Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery

Aap-gateway: improper path validation in gateway allows credential exfiltration

Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams

Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda

Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames

Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle

Inefficient candidate hostname parsing in crypto/x509

Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass

React Router vulnerable to XSS via Open Redirects

pip can extract console_scripts and gui_scripts outside installation directory

wheel Allows Arbitrary File Permission Modification via Path Traversal

Potential SQL injection via QuerySet.order_by and FilteredRelation

Potential SQL injection in column aliases via control characters

Potential SQL injection via raster lookups on PostGIS

Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates

Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure

Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Awxkit: path traversal via yaml !include directive

Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust

Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/

Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod