https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T19:11:40.658367+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-47913 CVE-2025-47913 — Potential denial of service in golang.org/x/crypto/ssh/agent 2026-10-10T19:11:40.690339+00:00

Affected: golang.org/x/crypto/ssh/agent

SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.

 https://cve.radiocsirt.org/vuln/ghsa-j88v-2chj-qfwx GHSA-j88v-2chj-qfwx — pgx: SQL Injection via placeholder confusion with dollar quoted string literals 2026-10-10T19:11:40.690406+00:00

Affected: Go: github.com/jackc/pgx/v5, Go: github.com/jackc/pgx/v4, Go: github.com/jackc/pgx

### Impact

SQL Injection can occur when:

1. The non-default simple protocol is used. 2. A dollar quoted string literal is used in the SQL query. 3. That string literal contains text that would be would be interpreted as a placeholder outside of a string literal. 4. The value of that placeholder is controllable by the attacker.

e.g.

```go attackValue := `$tag$; drop table canary; --` _, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue) ```

This is unlikely to occur outside of a contrived scenario.

### Patches

The problem is resolved in v5.9.2.

### Workarounds

Do not use the simple protocol to execute queries matching all the above conditions.