OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.

Cross-monitor event media authorization bypass in direct event media endpoints

Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode

libks has path traversal in kws HTTP parser via URI segment overflow

Doco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configuration

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token…

libde265: SAO sequential filter heap buffer overflow via signed integer overflow

libde265: Pixel accessor signed integer overflow causes heap OOB read/write