Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Argocd-image-updater: argocd image updater: cross-namespace privilege escalation via insufficient namespace validation

Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint

Apache Thrift: Swift Range crash in skip()

Gitops-operator: gitops-operator: missing allowednamespace check in reconcilerhook for clusterrole/role cases enables potential privilege escalation and dos

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus Azure AD remote write OAuth client secret exposed via config API

Apache Thrift: Go TFramedTransport uint32 overflow

Denial of service in github.com/buger/jsonparser

path-to-regexp vulnerable to Denial of Service via sequential optional groups

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

Apache Thrift: Swift Compact Protocol integer overflow

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Apache Thrift: C++ JSON OOB read

SpdyStream: DOS on CRI

Golang-fips: golang fips zeroed buffer

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

React Router vulnerable to XSS via Open Redirects

Keycloak: xss via assertion consumer service url in saml post-binding flow

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

Apache Thrift: c_glib dispatch stack overflow

Traefik mTLS bypass via fragmented ClientHello SNI extraction failure

Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled