Foreman: foreman: arbitrary code execution via safemode sandbox bypass

Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter

Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

Forman: foreman: remote code execution via command injection in websocket proxy

Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username

Foreman: command injection in foreman-rake database tasks

Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

Fog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validation

Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification

Foreman: os command injection via ct_location and fcct_location parameters

Foreman: command injection in foreman-tail

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

Foreman: ssti and insecure deserialization in foreman-rake configuration

Foreman: unauthenticated information disclosure via provisioning token validation flaw

Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

Crash when handling long CNAME response in net

Pillow is vulnerable to a FITS GZIP decompression bomb

Unexpected work during chain building in crypto/x509

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Incorrect parsing of IPv6 host literals in net/url

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown…

Rexml: rexml: denial of service via inefficient regex parsing

Pillow has an out-of-bounds write when loading PSD images

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

AIOHTTP Vulnerable to Deserialization of Untrusted Data