Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function

Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

pyasn1 has a DoS vulnerability in decoder

React Router vulnerable to XSS via Open Redirects

pip can extract console_scripts and gui_scripts outside installation directory

wheel Allows Arbitrary File Permission Modification via Path Traversal