Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Quay: unauthenticated secscan notification endpoint in quay when psk is unset

Quay: red hat quay: authentication bypass allows privileged actions without valid credentials

Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope

Quay: unauthenticated exported logs download in quay

Quay: stripe webhook accepts forged events without signature verification in quay

ws: Memory exhaustion DoS from tiny fragments and data chunks

ws: Uninitialized memory disclosure

Quay: ssrf via build archive_url in quay build api

Quay: ldap referral filter injection in quay external ldap authentication

Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable

Quay: build trigger uuid idor in quay api

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

Quay: quay: global read-only superuser can access build trigger write credentials

Quay: ssrf in red hat quay notification webhooks (slack/generic)

Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter

Quay: jwt claim validation bypasses in quay federated robot and sso authentication

Quay: quay: stored xss via filedrop svg upload

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

Quay: repository notification uuid idor in quay api

Claircore: claircore: denial of service via unchecked type assertion in rpm header parser

Claircore: claircore: denial of service via out-of-bounds slice in claircore's apk installed-database parser

Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page

Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

Quay: repository auto-prune policy uuid idor in quay api

Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring