ws: Uninitialized memory disclosure

Quadratic string concatentation in consumeComment in net/mail

Quadratic string concatenation in consumePhrase in net/mail

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

xmldom: XML injection through unvalidated DocumentType serialization

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus Azure AD remote write OAuth client secret exposed via config API

An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Go JOSE affect by a panic in JWE decryption

Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console

Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding

Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled

Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo

smb: client: reject userspace cifs.spnego descriptions

Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege…

Inefficient candidate hostname parsing in crypto/x509

Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation

Samba: missing access check on reparse point operations

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

SpdyStream: DOS on CRI

Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect

ip-address: XSS in Address6 HTML-emitting methods

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain