← All credits

Stan Ulbrych (https://github.com/StanFromIreland)

14 vulnerability records and advisories credit this contributor.

Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel

stringprep.map_table_b2() deviates from RFC 3454 Table B.2

bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow

Potential DoS via quadratic complexity in unicodedata.normalize()

CVE-2026-114583

tar filter allows writing outside destination via empty-named symlink

CVE-2026-116566

socket.getaddrinfo() accepts embedded null bytes in host and port

Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

tarfile hardlink fallback ignores custom extraction filter rejection via None

tarfile extraction filters allow file modification and content disclosure via hard link to symlink

The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection