Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

Quarkus authorization bypass via semicolon path normalization inconsistency

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Path Traversal in keras-team/keras

Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

Safe Mode Bypass in keras-team/keras

Arbitrary Code Execution in feast-dev/feast

Kserve: kserve: server-side request forgery via malicious storageuri

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

fast-uri vulnerable to host confusion via failed IDN canonicalization

Mistune: Potential DoS via quadratic-time parsing in parse_link_text

vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read

Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

undici WebSocket client vulnerable to denial of service via fragment count bypass

ws: Memory exhaustion DoS from tiny fragments and data chunks

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios: Allocation of Resources Without Limits or Throttling in axios

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

ws: Uninitialized memory disclosure

Python-Multipart: Denial of Service via unbounded multipart part headers

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

protobufjs: Denial of service through unbounded protobuf recursion

Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow

Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

fast-uri vulnerable to path traversal via percent-encoded dot segments

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus Azure AD remote write OAuth client secret exposed via config API

Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Pillow is vulnerable to a FITS GZIP decompression bomb

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

GOSTCTR implementation unable to process more than 255 blocks correctly

ONNX: Path Traversal via Symlink

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Denial of service in github.com/jackc/pgproto3/v2