Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Code execution vulnerability in SWIG code generation in cmd/go

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Containers/image: digest type does not guarantee valid type

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc clone

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios: Allocation of Resources Without Limits or Throttling in axios

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Black: Arbitrary file writes from unsanitized user input in cache file name

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume

Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body

SpdyStream: DOS on CRI

Golang-fips: golang fips zeroed buffer

Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Virt-controller-rhel9: kubevirt: kubevirt: multus default-network annotation injection via unvalidated tenant networkname when externalnetresourceinjection is enabled

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher

Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service

Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results