Red Hat would like to thank Yonghwa Lee (Xint by Theori) for reporting this issue.

Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens