EQSTLab

@fastify/http-proxy vulnerable to prefix escape via backslash dot-segments

Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Purpose-limited JWT accepted as full bearer authentication in AshAuthentication

hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass

@fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header

ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV

clawvet < 0.7.5 Hard-coded JWT Secret Session Forgery

Network-AI before 5.13.4 Cryptographic Signature Verification Bypass