Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

CVE-2026-33816 in github.com/jackc/pgx

lodash vulnerable to Code Injection via `_.template` imports key names

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

fast-uri vulnerable to host confusion via failed IDN canonicalization

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Crash when handling long CNAME response in net

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus Azure AD remote write OAuth client secret exposed via config API

path-to-regexp vulnerable to Denial of Service via sequential optional groups

flatted: Unbounded recursion DoS in parse() revive phase

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

React Router vulnerable to XSS via Open Redirects

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled