Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)