GHSA-WHVH-WF3X-G77J JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)

The extension allowlist/blocklist check inside PyPIExtensionManager.install was not enforced due to a missing await. For purposes of JupyterLab this was a secondary defense-in-depth check: install was intended to enforce the allowlist/blocklist itself for any future uses and users calling this...

GHSA-V2GC-RM6G-WRW9 Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution

The SSRF validation in Craft CMS’s GraphQL Asset mutation uses gethostbyname, which only resolves IPv4 addresses. When a hostname has only AAAA IPv6 records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection...