Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

path-to-regexp vulnerable to Denial of Service via sequential optional groups

NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app

lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

flatted: Unbounded recursion DoS in parse() revive phase

Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown…

Path Traversal in nltk/nltk

Pillow has an out-of-bounds write when loading PSD images

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Python-Multipart has Arbitrary File Write via Non-Default Configuration

WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect

pyasn1 has a DoS vulnerability in decoder

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component

Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery

Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversal

Pulp-ansible: bearer tokens are reused across remotes in a worker

Pulp-container: registry credentials are reused across remotes in a worker

Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter oracle

Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure

LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

Golang-fips: golang fips zeroed buffer

Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)

Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction

Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions

Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential

React Router vulnerable to XSS via Open Redirects

Controller: cross site scripting in automation controller ui

Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directory

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification

Jwcrypto: jwcrypto: denial of service via malformed jwe tokens

pip can extract console_scripts and gui_scripts outside installation directory

wheel Allows Arbitrary File Permission Modification via Path Traversal

Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)