CVE-2026-33816 in github.com/jackc/pgx

CVE-2026-33815 in github.com/jackc/pgx

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection

Stackrox: stackrox: unbounded graphql query depth allows authenticated denial of service

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Stackrox: stackrox: saml response replay allows multiple central authentication tokens

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

wheel Allows Arbitrary File Permission Modification via Path Traversal

Stackrox: xss in stackrox

Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

Claircore: claircore: denial of service via unchecked type assertion in rpm header parser

Claircore: claircore: denial of service via out-of-bounds slice in claircore's apk installed-database parser

Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers