pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

ReDoS in multipart 1.3.0 - `parse_options_header()`

Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Path Traversal in nltk/nltk

Pillow has an out-of-bounds write when loading PSD images

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Python-Multipart has Arbitrary File Write via Non-Default Configuration

pyasn1 has a DoS vulnerability in decoder

Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy

Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames

Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack

vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`

Odh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputy

Guardrails-detectors: guardrails-detectors: unauthenticated regular-expression denial of service (redos) via detector_params.regex

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

React Router vulnerable to XSS via Open Redirects

pip can extract console_scripts and gui_scripts outside installation directory

wheel Allows Arbitrary File Permission Modification via Path Traversal

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled

Libxml2: stack buffer overflow in xmllint interactive shell command handling