Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

pyOpenSSL DTLS cookie callback buffer overflow

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and…

Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in…