Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content

vLLM: OpenAI auth bypass

JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.

jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix

fast-uri vulnerable to host confusion via failed IDN canonicalization

Python-Multipart: Denial of Service via unbounded multipart part headers

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Quadratic string concatentation in consumeComment in net/mail

Quadratic string concatenation in consumePhrase in net/mail

Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

AIOHTTP Vulnerable to Deserialization of Untrusted Data

jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat

pip can extract console_scripts and gui_scripts outside installation directory

Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP

opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation