Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

vLLM: OpenAI auth bypass

Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

fast-uri vulnerable to host confusion via failed IDN canonicalization

ws: Memory exhaustion DoS from tiny fragments and data chunks

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

ws: Uninitialized memory disclosure

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Pillow is vulnerable to a FITS GZIP decompression bomb

LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app

lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

Black: Arbitrary file writes from unsanitized user input in cache file name

ReDoS in multipart 1.3.0 - `parse_options_header()`

Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

Incorrect enforcement of email constraints in crypto/x509

Path Traversal in nltk/nltk

MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

Pillow has an out-of-bounds write when loading PSD images

Python-Multipart has Arbitrary File Write via Non-Default Configuration

pyasn1 has a DoS vulnerability in decoder

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Docker: `PUT /containers/{id}/archive` executes container binary on the host

LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

React Router vulnerable to XSS via Open Redirects

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

wheel Allows Arbitrary File Permission Modification via Path Traversal

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers