golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass postcss: PostCSS: Information disclosure and denial of service via crafted CSS input ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification postcss: PostCSS: Information disclosure via crafted sourceMappingURL tar: node-tar: Denial of Service via crafted long-path tar archive

fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object openstack-ironic: openstack-ironic: Arbitrary IPMI command execution via send_raw deployment step

shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame openstack-ironic: openstack-ironic: Arbitrary IPMI command execution via send_raw deployment step

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation browserslist: Browserslist: Prototype pollution leading to denial of service browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results js-yaml: js-yaml: Denial of Service via exponential parsing in flow collections

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters ironic-python-agent: OpenStack ironic-python-agent: Arbitrary code execution via malicious image js-yaml: js-yaml: Denial of Service via crafted YAML documents

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation js-yaml: js-yaml: Denial of Service via exponential parsing in flow collections

form-data: form-data: Form field override via CRLF injection net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters ironic-python-agent: OpenStack ironic-python-agent: Arbitrary code execution via malicious image golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability openstack-ironic: openstack-ironic: Arbitrary IPMI command execution via send_raw deployment step js-yaml: js-yaml: Denial of Service via crafted YAML documents ironic-python-agent: OpenStack Ironic Python Agent: Arbitrary code execution via malicious configuration nanoid: nanoid: Predictable ID generation due to integer overflow tar: node-tar: Denial of Service via crafted long-path tar archive

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame browserslist: Browserslist: Prototype pollution leading to denial of service browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results js-yaml: js-yaml: Denial of Service via exponential parsing in flow collections

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass postcss: PostCSS: Information disclosure and denial of service via crafted CSS input linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability openstack-ironic: openstack-ironic: Arbitrary IPMI command execution via send_raw deployment step postcss: PostCSS: Information disclosure via crafted sourceMappingURL tar: node-tar: Denial of Service via crafted long-path tar archive