CWE-670 Always-Incorrect Control Flow Implementation

incorrect order of evaluation of side effects for some builtins

cut: -s (only-delimited) ignored when delimiter is a newline

Duplicate Advisory: uutils coreutils has an Issue With its Always-Incorrect Control Flow Implementation

ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction

wasmtime has a runtime crash when combining tail calls with trapping imports

Duplicate Advisory: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Wasmtime has host panic when Winch compiler executes `table.fill`

Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache

FastChat has a Content Moderation Bypass via Arena Side-by-Side Views

OpenClaw: Endpoint persists after trust decline, leaking gateway credentials

Nest Fastify HEAD Request Middleware Bypass

Cosmos EVM: incorrect state handling during nested EVM execution paths

The rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide

Requests `Session` object does not verify requests after making first request with verify=False

tough terminating targets role delegations are not respected

btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality

Vyper: reversed order of side effects for some operations

http-proxy-middleware can call writeBody twice because "else if" is not used

Vyper Does Not Check the Success of Certain Precompile Calls

In Gradio, the `enable_monitoring` flag set to `False` does not disable monitoring

Keycloak's improper input validation allows using email as username

Vyper's nonpayable default functions are sometimes payable

Incorrect success value returned in vyper

Multiple evaluation of contract address in call in vyper

Tor Arti's STUB circuits incorrectly have a length of 2