Thrift: Swift Compact Protocol integer overflow

Instructlab: instructlab: path traversal allows arbitrary directory creation and file write

vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`