José Valim

uri_string does not bound the port component of a URI before integer conversion

Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir

Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

SQL injection via the :comment option in Postgrex.stream/4

Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service

Plug: quadratic-time decoding of nested query/body parameters enables denial of service

Unbounded buffer accumulation in multipart header parsing causes denial of service in plug