https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:05:02.179586+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-08473 bdu:2025-08473 2026-10-03T14:05:03.307785+00:00 bdu:2025-08473 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0524 certfr-2025-avi-0524 — De multiples vulnérabilités ont été découvertes dans VMware Tanzu. Elles permettent à un attaquant de provoquer un prob… 2026-10-03T14:05:03.307866+00:00 certfr-2025-avi-0524 https://cve.radiocsirt.org/vuln/cleanstart-2026-ba61304 Withdrawn: CLEANSTART-2026-BA61304 — Security fixes in cosign 2.4.3-r0 2026-10-03T14:05:03.307890+00:00

Withdrawn by the publisher.

Affected: CleanStart: cosign

Package cosign version 2.4.3-r0 fixes 82 vulnerabilities: CVE-2025-0913, CVE-2025-15558, CVE-2025-22868, CVE-2025-22869, CVE-2025-22870...

 https://cve.radiocsirt.org/vuln/euvd-2026-239887 EUVD-2026-239887 2026-10-03T14:05:03.307925+00:00 EUVD-2026-239887 https://cve.radiocsirt.org/vuln/fkie_cve-2025-22872 fkie_cve-2025-22872 2026-10-03T14:05:03.307938+00:00

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

 https://cve.radiocsirt.org/vuln/ghsa-vvgc-356p-c3xw GHSA-vvgc-356p-c3xw — golang.org/x/net vulnerable to Cross-site Scripting 2026-10-03T14:05:03.307964+00:00

Affected: Go: golang.org/x/net

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

 https://cve.radiocsirt.org/vuln/msrc_cve-2025-22872 msrc_CVE-2025-22872 — Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net 2026-10-03T14:05:03.307987+00:00 msrc_CVE-2025-22872 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15008-1 openSUSE-SU-2025:15008-1 — govulncheck-vulndb-0.0.20250416T165455-1.1 on GA media 2026-10-03T14:05:03.308004+00:00

govulncheck-vulndb-0.0.20250416T165455-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:34342 RHSA-2026:34342 — Red Hat Security Advisory: Cluster Observability Operator 1.5.0 2026-10-03T14:05:03.308020+00:00

nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function nodejs-trim-newlines: ReDoS in .end() method braces: fails to limit the number of characters it can handle golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html launch-editor: vite: launch-editor: Arbitrary command execution via insufficient file argument sanitization golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net golang.org/x/net/html: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html golang.org/x/net/html: Infinite parsing loop in golang.org/x/net undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression undici: undici: Denial of Service via crafted WebSocket frame with large length undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter lodash: lodash: Arbitrary code execution via untrusted input in template imports path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri: fast-uri: URI authority bypass due to improper delimiter handlin…

 https://cve.radiocsirt.org/vuln/suse-su-2025:01940-1 SUSE-SU-2025:01940-1 — Security update for kubernetes1.23 2026-10-03T14:05:03.308134+00:00

Security update for kubernetes1.23

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-22872 UBUNTU-CVE-2025-22872 2026-10-03T14:05:03.308175+00:00

Affected: Ubuntu:Pro:16.04:LTS: golang-golang-x-net-dev, Ubuntu:Pro:16.04:LTS: juju-core, Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: golang-golang-x-net-dev, Ubuntu:Pro:20.04:LTS: golang-golang-x-net-dev, Ubuntu:Pro:22.04:LTS: golang-golang-x-net, Ubuntu:Pro:24.04:LTS: golang-golang-x-net

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1618 WID-SEC-W-2026-1618 — Splunk Splunk Enterprise: Mehrere Schwachstellen 2026-10-03T14:05:03.308227+00:00

Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.