node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

Trustyai-explainability: command injection via lmevaljob cr

pip can extract console_scripts and gui_scripts outside installation directory

wheel Allows Arbitrary File Permission Modification via Path Traversal

Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursor

Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP

Argo Workflows affected by stored XSS in the artifact directory listing

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

net-imap: Command Injection via unvalidated Symbol inputs

Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

Openshift-ai: trusty ai grants all authenticated users to list pods in any namespace

Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations

Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers