Path Traversal in nltk/nltk

Koa has Host Header Injection via `ctx.hostname`

Pillow has an out-of-bounds write when loading PSD images

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Fastify's Content-Type header tab character allows body validation bypass

Python-Multipart has Arbitrary File Write via Non-Default Configuration

pyasn1 has a DoS vulnerability in decoder

Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Apache Thrift: TSSLTransportFactory.java hostname verification

Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy

vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`

Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user

Odh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputy

Guardrails-detectors: guardrails-detectors: unauthenticated regular-expression denial of service (redos) via detector_params.regex

Inefficient candidate hostname parsing in crypto/x509

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

ip-address: XSS in Address6 HTML-emitting methods

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

React Router vulnerable to XSS via Open Redirects

Feast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalation

pip can extract console_scripts and gui_scripts outside installation directory

wheel Allows Arbitrary File Permission Modification via Path Traversal

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Openshift-ai: trusty ai grants all authenticated users to list pods in any namespace