Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster

Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation

Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check

Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha

fast-uri vulnerable to host confusion via failed IDN canonicalization

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Quadratic string concatentation in consumeComment in net/mail

Crash when handling long CNAME response in net

Quadratic string concatenation in consumePhrase in net/mail

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Unexpected work during chain building in crypto/x509

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Go JOSE affect by a panic in JWE decryption

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join