Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed

Submariner-operator: rbac permissions can allow for the spread of node compromises

Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity

SpdyStream: DOS on CRI

Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps

Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)

Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Coredns: cd bit response is cached and served later

Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref