https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:09:47.218557+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2025:22005 ALSA-2025:22005 — Moderate: go-rpm-macros security update 2026-10-03T14:09:48.190890+00:00

Affected: AlmaLinux:9: go-filesystem, AlmaLinux:9: go-rpm-macros, AlmaLinux:9: go-rpm-templates, AlmaLinux:9: go-srpm-macros

This package provides build-stage rpm automation to simplify the creation of Go language (golang) packages. It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only.

Security Fix(es):

* os/exec: Unexpected paths returned from LookPath in os/exec (CVE-2025-47906)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2025-11595 bdu:2025-11595 2026-10-03T14:09:48.190969+00:00 bdu:2025-11595 https://cve.radiocsirt.org/vuln/bell-cve-2025-47906 BELL-CVE-2025-47906 2026-10-03T14:09:48.190988+00:00

Affected: Alpaquita:23: go, Alpaquita:25: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go

 https://cve.radiocsirt.org/vuln/bit-golang-2025-47906 BIT-golang-2025-47906 — Unexpected paths returned from LookPath in os/exec 2026-10-03T14:09:48.191014+00:00

Affected: Bitnami: golang

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0935 certfr-2025-avi-0935 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-03T14:09:48.191035+00:00 certfr-2025-avi-0935 https://cve.radiocsirt.org/vuln/cleanstart-2026-am62510 Withdrawn: CLEANSTART-2026-AM62510 — gRPC-Go is the Go language implementation of gRPC 2026-10-03T14:09:48.191051+00:00

Withdrawn by the publisher.

Affected: CleanStart: consul-k8s-fips

Multiple security vulnerabilities affect the consul-k8s-fips package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-259961 EUVD-2026-259961 2026-10-03T14:09:48.191069+00:00 EUVD-2026-259961 https://cve.radiocsirt.org/vuln/fkie_cve-2025-47906 fkie_cve-2025-47906 2026-10-03T14:09:48.191080+00:00

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

 https://cve.radiocsirt.org/vuln/ghsa-gwrf-jf3h-w649 GHSA-gwrf-jf3h-w649 2026-10-03T14:09:48.191100+00:00

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

 https://cve.radiocsirt.org/vuln/msrc_cve-2025-47906 msrc_CVE-2025-47906 — Unexpected paths returned from LookPath in os/exec 2026-10-03T14:09:48.191113+00:00 msrc_CVE-2025-47906 https://cve.radiocsirt.org/vuln/oesa-2025-2180 OESA-2025-2180 — golang security update 2026-10-03T14:09:48.191129+00:00

Affected: openEuler:22.03-LTS-SP4: golang

. Security Fix(es):

A vulnerability was found in Google Go up to 1.23.11/1.24.5 (Programming Language Software). It has been declared as problematic.The manipulation of the argument PATH with an unknown input leads to a unknown weakness.As an impact it is known to affect integrity.Upgrading to version 1.23.12 or 1.24.6 eliminates this vulnerability.(CVE-2025-47906)

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15420-1 openSUSE-SU-2025:15420-1 — go1.25-1.25rc3-1.1 on GA media 2026-10-03T14:09:48.191152+00:00

go1.25-1.25rc3-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2025:21856 RHSA-2025:21856 — Red Hat Security Advisory: golang security update 2026-10-03T14:09:48.191167+00:00

os/exec: Unexpected paths returned from LookPath in os/exec golang: archive/tar: Unbounded allocation when parsing GNU sparse map

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-47906 UBUNTU-CVE-2025-47906 2026-10-03T14:09:48.191184+00:00

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:20.04:LTS: golang-1.13, Ubuntu:20.04:LTS: golang-1.14 and 21 more

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1740 WID-SEC-W-2025-1740 — Golang Go: Mehrere Schwachstellen ermöglichen Manipulation von Dateien 2026-10-03T14:09:48.191252+00:00

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Dateien zu manipulieren.