Foreman: foreman: arbitrary code execution via safemode sandbox bypass

Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter

Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

Forman: foreman: remote code execution via command injection in websocket proxy

Foreman: command injection in foreman-rake database tasks

Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

Foreman: command injection in foreman-tail

Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

Foreman: ssti and insecure deserialization in foreman-rake configuration

Foreman: unauthenticated information disclosure via provisioning token validation flaw

Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

Crash when handling long CNAME response in net

Pillow is vulnerable to a FITS GZIP decompression bomb

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

AIOHTTP Vulnerable to Deserialization of Untrusted Data