Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

vm2: Sandbox Breakout Through Inspect

protobufjs has an arbitrary code execution issue

Handlebars.js has JavaScript Injection via AST Type Confusion

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write…

systeminformation has Command Injection via Unsanitized `locate` Output in `versions()`

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path

fast-uri vulnerable to path traversal via percent-encoded dot segments

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

path-to-regexp vulnerable to Denial of Service via sequential optional groups

undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

Koa has Host Header Injection via `ctx.hostname`

React Router vulnerable to XSS via Open Redirects

Rhdh: red hat developer hub user permissions

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

pip can extract console_scripts and gui_scripts outside installation directory

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain