CWE-1286 Improper Validation of Syntactic Correctness of Input

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts

Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration

Keycloak: Denial of Service via specially crafted SAML input

Rack::Request accepts invalid Host characters, enabling host allowlist bypass

Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

uv has ZIP payload obfuscation through parsing differentials

FacturaScripts has SQL Injection in API ORDER BY Clause

Express.js Open Redirect in malformed URLs

Amazon.IonDotnet is vulnerable to Denial of Service attacks

github.com/nyaruka/phonenumbers Vulnerable to Improper Validation of Syntactic Correctness of Input

github.com/google/nftable IP addresses were encoded in the wrong byte order

golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability

Traefik affected by Go oauth2/jws Improper Validation of Syntactic Correctness of Input vulnerability

Eclipse Jetty URI parsing of invalid authority

Denial of Service in TYPO3 Bookmark Toolbar

protobuf-cpp and protobuf-python have potential Denial of Service issue