Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

protobufjs has an arbitrary code execution issue

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing

Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller

protobufjs: Denial of service through unbounded protobuf recursion

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus Azure AD remote write OAuth client secret exposed via config API

Apache Thrift: Go TFramedTransport uint32 overflow

Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.

Tempo query limit results in unbounded memory allocation

Docker: `PUT /containers/{id}/archive` executes container binary on the host

Community.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hardcode validate_certs=false with no override, enabling tls man-in-the-middle and credential disclosure

OpenFGA Playground Preshared Key Exposure

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames

Ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listings

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript