Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move()

Apache Thrift: C++ JSON OOB read

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

Ffmpeg: ffmpeg: denial of service and potential arbitrary code execution via signed integer overflow in dvd subtitle parser

ip-address: XSS in Address6 HTML-emitting methods

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

Next.js: Denial of Service in the Image Optimization API

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

pip can extract console_scripts and gui_scripts outside installation directory

wheel Allows Arbitrary File Permission Modification via Path Traversal

Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursor

Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL

Apache Thrift: c_glib dispatch stack overflow

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations