Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection

Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

gRPC-Go has an authorization bypass via missing leading slash in :path