RyotaK

Command injection via array-ish $command parameter of proc_open()

cgi.force_redirect configuration is bypassable due to the environment variable collision

Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions

Code execution in VSCode-bazel via malicious Bazel config files

Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write