alimony

Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

Grav before 2.0.15 Stored XSS via audio/video source URL

Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply

GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()

@fastify/static vulnerable to route guard bypass via non-canonical path segments