Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

lodash vulnerable to Code Injection via `_.template` imports key names

Handlebars.js has JavaScript Injection via AST Type Confusion

flatted: Prototype Pollution via parse()

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)