Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery

Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversal

Pulp-ansible: bearer tokens are reused across remotes in a worker

Pulp-container: registry credentials are reused across remotes in a worker

Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter oracle

Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure

LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

Golang-fips: golang fips zeroed buffer

Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)

Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction

Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions

Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential

Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directory

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification

Jwcrypto: jwcrypto: denial of service via malformed jwe tokens

pip can extract console_scripts and gui_scripts outside installation directory

Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)

Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration

Aap-mcp-server: aap mcp server: log injection allows social engineering attacks via unsanitized input

Awxkit: path traversal via yaml !include directive

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler