Netty has Insufficient Bailiwick Validation for NS Records

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server

Odh-dashboard: odh dashboard kubernetes service account exposure

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader

protobufjs has an arbitrary code execution issue

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

lodash vulnerable to Code Injection via `_.template` imports key names

(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.

SSRF Protection Bypass in vLLM

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

vLLM leaks a heap address when PIL throws an error

vLLM affected by RCE via auto_map dynamic module loading during model initialization

Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers

Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)

Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)

vLLM: OpenAI auth bypass

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Netty: HttpClientCodec response desynchronization

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

LiteLLM has an authentication bypass via OIDC userinfo cache key collision

ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack