Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

lodash vulnerable to Code Injection via `_.template` imports key names

pyOpenSSL DTLS cookie callback buffer overflow

Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution

Eda-server: websocket missing authorization allows credential theft via activation_id spoofing

Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

fast-uri vulnerable to path traversal via percent-encoded dot segments

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

Black: Arbitrary file writes from unsanitized user input in cache file name

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Pillow has an out-of-bounds write when loading PSD images

Axios affected by Denial of Service via __proto__ Key in mergeConfig

pyasn1 has a DoS vulnerability in decoder

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Aap-gateway: improper path validation in gateway allows credential exfiltration

Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams

Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions

pip can extract console_scripts and gui_scripts outside installation directory

Potential SQL injection via QuerySet.order_by and FilteredRelation

Potential SQL injection in column aliases via control characters

Potential SQL injection via raster lookups on PostGIS

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions