Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed

Submariner-operator: rbac permissions can allow for the spread of node compromises

Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity

SpdyStream: DOS on CRI

Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

React Router vulnerable to XSS via Open Redirects

Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps

Rhacm: users with clusterreader role can see credentials from managed-clusters

Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)

Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

Coredns: cd bit response is cached and served later

Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref