Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

pyOpenSSL DTLS cookie callback buffer overflow

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and…

Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in…

Mirror-registry: remote code execution using pickle deserialization

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

fast-uri vulnerable to host confusion via failed IDN canonicalization

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios: Allocation of Resources Without Limits or Throttling in axios

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

kafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.py

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Quadratic string concatentation in consumeComment in net/mail

Quadratic string concatenation in consumePhrase in net/mail

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus Azure AD remote write OAuth client secret exposed via config API

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Pillow is vulnerable to a FITS GZIP decompression bomb

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

Denial of service in github.com/jackc/pgproto3/v2

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation…

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Pillow has an out-of-bounds write when loading PSD images

Axios affected by Denial of Service via __proto__ Key in mergeConfig

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Mirror-registry: quay: insecure direct object reference in blobupload

Quay: quay: global read-only superuser can view robot account tokens