https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T13:03:18.984641+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:19135 ALSA-2026:19135 — Important: opentelemetry-collector security update 2026-10-02T13:03:20.294812+00:00

Affected: AlmaLinux:10: opentelemetry-collector

Collector with the supported components for a AlmaLinux build of OpenTelemetry

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-07331 bdu:2026-07331 2026-10-02T13:03:20.294923+00:00 bdu:2026-07331 https://cve.radiocsirt.org/vuln/bell-cve-2026-33810 BELL-CVE-2026-33810 2026-10-02T13:03:20.294942+00:00

Affected: Alpaquita:stream: go, BellSoft Hardened Containers:stream: go

 https://cve.radiocsirt.org/vuln/bit-golang-2026-33810 BIT-golang-2026-33810 — Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 2026-10-02T13:03:20.294964+00:00

Affected: Bitnami: golang

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0445 certfr-2026-avi-0445 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un at… 2026-10-02T13:03:20.294987+00:00 certfr-2026-avi-0445 https://cve.radiocsirt.org/vuln/cleanstart-2026-ac01087 Withdrawn: CLEANSTART-2026-AC01087 — During chain building, the amount of work that is done is not correctly limited when a large number of intermediate cer… 2026-10-02T13:03:20.295003+00:00

Withdrawn by the publisher.

Affected: CleanStart: gitness

Multiple security vulnerabilities affect the gitness package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-371749 EUVD-2026-371749 2026-10-02T13:03:20.295025+00:00 EUVD-2026-371749 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33810 fkie_cve-2026-33810 2026-10-02T13:03:20.295036+00:00

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

 https://cve.radiocsirt.org/vuln/ghsa-fv83-x2xw-2j55 GHSA-fv83-x2xw-2j55 2026-10-02T13:03:20.295058+00:00

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-33810 msrc_CVE-2026-33810 — Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 2026-10-02T13:03:20.295073+00:00 msrc_CVE-2026-33810 https://cve.radiocsirt.org/vuln/oesa-2026-3879 OESA-2026-3879 — git-lfs security update 2026-10-02T13:03:20.295089+00:00

Affected: openEuler:24.03-LTS-SP1: git-lfs

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es):

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the bin…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10525-1 openSUSE-SU-2026:10525-1 — go1.26-1.26.2-1.1 on GA media 2026-10-02T13:03:20.295173+00:00

go1.26-1.26.2-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:10155 RHSA-2026:10155 — Red Hat Security Advisory: Red Hat OpenShift Builds 1.6.5 2026-10-02T13:03:20.295197+00:00

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation Tekton Pipelines: github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure via path traversal in git resolver crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

 https://cve.radiocsirt.org/vuln/rlsa-2026:19135 RLSA-2026:19135 — Important: opentelemetry-collector security update 2026-10-02T13:03:20.295256+00:00

Affected: Rocky Linux:10: opentelemetry-collector

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:21356-1 SUSE-SU-2026:21356-1 — Security update for go1.26 2026-10-02T13:03:20.295291+00:00

Security update for go1.26

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33810 UBUNTU-CVE-2026-33810 2026-10-02T13:03:20.295311+00:00

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 26 more

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1006 WID-SEC-W-2026-1006 — Golang Go: Mehrere Schwachstellen 2026-10-02T13:03:20.295367+00:00

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Speicherbeschädigungen zu verursachen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand auszulösen oder andere, nicht näher spezifizierte Angriffe durchzuführen.