https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T06:04:45.420458+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-52439 cnvd-2020-52439 2026-10-06T06:04:45.427393+00:00 cnvd-2020-52439 https://cve.radiocsirt.org/vuln/euvd-2026-42036 EUVD-2026-42036 2026-10-06T06:04:45.427426+00:00 EUVD-2026-42036 https://cve.radiocsirt.org/vuln/fkie_cve-2020-13846 fkie_cve-2020-13846 2026-10-06T06:04:45.427440+00:00

Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.

 https://cve.radiocsirt.org/vuln/ghsa-6w7g-p4jh-rf92 GHSA-6w7g-p4jh-rf92 — "Verify All" Returns Success Despite Validation Failures in Singularity 2026-10-06T06:04:45.427467+00:00

Affected: Go: github.com/sylabs/singularity

### Impact

The `--all / -a` option to `singularity verify` returns success even when some objects in a SIF container are not signed, or cannot be verified.

The SIF objects that are not verified are reported in `WARNING` log messages, but a `Container Verified` message and exit code of `0` are returned.

Workflows that verify a container using `--all / -a` and use the exit code as an indicator of success are vulnerable to running SIF containers that have unsigned, or modified, objects that may be exploited to introduce malicious behavior.

``` $ singularity verify -a image.sif WARNING: Missing signature for SIF descriptor 2 (JSON.Generic) WARNING: Missing signature for SIF descriptor 3 (FS) Container is signed by 1 key(s):

Verifying partition: Def.FILE: 12045C8C0B1004D058DE4BEDA20C27EE7FF7BA84 [LOCAL] Unit Test <unit@test.com> [OK] Data integrity verified

INFO: Container verified: image.sif

$ echo $? 0 ```

### Patches

Singularity 3.6.0 has a new implementation of sign/verify that fixes this issue.

All users are advised to upgrade to 3.6.0. Note that Singularity 3.6.0 uses a new signature format that is necessarily incompatible with Singularity < 3.6.0 - e.g. Singularity 3.5.3 cannot verify containers signed by 3.6.0.

Version 3.6.0 includes a `--legacy-insecure` flag for the `singularity verify` command, that will perform verification of the older, and insecure, legacy signatures for compatibility with existing containers. This does not guarantee that con…

 https://cve.radiocsirt.org/vuln/gsd-2020-13846 gsd-2020-13846 2026-10-06T06:04:45.427515+00:00 gsd-2020-13846 https://cve.radiocsirt.org/vuln/opensuse-su-2020:1011-1 openSUSE-SU-2020:1011-1 — Security update for singularity 2026-10-06T06:04:45.427528+00:00

Security update for singularity

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-13846 UBUNTU-CVE-2020-13846 2026-10-06T06:04:45.427545+00:00

Affected: Ubuntu:Pro:18.04:LTS: singularity-container, Ubuntu:Pro:24.04:LTS: singularity-container, Ubuntu:25.10: singularity-container, Ubuntu:26.04:LTS: singularity-container

Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.