Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

ws: Uninitialized memory disclosure

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

fast-uri vulnerable to path traversal via percent-encoded dot segments

Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

Go JOSE affect by a panic in JWE decryption

Docker: `PUT /containers/{id}/archive` executes container binary on the host

OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

SpdyStream: DOS on CRI

Noobaa-core: excessive permissions of /etc could lead to escalation of privilege in the noobaa-core container

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

ip-address: XSS in Address6 HTML-emitting methods

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh