Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

pyasn1: Uncontrolled resource consumption when converting decoded REAL values

pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

node-tar: Negative tar entry size causes infinite loop in archive replace

node-tar: Decompression/parse DoS via unlimited input

node-tar: Process crash via PAX numeric path type confusion

js-yaml: YAML merge-key chains can force quadratic CPU consumption

Vim: Arbitrary Code Execution via PHP Omni-Completion

Libssh: libssh: use-after-free via data callbacks on closed channels

Libssh: libssh: denial of service via sftp responses with unknown request ids

Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

Libssh: libssh: information disclosure via proxycommand %r username expansion

Libssh: libssh: denial of service via unchecked proxycommand fork() failure

Libssh: libssh: denial of service via oversized sftp read length

Libssh: libssh: denial of service via zero advertised channel packet size

GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace

etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation