sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values sqlparse: sqlparse: Denial of Service via inefficient SQL parsing sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping

sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing sqlparse: sqlparse: Denial of Service via inefficient SQL parsing sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping

rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter foreman: unauthenticated information disclosure via provisioning token validation flaw foreman: command injection in foreman-rake errors:fetch_log via request_id parameter foreman: command injection in foreman-rake database tasks foreman: command injection in foreman-tail foreman: SSTI and insecure deserialization in foreman-rake configuration rubygem-hammer_cli: command injection via insecure editor invocation dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks GitPython: GitPython: Arbitrary code execution via improper validation of clone options mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing rubygem-katello: SQL injection in Registry Proxy via labels rubygem-katello: improper authorization logic allows resource enumeration net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input net/url: golang: golang net/url: Denial of Service f…

rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter foreman: unauthenticated information disclosure via provisioning token validation flaw foreman: command injection in foreman-rake errors:fetch_log via request_id parameter foreman: command injection in foreman-rake database tasks foreman: command injection in foreman-tail foreman: SSTI and insecure deserialization in foreman-rake configuration rubygem-hammer_cli: command injection via insecure editor invocation dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks GitPython: GitPython: Arbitrary code execution via improper validation of clone options mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing rubygem-katello: SQL injection in Registry Proxy via labels rubygem-katello: improper authorization logic allows resource enumeration net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denia…

rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter foreman: unauthenticated information disclosure via provisioning token validation flaw foreman: command injection in foreman-rake errors:fetch_log via request_id parameter foreman: command injection in foreman-rake database tasks foreman: command injection in foreman-tail foreman: SSTI and insecure deserialization in foreman-rake configuration rubygem-hammer_cli: command injection via insecure editor invocation dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header postcss: PostCSS: Information disclosure and denial of service via crafted CSS input sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing rubygem-katello: SQL injection in Registry Proxy via labels rubygem-katello: improper authorization logic allows resource enumeration html/template: golang: Go html/template: Cross-Site Scripting via pathological input net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations sqlparse: sqlparse: Denial of Service v…

ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion django: Django: Remote code execution via GeoDjango spatial lookups GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks GitPython: GitPython: Arbitrary code execution via improper validation of clone options GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing sqlparse: sqlparse: Denial of Service via inefficient SQL parsing gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options gitpython: GitPython: Command Injection via Git option prefix abbreviation sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding gitpython: GitPython: Information disclosure via environment variable expansion in URL handling gitpython: GitPython: Remote Code Execution via malicious Git template gitpython: GitPython: Arbitrary File Overwrite via improper git option validation gitpython: GitPython: Remote Code Execution via kwar…

ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion Automation-Controller: automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function django: Django: Remote code execution via GeoDjango spatial lookups encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks GitPython: GitPython: Arbitrary code execution via improper validation of clone options mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration. sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/templat…

ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration. sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing sqlparse: sqlparse: Denial of Service via inefficient SQL parsing automation-controller: automation-controller-container: automation-controller: Named-URL 404 body oracle enables cross-tenant resource name enumeration automation-controller: automation-controller-container: automation-controller: JobJobEventsChildrenSummary RBAC bypass exposes cross-tenant job event tree structure automation-controller: automation-controller-container: automation-controller: Any authenticated user reads Red Hat subscription/license details via /config/ automation-controller: automation-controller-container: automation-controller: Verbose internal exception disclosure via HostList bare-Exception handler automation-controller: automation-controller-container: automation-controller: CUSTOM_VENV_PATH setting provides filesystem path-existence oracle on co…

Automation-Controller: automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages js-yaml: js-yaml: Denial of Service via crafted YAML documents sqlparse: sqlparse: Denial of Service via inefficient SQL parsing gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options gitpython: GitPython: Command Injection via Git option prefix abbreviation brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation postcss: PostCSS: Information disclosure via crafted sourceMappingURL automation-controller: automation-controller-container: automation-controller: Named-URL 404 body oracle…

Automation-Controller: automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages js-yaml: js-yaml: Denial of Service via crafted YAML documents sqlparse: sqlparse: Denial of Service via inefficient SQL parsing nanoid: nanoid: Denial of Service via negative size input in non-secure module functions gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options gitpython: GitPython: Command Injection via Git option prefix abbreviation postcss: PostCSS: Information disclosure via crafted sourceMappingURL automation-controller: automation-controller-container: automation-controller: Named-URL 404 body oracle enable…