Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation

Possible arbitrary code execution during DNSSEC validation

Gnutls: gnutls: authentication bypass via nul character in username

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

CVE-2026-33816 in github.com/jackc/pgx

CVE-2026-33815 in github.com/jackc/pgx

pyOpenSSL DTLS cookie callback buffer overflow

Glib: glib: buffer underflow in gvariant parser leads to heap corruption

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

MariaDB: mysql_real_escape_string() incorrectly handled big5

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Gnutls: gnutls: denial of service via dtls zero-length fragment

Ruby JSON has a format string injection vulnerability

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths

Libxml: heap use after free (uaf) leads to denial of service (dos)

Libxml: type confusion leads to denial of service (dos)

Libssh: libssh: authentication bypass via missing gssapi principal check

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

Heap Use-After-Free in the PKCS7_verify() Function

PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

PostgreSQL server undersizes allocations, via integer wraparound

redis-server RESTORE invalid memory access may allow remote code execution

redis-server use-after-free in unblock client flow may allow remote code execution

Apache HTTP Server: http2: double free and possible RCE on early reset

Composer has Command Injection via Malicious Perforce Reference

PostgreSQL missing validation of multibyte character length executes arbitrary code

PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

Stack buffer overflow in CMS (Auth)EnvelopedData parsing

Libtiff: libtiff write-what-where

Potential code smuggling via doc comments in cmd/cgo

Libxml2: double-free/uaf in libxml2 python bindings

Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name

Gnutls: gnutls: information disclosure via heap overread in rsa key exchange

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()

NGINX ngx_http_dav_module vulnerability

PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory

Gnutls: vulnerability in gnutls certtool template parsing

Gnutls: vulnerability in gnutls othername san export

NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

NGINX Open-Source ngx_http_v3_module vulnerability

nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification

NGINX ngx_http_rewrite_module vulnerability

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by…