Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server

Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication

Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization

Gnutls: gnutls: authentication bypass via nul character in username

Missing Authentication for Critical Function in mlflow/mlflow

vLLM affected by RCE via auto_map dynamic module loading during model initialization

Glib: glib: buffer underflow in gvariant parser leads to heap corruption

Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers

jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content

Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)

Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)

Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

Gnutls: gnutls: denial of service via dtls zero-length fragment