Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter

Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

Forman: foreman: remote code execution via command injection in websocket proxy

Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username

Foreman: command injection in foreman-rake database tasks

Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

Fog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validation

Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

Foreman: os command injection via ct_location and fcct_location parameters

Foreman: command injection in foreman-tail

Foreman: ssti and insecure deserialization in foreman-rake configuration

Foreman: unauthenticated information disclosure via provisioning token validation flaw

Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

ws: Memory exhaustion DoS from tiny fragments and data chunks

ws: Uninitialized memory disclosure

Python-Multipart: Denial of Service via unbounded multipart part headers

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

ReDoS in multipart 1.3.0 - `parse_options_header()`

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown…

Pillow has an out-of-bounds write when loading PSD images

Python-Multipart has Arbitrary File Write via Non-Default Configuration

jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

pyasn1 has a DoS vulnerability in decoder

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

Rubygem-mqtt: rubygem-mqtt hostname validation

AIOHTTP Vulnerable to Deserialization of Untrusted Data