https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:58:13.399084+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-15305 bdu:2026-15305 2026-10-02T11:58:14.711835+00:00 bdu:2026-15305 https://cve.radiocsirt.org/vuln/bell-cve-2026-42502 BELL-CVE-2026-42502 2026-10-02T11:58:14.711905+00:00

Affected: Alpaquita:23: buildah, Alpaquita:23: containerd, Alpaquita:23: podman, Alpaquita:23: runc, Alpaquita:23: skopeo, Alpaquita:25: buildah, Alpaquita:25: containerd, Alpaquita:25: docker-cli-buildx, Alpaquita:25: google-guest-agent, Alpaquita:25: osv-scanner and 20 more

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0674 certfr-2026-avi-0674 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu… 2026-10-02T11:58:14.711971+00:00 certfr-2026-avi-0674 https://cve.radiocsirt.org/vuln/cleanstart-2026-ad30368 Withdrawn: CLEANSTART-2026-AD30368 — Security fixes for CVE-2026-2303, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39827, CVE-2… 2026-10-02T11:58:14.711990+00:00

Withdrawn by the publisher.

Affected: CleanStart: weaviate-fips

Multiple security vulnerabilities affect the weaviate-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-320139 EUVD-2026-320139 2026-10-02T11:58:14.712017+00:00 EUVD-2026-320139 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42502 fkie_cve-2026-42502 2026-10-02T11:58:14.712029+00:00

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

 https://cve.radiocsirt.org/vuln/ghsa-wrh2-89vg-4j9g GHSA-wrh2-89vg-4j9g 2026-10-02T11:58:14.712051+00:00

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-42502 msrc_CVE-2026-42502 — Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html 2026-10-02T11:58:14.712065+00:00 msrc_CVE-2026-42502 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10856-1 openSUSE-SU-2026:10856-1 — rclone-1.74.2-1.1 on GA media 2026-10-02T11:58:14.712083+00:00

rclone-1.74.2-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:26546 RHSA-2026:26546 — Red Hat Security Advisory: RHACS 4.9.8 security and bug fix update 2026-10-02T11:58:14.712112+00:00

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation

 https://cve.radiocsirt.org/vuln/rlsa-2026:66432 RLSA-2026:66432 — Important: osbuild-composer security update 2026-10-02T11:58:14.712141+00:00

Affected: Rocky Linux:10: osbuild-composer

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

* github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

* github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:22065-1 SUSE-SU-2026:22065-1 — Security update for elemental-toolkit 2026-10-02T11:58:14.712174+00:00

Security update for elemental-toolkit

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42502 UBUNTU-CVE-2026-42502 2026-10-02T11:58:14.712200+00:00

Affected: Ubuntu:Pro:16.04:LTS: golang-golang-x-net-dev, Ubuntu:Pro:18.04:LTS: golang-golang-x-net-dev, Ubuntu:Pro:20.04:LTS: golang-golang-x-net-dev

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1653 WID-SEC-W-2026-1653 — Golang Go-Module (Net, Image, Crypto: Mehrere Schwachstellen 2026-10-02T11:58:14.712222+00:00

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um erweiterte Privilegien zu erlangen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu verursachen.