Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

NGINX ngx_http_rewrite_module vulnerability

Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse

fast-uri vulnerable to host confusion via failed IDN canonicalization

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios: Allocation of Resources Without Limits or Throttling in axios

Python-Multipart: Denial of Service via unbounded multipart part headers

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Foreman-mcp-server: mcp server: insecure sensitive http header sanitization

ip-address: XSS in Address6 HTML-emitting methods