Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)

Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path

Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity

Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege

Inefficient candidate hostname parsing in crypto/x509

Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputy

Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription

Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps

Must-gather: /tmp/kubeconfig retention

Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction

Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication

Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache

Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref