Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

CVE-2026-33816 in github.com/jackc/pgx

CVE-2026-33815 in github.com/jackc/pgx

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane

Heap Use-After-Free in the PKCS7_verify() Function

Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O…

Moby: Off-by-one error in plugin privilege validation

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

Denial of service in github.com/jackc/pgproto3/v2

path-to-regexp vulnerable to Denial of Service via sequential optional groups

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions

Docker: `PUT /containers/{id}/archive` executes container binary on the host

Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend

Mce: privilege escalation via excessive /etc/passwd permissions

Maestro: maestro: rest api write endpoints registered without authentication middleware

SpdyStream: DOS on CRI

Maestro: sql identifier injection via properties.* search filter and orderby field

Assisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view users

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

ip-address: XSS in Address6 HTML-emitting methods

Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers