CWE-1289 Improper Validation of Unsafe Equivalence in Input

Handlebars: JavaScript Injection via Own Property Check Bypass

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries

Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form

webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed

DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

mercure has Topic Selector Cache Key Collision

fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)

OpenFGA has an Authorization Bypass through cached keys

Ory Oathkeeper has an authentication bypass by cache key confusion

Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions

AngularJS allows attackers to bypass common image source restrictions

`idna` accepts Punycode labels that do not produce any non-ASCII when decoded