https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T17:47:24.803175+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-47378 EUVD-2026-47378 2026-10-03T17:47:24.895793+00:00 EUVD-2026-47378 https://cve.radiocsirt.org/vuln/fkie_cve-2020-29529 fkie_cve-2020-29529 2026-10-03T17:47:24.895829+00:00

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.

 https://cve.radiocsirt.org/vuln/ghsa-2g5j-5x95-r6hr GHSA-2g5j-5x95-r6hr — Unsafe tar unpacking in HashiCorp go-slug 2026-10-03T17:47:24.895860+00:00

Affected: Go: github.com/hashicorp/go-slug

HashiCorp go-slug before 0.5.0 does not address attempts at directory traversal involving ../ and symlinks.

 https://cve.radiocsirt.org/vuln/gsd-2020-29529 gsd-2020-29529 2026-10-03T17:47:24.895884+00:00 gsd-2020-29529 https://cve.radiocsirt.org/vuln/rhsa-2021:1168 RHSA-2021:1168 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.2.2 security and bug fix update 2026-10-03T17:47:24.895897+00:00

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag go-slug: partial protection against zip slip attacks fastify-reply-from: crafted URL allows prefix scape of the proxied backend service fastify-http-proxy: crafted URL allows prefix scape of the proxied backend service nodejs-lodash: command injection via template openssl: integer overflow in CipherUpdate openssl: NULL pointer dereference in X509_issuer_and_serial_hash()

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-29529 Withdrawn: UBUNTU-CVE-2020-29529 2026-10-03T17:47:24.895933+00:00

Withdrawn by the publisher.

Affected: Ubuntu:22.04:LTS: golang-github-hashicorp-go-slug

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.