https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:25:09.999479+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2022:1819 ALSA-2022:1819 — Moderate: go-toolset:rhel8 security and bug fix update 2026-10-02T23:25:10.331657+00:00

Affected: AlmaLinux:8: delve, AlmaLinux:8: go-toolset, AlmaLinux:8: golang, AlmaLinux:8: golang-bin, AlmaLinux:8: golang-docs, AlmaLinux:8: golang-misc, AlmaLinux:8: golang-race, AlmaLinux:8: golang-src, AlmaLinux:8: golang-tests

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

* golang: Command-line arguments may overwrite global data (CVE-2021-38297)

* golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196) (CVE-2021-39293)

* golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)

* golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)

* golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772)

* golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)

* golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/bell-cve-2021-39293 Withdrawn: BELL-CVE-2021-39293 — CVE-2021-39293 does not affect BellSoft software 2026-10-02T23:25:10.331739+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/bit-golang-2021-39293 BIT-golang-2021-39293 2026-10-02T23:25:10.331759+00:00

Affected: Bitnami: golang

In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.

 https://cve.radiocsirt.org/vuln/certfr-2022-avi-547 certfr-2022-avi-547 — De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un atta… 2026-10-02T23:25:10.331780+00:00 certfr-2022-avi-547 https://cve.radiocsirt.org/vuln/cnvd-2022-55062 cnvd-2022-55062 2026-10-02T23:25:10.331797+00:00 cnvd-2022-55062 https://cve.radiocsirt.org/vuln/euvd-2026-30552 EUVD-2026-30552 2026-10-02T23:25:10.331838+00:00 EUVD-2026-30552 https://cve.radiocsirt.org/vuln/fkie_cve-2021-39293 fkie_cve-2021-39293 2026-10-02T23:25:10.331861+00:00

In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.

 https://cve.radiocsirt.org/vuln/ghsa-j532-8pqq-78jr GHSA-j532-8pqq-78jr 2026-10-02T23:25:10.331882+00:00

In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.

 https://cve.radiocsirt.org/vuln/gsd-2021-39293 gsd-2021-39293 2026-10-02T23:25:10.331895+00:00 gsd-2021-39293 https://cve.radiocsirt.org/vuln/icsa-22-167-09 ICSA-22-167-09 — Siemens SCALANCE LPE9403 Third-Party Vulnerabilities 2026-10-02T23:25:10.331905+00:00

The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user privileges to cause a denial of service, slowing and eventually stopping the system while running OSP. The use of alloca function with an uncontrolled size in function unit_name_path_escape allows a local attacker, able to mount a filesystem on a very long path, to crash systemd and the whole system by allocating a very large space in the stack. A race condition vulnerability was found in Go. The incoming requests body weren't closed after the handler panic and as a consequence this could lead to ReverseProxy crash. The fix for CVE-2021-33196 can be bypassed by crafted inputs. As a result, the NewReader and OpenReader functions in archive/zip can still cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size. A vulnerability was found in Moby (Docker Engine) where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permi…

 https://cve.radiocsirt.org/vuln/oesa-2022-1518 OESA-2022-1518 — golang security update 2026-10-02T23:25:10.331955+00:00

Affected: openEuler:20.03-LTS-SP1: golang, openEuler:20.03-LTS-SP2: golang, openEuler:20.03-LTS-SP3: golang

The Go Programming Language. Security Fix(es): In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (Falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.(CVE-2021-39293)

 https://cve.radiocsirt.org/vuln/opensuse-su-2021:1342-1 openSUSE-SU-2021:1342-1 — Security update for go1.16 2026-10-02T23:25:10.331978+00:00

Security update for go1.16

 https://cve.radiocsirt.org/vuln/rhsa-2021:4902 RHSA-2021:4902 — Red Hat Security Advisory: ACS 3.67 security and enhancement update 2026-10-02T23:25:10.331993+00:00

civetweb: directory traversal when using the built-in example HTTP form-based file upload mechanism via the mg_handle_form_request API nodejs-axios: Regular expression denial of service in trim function nodejs-prismjs: ReDoS vulnerability nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet helm: information disclosure vulnerability golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196)

 https://cve.radiocsirt.org/vuln/suse-ru-2021:3315-1 SUSE-RU-2021:3315-1 — Recommended update for go1.17 2026-10-02T23:25:10.332019+00:00

Recommended update for go1.17

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-39293 UBUNTU-CVE-2021-39293 2026-10-02T23:25:10.332032+00:00

Affected: Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:18.04:LTS: golang-1.8, Ubuntu:Pro:20.04:LTS: golang-1.16

In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2229 WID-SEC-W-2023-2229 — Splunk Splunk Enterprise: Mehrere Schwachstellen 2026-10-02T23:25:10.332053+00:00

Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, einen 'Denial of Service'-Zustand zu verursachen, seine Privilegien zu erweitern und weitere, nicht spezifizierte Auswirkungen zu verursachen.