CWE-665 Improper Initialization

DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

PyTorch: Manipulation of the argument scale/zero_point leads to improper initialization via Quantized Sigmoid Module

Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)

filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity

Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service

ArrayQueue's push_front is not panic-safe

IdMap from_iter may lead to uninitialized memory being freed on drop

@misskey-dev/summaly Redirect Filter Bypass

Interpreter crash from `tf.io.decode_raw`

Incomplete validation in `tf.raw_ops.CTCLoss`

Invalid validation in `QuantizeAndDequantizeV2`

Incomplete validation in `SparseReshape`

Incomplete validation in `SparseAdd`

Code execution vulnerability in HtmlUnit

Improper Initialization in Pillow

Moby Docker cp broken with debian containers

TPM 1.2 key authorization values vulnerable to TPM transport eavesdropper in go-tpm

Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure

Tokio reject_remote_clients configuration may get dropped when creating a Windows named pipe

NodeBB vulnerable to account takeover via prototype vulnerability

OpenZeppelin Contracts initializer reentrancy may lead to double initialization

Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued

Elrond-go has improper initialization