Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Odh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputy

Guardrails-detectors: guardrails-detectors: unauthenticated regular-expression denial of service (redos) via detector_params.regex

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

React Router vulnerable to XSS via Open Redirects

pip can extract console_scripts and gui_scripts outside installation directory

wheel Allows Arbitrary File Permission Modification via Path Traversal

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain