Jonatan Männchen / EEF

Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service

Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service

Filter expression injection via forged keyset pagination cursor in Ash

Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash

Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset

Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation

SQL injection via the :comment option in Postgrex.stream/4

JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts

Unescaped deployment environment variables in generated setup commands