Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

CVE-2026-33816 in github.com/jackc/pgx

CVE-2026-33815 in github.com/jackc/pgx

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

gRPC-Go has an authorization bypass via missing leading slash in :path

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Quadratic string concatentation in consumeComment in net/mail

Crash when handling long CNAME response in net

Quadratic string concatenation in consumePhrase in net/mail

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus Azure AD remote write OAuth client secret exposed via config API

Unexpected work during chain building in crypto/x509

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Incorrect parsing of IPv6 host literals in net/url

Incorrect enforcement of email constraints in crypto/x509

Inefficient candidate hostname parsing in crypto/x509

SpdyStream: DOS on CRI

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh