Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

lodash vulnerable to Code Injection via `_.template` imports key names

Handlebars.js has JavaScript Injection via AST Type Confusion

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass

Go JOSE affect by a panic in JWE decryption

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

path-to-regexp vulnerable to Denial of Service via sequential optional groups

Incorrect enforcement of email constraints in crypto/x509

Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)

Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)

Traefik mTLS bypass via fragmented ClientHello SNI extraction failure

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain