Potential SQL injection via QuerySet.order_by and FilteredRelation

Potential SQL injection in column aliases via control characters

Potential SQL injection via raster lookups on PostGIS

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration

Aap-mcp-server: aap mcp server: log injection allows social engineering attacks via unsanitized input

Event-driven automation in ansible automation platform (aap): ansible event-driven automation (eda) lacks encryption

Awxkit: path traversal via yaml !include directive

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler

Aap: aap-gateway: automation-hub: sensitive information disclosure

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api key

Aap: sensitive cookie(s) set without security flags

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled