https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T00:05:30.931710+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:19135 ALSA-2026:19135 — Important: opentelemetry-collector security update 2026-10-04T00:05:34.461930+00:00

Affected: AlmaLinux:10: opentelemetry-collector

Collector with the supported components for a AlmaLinux build of OpenTelemetry

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-07251 bdu:2026-07251 2026-10-04T00:05:34.462039+00:00 bdu:2026-07251 https://cve.radiocsirt.org/vuln/bell-cve-2026-32281 BELL-CVE-2026-32281 2026-10-04T00:05:34.462060+00:00

Affected: Alpaquita:23: go, Alpaquita:25: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go

 https://cve.radiocsirt.org/vuln/bit-golang-2026-32281 BIT-golang-2026-32281 — Inefficient policy validation in crypto/x509 2026-10-04T00:05:34.462089+00:00

Affected: Bitnami: golang

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0498 certfr-2026-avi-0498 — De multiples vulnérabilités ont été découvertes dans Zabbix Agent2. Elles permettent à un attaquant de provoquer un pro… 2026-10-04T00:05:34.462110+00:00 certfr-2026-avi-0498 https://cve.radiocsirt.org/vuln/cleanstart-2026-ac01087 Withdrawn: CLEANSTART-2026-AC01087 — During chain building, the amount of work that is done is not correctly limited when a large number of intermediate cer… 2026-10-04T00:05:34.462125+00:00

Withdrawn by the publisher.

Affected: CleanStart: gitness

Multiple security vulnerabilities affect the gitness package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-290976 EUVD-2026-290976 2026-10-04T00:05:34.462147+00:00 EUVD-2026-290976 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32281 fkie_cve-2026-32281 2026-10-04T00:05:34.462159+00:00

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

 https://cve.radiocsirt.org/vuln/ghsa-gjvh-7jh8-7xhm GHSA-gjvh-7jh8-7xhm 2026-10-04T00:05:34.462181+00:00

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-32281 msrc_CVE-2026-32281 — Inefficient policy validation in crypto/x509 2026-10-04T00:05:34.462195+00:00 msrc_CVE-2026-32281 https://cve.radiocsirt.org/vuln/oesa-2026-3879 OESA-2026-3879 — git-lfs security update 2026-10-04T00:05:34.462211+00:00

Affected: openEuler:24.03-LTS-SP1: git-lfs

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es):

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the bin…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10514-1 openSUSE-SU-2026:10514-1 — go1.25-1.25.9-1.1 on GA media 2026-10-04T00:05:34.462294+00:00

go1.25-1.25.9-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:13791 RHSA-2026:13791 — Red Hat Security Advisory: RHACS 4.9.6 security and bug fix update 2026-10-04T00:05:34.462316+00:00

net/url: Incorrect parsing of IPv6 host literals in net/url immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

 https://cve.radiocsirt.org/vuln/rlsa-2026:19135 RLSA-2026:19135 — Important: opentelemetry-collector security update 2026-10-04T00:05:34.462348+00:00

Affected: Rocky Linux:10: opentelemetry-collector

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:21355-1 SUSE-SU-2026:21355-1 — Security update for go1.25 2026-10-04T00:05:34.462379+00:00

Security update for go1.25

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-32281 UBUNTU-CVE-2026-32281 2026-10-04T00:05:34.462398+00:00

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 26 more

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

 https://cve.radiocsirt.org/vuln/vde-2026-088 VDE-2026-088 — METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4 2026-10-04T00:05:34.462453+00:00

The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25.

The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25

All other vulnerabilities are to be fixed in the upcoming releases.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1006 WID-SEC-W-2026-1006 — Golang Go: Mehrere Schwachstellen 2026-10-04T00:05:34.462498+00:00

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Speicherbeschädigungen zu verursachen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand auszulösen oder andere, nicht näher spezifizierte Angriffe durchzuführen.