Rubygem-hammer_cli: command injection via insecure editor invocation

Foreman: api filter lookup ignores a search-limited filter permission

Pulp-ansible: bearer tokens are reused across remotes in a worker

Pulp-container: registry credentials are reused across remotes in a worker

Rubygem-katello: sql injection in registry proxy via labels

Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup

Foreman: foreman: unauthorized modification of host configurations via broken access control

Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

Golang-fips: golang fips zeroed buffer

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data

Foreman: domain and subnet interface api skips host search filters

Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass

Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content

Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup

Potential SQL injection via QuerySet.order_by and FilteredRelation

Potential SQL injection in column aliases via control characters

Potential SQL injection via raster lookups on PostGIS

Pulp-rpm: distribution tree publish creates directories from .treeinfo ids

Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config

Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass

Rubygem-katello: improper authorization logic allows resource enumeration

Rubygem-foreman_remote_execution: job output readable without object-level view_job_invocations check

Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters

Rubygem-foreman_ansible: unscoped lookupvalue deletion allows cross-model override value destruction

Ketello: katello content view history api cross-organization authorization bypass

Foreman: foreman: information disclosure via improper validation of nested request parameters

Katello: missing repository authorization in content_uploads exposes cross-product content existence