https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T06:31:09.417987+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-09522 bdu:2026-09522 2026-10-04T06:31:10.363865+00:00 bdu:2026-09522 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0316 certfr-2026-avi-0316 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-04T06:31:10.363913+00:00 certfr-2026-avi-0316 https://cve.radiocsirt.org/vuln/cleanstart-2026-aa56293 Withdrawn: CLEANSTART-2026-AA56293 — Security fixes in fluent-bit-plugin-loki 3.6.5-r0 2026-10-04T06:31:10.363932+00:00

Withdrawn by the publisher.

Affected: CleanStart: fluent-bit-plugin-loki

Package fluent-bit-plugin-loki version 3.6.5-r0 fixes 5 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-24051, CVE-2026-25679, CVE-2026-33186

 https://cve.radiocsirt.org/vuln/euvd-2026-267124 EUVD-2026-267124 2026-10-04T06:31:10.363965+00:00 EUVD-2026-267124 https://cve.radiocsirt.org/vuln/fkie_cve-2026-24051 fkie_cve-2026-24051 2026-10-04T06:31:10.363977+00:00

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.

 https://cve.radiocsirt.org/vuln/ghsa-9h8m-3fm2-qjrq GHSA-9h8m-3fm2-qjrq — OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking 2026-10-04T06:31:10.364000+00:00

Affected: Go: go.opentelemetry.io/otel/sdk

### Impact The OpenTelemetry Go SDK in version `v1.20.0`-`1.39.0` is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in `sdk/resource/host_id.go` executes the `ioreg` system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application.

### Patches This has been patched in [d45961b](https://github.com/open-telemetry/opentelemetry-go/commit/d45961bcda453fcbdb6469c22d6e88a1f9970a53), which was released with `v1.40.0`.

### References - [CWE-426: Untrusted Search Path](https://cwe.mitre.org/data/definitions/426.html)

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-24051 msrc_CVE-2026-24051 — OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking 2026-10-04T06:31:10.364025+00:00 msrc_CVE-2026-24051 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10396-1 openSUSE-SU-2026:10396-1 — openbao-2.5.1-1.1 on GA media 2026-10-04T06:31:10.364040+00:00

openbao-2.5.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2437 WID-SEC-W-2026-2437 — Oracle Communications: Mehrere Schwachstellen 2026-10-04T06:31:10.364057+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.