CVE-2014-7169 — bash secondary Shellshock parser-state leak via env function import

CVE-2020-16592: binutils libbfd UAF in section merging via hash table resize

CVE-2024-38428: GNU Wget url_skip_credentials mishandles ';' in userinfo, enabling hostname confusion