Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore

Puppet-foreman: an authentication bypass vulnerability exists in foreman

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Foreman: excessive permissions for viewer role on preview

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

Foreman: foreman: arbitrary code execution via safemode sandbox bypass

Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter

Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

Forman: foreman: remote code execution via command injection in websocket proxy

Foreman: command injection in foreman-rake database tasks

Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

Foreman: command injection in foreman-tail

Foreman: ssti and insecure deserialization in foreman-rake configuration

Foreman: unauthenticated information disclosure via provisioning token validation flaw

Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

Crash when handling long CNAME response in net

Pillow is vulnerable to a FITS GZIP decompression bomb

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

AIOHTTP Vulnerable to Deserialization of Untrusted Data

Rubygem-hammer_cli: command injection via insecure editor invocation

Rubygem-katello: sql injection in registry proxy via labels

Foreman: foreman: unauthorized modification of host configurations via broken access control

Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass

Inefficient candidate hostname parsing in crypto/x509

Rubygem-katello: improper authorization logic allows resource enumeration

Ketello: katello content view history api cross-organization authorization bypass

Foreman: foreman: information disclosure via improper validation of nested request parameters

Katello: missing repository authorization in content_uploads exposes cross-product content existence