Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters

Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handler

Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method

HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping

HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping

HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message

fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address

Hawtio-operator: hawtio-operator: oauthclient created with grantmethod auto and no secret enables oauth token theft