Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke

Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters

Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses

Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spoke

Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials

Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references

Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace

Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces

Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace enabling cross-namespace secret exfiltration

Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos

fast-uri vulnerable to host confusion via failed IDN canonicalization

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios: Allocation of Resources Without Limits or Throttling in axios

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

iskorotkov/avro: CPU Exhaustion in Avro Decoder

iskorotkov/avro: Integer Overflow in Avro Decoder

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Crash when handling long CNAME response in net

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Prometheus Azure AD remote write OAuth client secret exposed via config API

Apache Thrift: Go TFramedTransport uint32 overflow

Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Apache Thrift: TSSLTransportFactory.java hostname verification

Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response