Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

protobufjs has an arbitrary code execution issue

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

SSRF Protection Bypass in vLLM

Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions

vLLM leaks a heap address when PIL throws an error

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution

vLLM affected by RCE via auto_map dynamic module loading during model initialization

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function

Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers

vLLM: OpenAI auth bypass

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Netty: HttpClientCodec response desynchronization

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`