Jonatan Männchen / EEF

Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax

Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)

Unbounded memory allocation in highlight_lines range expansion in mdex

Atom-table exhaustion denial-of-service via JSON parse_document in MDEx

Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service

Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex

Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute

Plug: quadratic-time decoding of nested query/body parameters enables denial of service

Stored XSS via unescaped HTML attribute values in earmark

OAuth2/OIDC account takeover in AshAuthentication via email-based user matching