Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation

Possible arbitrary code execution during DNSSEC validation

Gnutls: gnutls: authentication bypass via nul character in username

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

CVE-2026-33816 in github.com/jackc/pgx

CVE-2026-33815 in github.com/jackc/pgx

pyOpenSSL DTLS cookie callback buffer overflow

Glib: glib: buffer underflow in gvariant parser leads to heap corruption

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

MariaDB: mysql_real_escape_string() incorrectly handled big5

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Gnutls: gnutls: denial of service via dtls zero-length fragment

Ruby JSON has a format string injection vulnerability

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths

Libxml: heap use after free (uaf) leads to denial of service (dos)

Libxml: type confusion leads to denial of service (dos)