Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding

Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user

Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move()

LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

Ffmpeg: ffmpeg: denial of service and potential arbitrary code execution via signed integer overflow in dvd subtitle parser

vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

Trustyai-service-operator: trustyai service operator: gorch port bypass when auth is enabled

Trustyai-service-operator: trustyai service operator: unauthenticated access to ai guardrails and orchestrator apis

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

React Router vulnerable to XSS via Open Redirects

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

Jwcrypto: jwcrypto: denial of service via malformed jwe tokens

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

Trustyai-explainability: command injection via lmevaljob cr

pip can extract console_scripts and gui_scripts outside installation directory

wheel Allows Arbitrary File Permission Modification via Path Traversal

Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursor

Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP

Argo Workflows affected by stored XSS in the artifact directory listing

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

net-imap: Command Injection via unvalidated Symbol inputs

Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

Openshift-ai: trusty ai grants all authenticated users to list pods in any namespace

Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations