Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Samba: remote code execution in samr

Possible arbitrary code execution during DNSSEC validation

Gnutls: gnutls: authentication bypass via nul character in username

protobufjs has an arbitrary code execution issue

Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

pyOpenSSL DTLS cookie callback buffer overflow

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function

Glib: glib: buffer underflow in gvariant parser leads to heap corruption

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710,…

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

Gnutls: gnutls: denial of service via dtls zero-length fragment

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Samba: samba: remote code execution in printing subsystem via unescaped job description