Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane

Heap Use-After-Free in the PKCS7_verify() Function

Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O…

Moby: Off-by-one error in plugin privilege validation

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

Denial of service in github.com/jackc/pgproto3/v2

path-to-regexp vulnerable to Denial of Service via sequential optional groups

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions

Docker: `PUT /containers/{id}/archive` executes container binary on the host