https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T05:03:41.712249+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:35833 ALSA-2026:35833 — Important: container-tools:rhel8 security update 2026-10-03T05:03:42.584372+00:00

Affected: AlmaLinux:8: aardvark-dns, AlmaLinux:8: buildah, AlmaLinux:8: buildah-tests, AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: container-selinux, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: containers-common, AlmaLinux:8: crit, AlmaLinux:8: criu and 24 more

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830) * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832) * golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-12029 bdu:2026-12029 2026-10-03T05:03:42.584568+00:00 bdu:2026-12029 https://cve.radiocsirt.org/vuln/bell-cve-2026-39832 BELL-CVE-2026-39832 2026-10-03T05:03:42.584590+00:00

Affected: Alpaquita:23: buildah, Alpaquita:23: containerd, Alpaquita:23: podman, Alpaquita:23: skopeo, Alpaquita:25: buildah, Alpaquita:25: containerd, Alpaquita:25: docker-cli-buildx, Alpaquita:25: google-guest-agent, Alpaquita:25: osv-scanner, Alpaquita:25: podman and 13 more

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 certfr-2026-avi-0901 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T05:03:42.584637+00:00 certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/cleanstart-2026-ad30368 Withdrawn: CLEANSTART-2026-AD30368 — Security fixes for CVE-2026-2303, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39827, CVE-2… 2026-10-03T05:03:42.584656+00:00

Withdrawn by the publisher.

Affected: CleanStart: weaviate-fips

Multiple security vulnerabilities affect the weaviate-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-368450 EUVD-2026-368450 2026-10-03T05:03:42.584681+00:00 EUVD-2026-368450 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39832 fkie_cve-2026-39832 2026-10-03T05:03:42.584693+00:00

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

 https://cve.radiocsirt.org/vuln/ghsa-f5wc-c3c7-36mc GHSA-f5wc-c3c7-36mc — golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys 2026-10-03T05:03:42.584717+00:00

Affected: Go: golang.org/x/crypto

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-39832 msrc_CVE-2026-39832 — Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent 2026-10-03T05:03:42.584739+00:00 msrc_CVE-2026-39832 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10842-1 openSUSE-SU-2026:10842-1 — apptainer-1.4.5-5.1 on GA media 2026-10-03T05:03:42.584757+00:00

apptainer-1.4.5-5.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:36319 RHSA-2026:36319 — Red Hat Security Advisory: RHACS 4.9.9 security and bug fix update 2026-10-03T05:03:42.584778+00:00

stackrox: stackrox: Unbounded GraphQL query depth allows authenticated denial of service form-data: form-data: Form field override via CRLF injection net/url: Incorrect parsing of IPv6 host literals in net/url golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME net/mail: golang: Go net/mail: Denial of Service via crafted email inputs golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate net/mail: golang: net/mail: Denial of Service via pathological email address parsing golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripti…

 https://cve.radiocsirt.org/vuln/rlsa-2026:35833 RLSA-2026:35833 — Important: container-tools:rhel8 security update 2026-10-03T05:03:42.584845+00:00

Affected: Rocky Linux:8: aardvark-dns, Rocky Linux:8: cockpit-podman, Rocky Linux:8: buildah, Rocky Linux:8: conmon, Rocky Linux:8: containernetworking-plugins, Rocky Linux:8: containers-common, Rocky Linux:8: container-selinux, Rocky Linux:8: criu, Rocky Linux:8: crun, Rocky Linux:8: fuse-overlayfs and 9 more

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)

* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)

* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)

* golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:22065-1 SUSE-SU-2026:22065-1 — Security update for elemental-toolkit 2026-10-03T05:03:42.584965+00:00

Security update for elemental-toolkit

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-39832 UBUNTU-CVE-2026-39832 2026-10-03T05:03:42.584991+00:00

Affected: Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:16.04:LTS: snapd, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: snapd, Ubuntu:Pro:20.04:LTS: snapd, Ubuntu:Pro:20.04:LTS: golang-go.crypto, Ubuntu:22.04:LTS: snapd, Ubuntu:Pro:22.04:LTS: golang-go.crypto, Ubuntu:24.04:LTS: snapd, Ubuntu:Pro:24.04:LTS: golang-go.crypto and 4 more

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1653 WID-SEC-W-2026-1653 — Golang Go-Module (Net, Image, Crypto: Mehrere Schwachstellen 2026-10-03T05:03:42.585029+00:00

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um erweiterte Privilegien zu erlangen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu verursachen.