Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server

Odh-dashboard: odh dashboard kubernetes service account exposure

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

protobufjs has an arbitrary code execution issue

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

lodash vulnerable to Code Injection via `_.template` imports key names

(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default

vLLM leaks a heap address when PIL throws an error

vLLM affected by RCE via auto_map dynamic module loading during model initialization

Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers

Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

LiteLLM has an authentication bypass via OIDC userinfo cache key collision