CVE-2026-33816 in github.com/jackc/pgx

CVE-2026-33815 in github.com/jackc/pgx

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Go-getter may allow to arbitrary filesystem reads through git operations

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

Crossbeam-channel: crossbeam-channel vulnerable to double free on drop

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

pip can extract console_scripts and gui_scripts outside installation directory

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

Ring: some aes functions may panic when overflow checking is enabled in ring

Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results

Rust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`