Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

pyOpenSSL DTLS cookie callback buffer overflow

Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification

mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter

Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

Forman: foreman: remote code execution via command injection in websocket proxy

Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username

Foreman: command injection in foreman-rake database tasks

Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

Fog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validation

Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

Foreman: os command injection via ct_location and fcct_location parameters

Foreman: command injection in foreman-tail

Foreman: ssti and insecure deserialization in foreman-rake configuration

Foreman: unauthenticated information disclosure via provisioning token validation flaw

Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

ws: Memory exhaustion DoS from tiny fragments and data chunks

ws: Uninitialized memory disclosure

Python-Multipart: Denial of Service via unbounded multipart part headers

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

ReDoS in multipart 1.3.0 - `parse_options_header()`

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown…

Pillow has an out-of-bounds write when loading PSD images

Python-Multipart has Arbitrary File Write via Non-Default Configuration

jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

pyasn1 has a DoS vulnerability in decoder

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

Rubygem-mqtt: rubygem-mqtt hostname validation

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Rubygem-hammer_cli: command injection via insecure editor invocation

Foreman: api filter lookup ignores a search-limited filter permission

Pulp-ansible: bearer tokens are reused across remotes in a worker

Pulp-container: registry credentials are reused across remotes in a worker

Rubygem-katello: sql injection in registry proxy via labels

Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup

Foreman: foreman: unauthorized modification of host configurations via broken access control

Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass