ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

gRPC-Go has an authorization bypass via missing leading slash in :path

An issue was discovered in OpenStack Keystone before 29.0.2

An issue was discovered in OpenStack Keystone before 29.0.2

Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

Containers/image: digest type does not guarantee valid type

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1

nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification

An issue was discovered in OpenStack Keystone before 29.0.2

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Long list of incoming EDNS options degrades performance

Crash when handling long CNAME response in net

Unexpected work during chain building in crypto/x509

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Incorrect parsing of IPv6 host literals in net/url

Incorrect enforcement of email constraints in crypto/x509

Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0

OCSP designated-responder authorization bypass via missing signature verification

Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token

Inefficient candidate hostname parsing in crypto/x509

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

Jwcrypto: jwcrypto: denial of service via malformed jwe tokens

Openvswitch: open vswitch: denial of service via malformed ftp epasv command

OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF)

Non-CA certificate accepted as intermediate issuer in public_key path validation

Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results