Netty has Insufficient Bailiwick Validation for NS Records

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

Containers/image: digest type does not guarantee valid type

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

Netty's wrapping plain trust manager silently disables hostname verification

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

Micrometer HTTP server instrumentations DoS vulnerability

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash

Podman: arbitrary file write when importing oci archive

pip can extract console_scripts and gui_scripts outside installation directory

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

Cockpit: cockpit: unauthorized modification of login records via integer overflow

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers