https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:12:28.102169+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:10704 ALSA-2026:10704 — Important: go-toolset:rhel8 security update 2026-10-02T22:12:33.012650+00:00

Affected: AlmaLinux:8: delve, AlmaLinux:8: go-toolset, AlmaLinux:8: golang, AlmaLinux:8: golang-bin, AlmaLinux:8: golang-docs, AlmaLinux:8: golang-misc, AlmaLinux:8: golang-race, AlmaLinux:8: golang-src, AlmaLinux:8: golang-tests

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names (CVE-2026-27140) * golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-07254 bdu:2026-07254 2026-10-02T22:12:33.012766+00:00 bdu:2026-07254 https://cve.radiocsirt.org/vuln/bell-cve-2026-32280 BELL-CVE-2026-32280 2026-10-02T22:12:33.012786+00:00

Affected: Alpaquita:23: go, Alpaquita:25: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go

 https://cve.radiocsirt.org/vuln/bit-golang-2026-32280 BIT-golang-2026-32280 — Unexpected work during chain building in crypto/x509 2026-10-02T22:12:33.012814+00:00

Affected: Bitnami: golang

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0498 certfr-2026-avi-0498 — De multiples vulnérabilités ont été découvertes dans Zabbix Agent2. Elles permettent à un attaquant de provoquer un pro… 2026-10-02T22:12:33.012837+00:00 certfr-2026-avi-0498 https://cve.radiocsirt.org/vuln/cleanstart-2026-ac01087 Withdrawn: CLEANSTART-2026-AC01087 — During chain building, the amount of work that is done is not correctly limited when a large number of intermediate cer… 2026-10-02T22:12:33.012854+00:00

Withdrawn by the publisher.

Affected: CleanStart: gitness

Multiple security vulnerabilities affect the gitness package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-371789 EUVD-2026-371789 2026-10-02T22:12:33.012877+00:00 EUVD-2026-371789 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32280 fkie_cve-2026-32280 2026-10-02T22:12:33.012889+00:00

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.

 https://cve.radiocsirt.org/vuln/ghsa-m4pr-4j3g-9v7v GHSA-m4pr-4j3g-9v7v 2026-10-02T22:12:33.012910+00:00

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-32280 msrc_CVE-2026-32280 — Unexpected work during chain building in crypto/x509 2026-10-02T22:12:33.012926+00:00 msrc_CVE-2026-32280 https://cve.radiocsirt.org/vuln/oesa-2026-3879 OESA-2026-3879 — git-lfs security update 2026-10-02T22:12:33.012943+00:00

Affected: openEuler:24.03-LTS-SP1: git-lfs

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es):

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the bin…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10514-1 openSUSE-SU-2026:10514-1 — go1.25-1.25.9-1.1 on GA media 2026-10-02T22:12:33.013029+00:00

go1.25-1.25.9-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:11688 RHSA-2026:11688 — Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.6.15 2026-10-02T22:12:33.013052+00:00

net/url: Incorrect parsing of IPv6 host literals in net/url golang: cmd/compile: possible memory corruption after bound check elimination golang: cmd/compile: no-op interface conversion bypasses overlap checking crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

 https://cve.radiocsirt.org/vuln/rlsa-2026:19133 RLSA-2026:19133 — Important: git-lfs security update 2026-10-02T22:12:33.013077+00:00

Affected: Rocky Linux:10: git-lfs

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:21355-1 SUSE-SU-2026:21355-1 — Security update for go1.25 2026-10-02T22:12:33.013103+00:00

Security update for go1.25

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-32280 UBUNTU-CVE-2026-32280 2026-10-02T22:12:33.013121+00:00

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:20.04:LTS: golang-1.13, Ubuntu:20.04:LTS: golang-1.14, Ubuntu:Pro:20.04:LTS: golang-1.16, Ubuntu:20.04:LTS: golang-1.18 and 21 more

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.

 https://cve.radiocsirt.org/vuln/vde-2026-088 VDE-2026-088 — METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4 2026-10-02T22:12:33.013173+00:00

The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25.

The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25

All other vulnerabilities are to be fixed in the upcoming releases.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1006 WID-SEC-W-2026-1006 — Golang Go: Mehrere Schwachstellen 2026-10-02T22:12:33.013217+00:00

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Speicherbeschädigungen zu verursachen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand auszulösen oder andere, nicht näher spezifizierte Angriffe durchzuführen.