Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

lodash vulnerable to Code Injection via `_.template` imports key names

Handlebars.js has JavaScript Injection via AST Type Confusion

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

launch-editor vulnerable to command injection via the crafted request on Windows

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

fast-uri vulnerable to host confusion via failed IDN canonicalization

undici WebSocket client vulnerable to denial of service via fragment count bypass

ws: Memory exhaustion DoS from tiny fragments and data chunks

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

fast-uri vulnerable to path traversal via percent-encoded dot segments

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

Forge has signature forgery in Ed25519 due to missing S > L check

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

Inefficient candidate hostname parsing in crypto/x509

SpdyStream: DOS on CRI