Gnutls: gnutls: denial of service via dtls packet reordering vulnerability

ws: Uninitialized memory disclosure

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

fast-uri vulnerable to path traversal via percent-encoded dot segments

Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

nghttp2 Denial of service: Assertion failure due to the missing state validation

Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive

Axios affected by Denial of Service via __proto__ Key in mergeConfig

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

Libtiff: tiffrasterscanlinesize64 produce too-big size and could cause oom

Gnutls: gnutls: security bypass due to incorrect name constraint handling

Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

AIOHTTP Vulnerable to Deserialization of Untrusted Data

attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr

acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Rsync: rsync server leaks arbitrary client files

Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow

Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

React Router vulnerable to XSS via Open Redirects

Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions

pip can extract console_scripts and gui_scripts outside installation directory

Tar: tar: hidden file injection via crafted archives

wheel Allows Arbitrary File Permission Modification via Path Traversal

Libxslt: use-after-free with key data stored cross-rvt

Potential SQL injection via QuerySet.order_by and FilteredRelation

Potential SQL injection in column aliases via control characters

Potential SQL injection via raster lookups on PostGIS

Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering

Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling

Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Gnutls: vulnerability in gnutls sct extension parsing

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape