https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T15:27:31.250416+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-01060 bdu:2026-01060 2026-10-03T15:27:31.413202+00:00 bdu:2026-01060 https://cve.radiocsirt.org/vuln/bell-cve-2026-23991 BELL-CVE-2026-23991 2026-10-03T15:27:31.413241+00:00

Affected: Alpaquita:stream: docker-cli-buildx

 https://cve.radiocsirt.org/vuln/cleanstart-2026-ba61304 Withdrawn: CLEANSTART-2026-BA61304 — Security fixes in cosign 2.4.3-r0 2026-10-03T15:27:31.413268+00:00

Withdrawn by the publisher.

Affected: CleanStart: cosign

Package cosign version 2.4.3-r0 fixes 82 vulnerabilities: CVE-2025-0913, CVE-2025-15558, CVE-2025-22868, CVE-2025-22869, CVE-2025-22870...

 https://cve.radiocsirt.org/vuln/euvd-2026-266317 EUVD-2026-266317 2026-10-03T15:27:31.413293+00:00 EUVD-2026-266317 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23991 fkie_cve-2026-23991 2026-10-03T15:27:31.413305+00:00

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/ghsa-846p-jg2w-w324 GHSA-846p-jg2w-w324 — go-tuf affected by client DoS via malformed server response 2026-10-03T15:27:31.413329+00:00

Affected: Go: github.com/theupdateframework/go-tuf/v2

# Security Disclosure: Client DoS via malformed server response

## Summary

If the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic _during parsing_, causing a DoS. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key.

## Impact

Client crashes upon receiving and parsing malformed TUF metadata. This can cause long running services to enter an restart/crash loop.

## Workarounds

None currently.

## Affected code

The `metadata.checkType` function did not properly type assert the (untrusted) input causing it to panic on malformed data.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10235-1 openSUSE-SU-2026:10235-1 — cosign-3.0.5-1.1 on GA media 2026-10-03T15:27:31.413359+00:00

cosign-3.0.5-1.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2026:20904-1 SUSE-SU-2026:20904-1 — Security update for cosign 2026-10-03T15:27:31.413379+00:00

Security update for cosign

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-23991 UBUNTU-CVE-2026-23991 2026-10-03T15:27:31.413398+00:00

Affected: Ubuntu:24.04:LTS: golang-github-theupdateframework-go-tuf, Ubuntu:25.10: golang-github-theupdateframework-go-tuf, Ubuntu:26.04:LTS: golang-github-theupdateframework-go-tuf

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.