https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:11:53.178870+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:34357 ALSA-2026:34357 — Important: opentelemetry-collector security update 2026-10-03T19:11:55.206787+00:00

Affected: AlmaLinux:10: opentelemetry-collector

Collector with the supported components for a AlmaLinux build of OpenTelemetry

Security Fix(es):

* github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154) * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-15280 bdu:2026-15280 2026-10-03T19:11:55.206906+00:00 bdu:2026-15280 https://cve.radiocsirt.org/vuln/bell-cve-2026-25681 BELL-CVE-2026-25681 2026-10-03T19:11:55.206926+00:00

Affected: Alpaquita:23: buildah, Alpaquita:23: containerd, Alpaquita:23: podman, Alpaquita:23: runc, Alpaquita:23: skopeo, Alpaquita:25: buildah, Alpaquita:25: containerd, Alpaquita:25: docker-cli-buildx, Alpaquita:25: google-guest-agent, Alpaquita:25: osv-scanner and 20 more

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0674 certfr-2026-avi-0674 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu… 2026-10-03T19:11:55.206981+00:00 certfr-2026-avi-0674 https://cve.radiocsirt.org/vuln/cleanstart-2026-ad30368 Withdrawn: CLEANSTART-2026-AD30368 — Security fixes for CVE-2026-2303, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39827, CVE-2… 2026-10-03T19:11:55.206997+00:00

Withdrawn by the publisher.

Affected: CleanStart: weaviate-fips

Multiple security vulnerabilities affect the weaviate-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-320148 EUVD-2026-320148 2026-10-03T19:11:55.207021+00:00 EUVD-2026-320148 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25681 fkie_cve-2026-25681 2026-10-03T19:11:55.207032+00:00

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

 https://cve.radiocsirt.org/vuln/ghsa-w9p8-pvxh-rxpj GHSA-w9p8-pvxh-rxpj 2026-10-03T19:11:55.207053+00:00

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-25681 msrc_CVE-2026-25681 — Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html 2026-10-03T19:11:55.207067+00:00 msrc_CVE-2026-25681 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10856-1 openSUSE-SU-2026:10856-1 — rclone-1.74.2-1.1 on GA media 2026-10-03T19:11:55.207083+00:00

rclone-1.74.2-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:34342 RHSA-2026:34342 — Red Hat Security Advisory: Cluster Observability Operator 1.5.0 2026-10-03T19:11:55.207117+00:00

nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function nodejs-trim-newlines: ReDoS in .end() method braces: fails to limit the number of characters it can handle golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html launch-editor: vite: launch-editor: Arbitrary command execution via insufficient file argument sanitization golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net golang.org/x/net/html: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html golang.org/x/net/html: Infinite parsing loop in golang.org/x/net undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression undici: undici: Denial of Service via crafted WebSocket frame with large length undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter lodash: lodash: Arbitrary code execution via untrusted input in template imports path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri: fast-uri: URI authority bypass due to improper delimiter handlin…

 https://cve.radiocsirt.org/vuln/rlsa-2026:34357 RLSA-2026:34357 — Important: opentelemetry-collector security update 2026-10-03T19:11:55.207203+00:00

Affected: Rocky Linux:10: opentelemetry-collector

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154)

* github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)

* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:22065-1 SUSE-SU-2026:22065-1 — Security update for elemental-toolkit 2026-10-03T19:11:55.207281+00:00

Security update for elemental-toolkit

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-25681 UBUNTU-CVE-2026-25681 2026-10-03T19:11:55.207304+00:00

Affected: Ubuntu:Pro:16.04:LTS: golang-golang-x-net-dev, Ubuntu:Pro:18.04:LTS: golang-golang-x-net-dev, Ubuntu:Pro:20.04:LTS: golang-golang-x-net-dev

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1653 WID-SEC-W-2026-1653 — Golang Go-Module (Net, Image, Crypto: Mehrere Schwachstellen 2026-10-03T19:11:55.207326+00:00

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um erweiterte Privilegien zu erlangen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu verursachen.