jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

undici WebSocket client vulnerable to denial of service via fragment count bypass

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Netty's wrapping plain trust manager silently disables hostname verification

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

Micrometer HTTP server instrumentations DoS vulnerability

Micrometer gRPC server instrumentation DoS vulnerability

Quadratic string concatentation in consumeComment in net/mail

Quadratic string concatenation in consumePhrase in net/mail

Go JOSE affect by a panic in JWE decryption