NGINX ngx_http_mp4_module vulnerability

NGINX ngx_http_dav_module vulnerability

NGINX ngx_mail_auth_http_module vulnerability

Valkey has Pre-Authentication DOS from malformed RESP request

Underscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

nats-server websockets are vulnerable to pre-auth memory DoS

pyOpenSSL DTLS cookie callback buffer overflow

util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup

pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

Cloud Hypervisor: Host File Exfiltration via QCOW Backing File Abuse

Werkzeug safe_join() allows Windows special device names

zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.

Inefficient candidate hostname parsing in crypto/x509

Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile

Missing bound checks can lead to memory corruption in safe Go in cmd/compile

URLs in meta content attribute actions are not escaped in html/template

Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net

Code execution vulnerability in SWIG code generation in cmd/go