shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

NGINX ngx_http_rewrite_module vulnerability

Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse

fast-uri vulnerable to host confusion via failed IDN canonicalization

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

fast-uri vulnerable to path traversal via percent-encoded dot segments

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type

Incorrect enforcement of email constraints in crypto/x509

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Python-Multipart has Arbitrary File Write via Non-Default Configuration

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking