Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend

Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)

Wildfly-core: wildfly: arbitrary file read via malicious archive deployment

Jastow: jastow cross-site scripting attack due to unsanitized uri

Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload

Narayana: deadlock via multiple join requests sent to lra coordinator

Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak

Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers

Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver

Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap

Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.

Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators

Wildfly-core: path traversal on wildfly domain controller

Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram

Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions