NGINX Map directive and Regex matching vulnerability

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Arbitrary inputs are included in errors without any escaping in net/textproto

Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

Invoking Encrypted Client Hello privacy leak in crypto/tls

Quadratic complexity in WordDecoder.DecodeHeader in mime

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Malicious module proxy can bypass checksum database in cmd/go

Quadratic string concatenation in consumePhrase in net/mail

Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory

Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains

net-imap: Command Injection via unvalidated Symbol inputs

net-imap: Command Injection via "raw" arguments to multiple commands

net-imap: Denial of service via high iteration count for `SCRAM-*` authentication

Off-by-One Leading to Out-of-Bounds Write in bzip2

Stack overflow parsing XML with deeply nested DTD content models

net-imap vulnerable to STARTTLS stripping via invalid response timing

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus Azure AD remote write OAuth client secret exposed via config API