CWE-672 Operation on a Resource after Expiration or Release

nebula-mesh: Certificate revocation is never enforced at the mesh

Sylius: Cart FormComponent allows modification or deletion of an already-completed order

Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows

zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip

Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields

Duplicate Advisory: OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload

OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation

Duplicate Advisory: OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation

Parse Server's MFA recovery codes not consumed after use

Hyperledger Fabric does not verify request has a timestamp within the expected time window

Rust XCB `xcb::Connection::connect_to_fd*` functions violate I/O safety

Wasmtime CLI is vulnerable to host panic through its fd_renumber function

Suspended Directus user can continue to use session token to access API

array-init-cursor is unsound when used with types that implement `Drop`

JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh

ZITADEL Allows Unauthorized Access After Organization or Project Deactivation

ZITADEL's Service Users Deactivation not Working

ZITADEL's User Grant Deactivation not Working

Mio's tokens for named pipes may be delivered after deregistration

Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry

Possibility to circumvent the invitation token expiry period

Pow Mnesia cache doesn't invalidate all expired keys on startup

Update unsound DrainFilter and RString::retain

receiving subscription objects with deleted session