Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr

FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

lodash vulnerable to Code Injection via `_.template` imports key names

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

NGINX ngx_http_rewrite_module vulnerability

Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse

fast-uri vulnerable to host confusion via failed IDN canonicalization

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

fast-uri vulnerable to path traversal via percent-encoded dot segments

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type

Incorrect enforcement of email constraints in crypto/x509

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Python-Multipart has Arbitrary File Write via Non-Default Configuration

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

FastMCP OAuth Proxy token reuse across MCP servers

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

Foreman-mcp-server: mcp server: insecure sensitive http header sanitization

wheel Allows Arbitrary File Permission Modification via Path Traversal

Potential SQL injection via QuerySet.order_by and FilteredRelation

Potential SQL injection in column aliases via control characters

Potential SQL injection via raster lookups on PostGIS

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled