José Valim

Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir

httpc does not bound server-supplied numeric header values before integer conversion

eldap does not bound the port component of a referral URL before integer conversion

snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

uri_string does not bound the port component of a URI before integer conversion

SQL injection via the :comment option in Postgrex.stream/4

Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts

Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download

Livebook Teams identity callback lacks state binding, allowing login CSRF