https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T15:50:18.872184+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-01059 bdu:2026-01059 2026-10-02T15:50:19.025612+00:00 bdu:2026-01059 https://cve.radiocsirt.org/vuln/bell-cve-2026-23992 BELL-CVE-2026-23992 2026-10-02T15:50:19.025651+00:00

Affected: Alpaquita:stream: docker-cli-buildx

 https://cve.radiocsirt.org/vuln/cleanstart-2026-ba61304 Withdrawn: CLEANSTART-2026-BA61304 — Security fixes in cosign 2.4.3-r0 2026-10-02T15:50:19.025678+00:00

Withdrawn by the publisher.

Affected: CleanStart: cosign

Package cosign version 2.4.3-r0 fixes 82 vulnerabilities: CVE-2025-0913, CVE-2025-15558, CVE-2025-22868, CVE-2025-22869, CVE-2025-22870...

 https://cve.radiocsirt.org/vuln/euvd-2026-266313 EUVD-2026-266313 2026-10-02T15:50:19.025701+00:00 EUVD-2026-266313 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23992 fkie_cve-2026-23992 2026-10-02T15:50:19.025713+00:00

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.

 https://cve.radiocsirt.org/vuln/ghsa-fphv-w9fq-2525 GHSA-fphv-w9fq-2525 — go-tuf improperly validates the configured threshold for delegations 2026-10-02T15:50:19.025737+00:00

Affected: Go: github.com/theupdateframework/go-tuf/v2

# Security Disclosure: Improper validation of configured threshold for delegations

## Summary

A compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification.

## Impact

Unathorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made.

## Patches

Upgrade to v2.3.1

## Workarounds

Always make sure that the TUF metadata roles are configured with a threshold of at least 1.

## Affected code:

The `metadata.VerifyDelegate` did not verify the configured threshold prior to comparison. This means that a misconfigured TUF repository could disable the signature verification by setting the threshold to 0, or a negative value (and so always make the signature threshold computation to pass).

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10235-1 openSUSE-SU-2026:10235-1 — cosign-3.0.5-1.1 on GA media 2026-10-02T15:50:19.025769+00:00

cosign-3.0.5-1.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2026:20904-1 SUSE-SU-2026:20904-1 — Security update for cosign 2026-10-02T15:50:19.025788+00:00

Security update for cosign

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-23992 UBUNTU-CVE-2026-23992 2026-10-02T15:50:19.025806+00:00

Affected: Ubuntu:24.04:LTS: golang-github-theupdateframework-go-tuf, Ubuntu:25.10: golang-github-theupdateframework-go-tuf, Ubuntu:26.04:LTS: golang-github-theupdateframework-go-tuf

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.