An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642

Containers/image: digest type does not guarantee valid type

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run…

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

GOSTCTR implementation unable to process more than 255 blocks correctly

Incorrect enforcement of email constraints in crypto/x509

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed…

Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification

LDAP Injection Vulnerability in LDAPStoreHelper.java

Jenkins-image: sensitive data disclosure when using openshift jenkins image

Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)

Golang-fips: golang fips zeroed buffer

Buildah: buildah allows arbitrary directory mount