https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T00:55:26.614254+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-cp15003 Withdrawn: CLEANSTART-2026-CP15003 — Security fixes for CVE-2026-25680, CVE-2026-39821, CVE-2026-42504, CVE-2026-42507, CVE-2026-44740, CVE-2026-44973, CVE-… 2026-10-04T00:55:26.625280+00:00

Withdrawn by the publisher.

Affected: CleanStart: kyverno

Multiple security vulnerabilities affect the kyverno package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-338590 EUVD-2026-338590 2026-10-04T00:55:26.625365+00:00 EUVD-2026-338590 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49835 fkie_cve-2026-49835 2026-10-04T00:55:26.625389+00:00

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.

 https://cve.radiocsirt.org/vuln/ghsa-9c54-x2g4-v92j GHSA-9c54-x2g4-v92j — Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality 2026-10-04T00:55:26.625429+00:00

Affected: Go: github.com/sigstore/timestamp-authority/v2, Go: github.com/sigstore/timestamp-authority

### Impact

An unauthenticated remote attacker can trigger unbounded memory growth on the timestamp authority server.

This vulnerability exists because the global `wrapMetrics` middleware records the raw HTTP request path (`r.URL.Path`) and raw HTTP request method (`r.Method`) as Prometheus labels for latency and request count metric vectors. Since this middleware runs before standard routing occurs, it executes for all incoming requests, including those for unmatched paths (yielding 404 responses) or arbitrary request methods. The Prometheus library registers a new, permanent time-series entry for every distinct label combination. An attacker can continuously issue requests containing random paths (e.g., `/api/v1/timestamp/<uuid>`) or random HTTP methods to exhaust system memory.

### Patches

This issue has been patched by limiting the metric label values to a strict allowlist of expected paths (`/ping`, `/api/v1/timestamp`, `/api/v1/timestamp/certchain`) and expected HTTP methods (`GET`, `POST`, `HEAD`, `OPTIONS`). Unrecognized paths or methods are normalized to a static string (`"unrecognized"`).

Users should update to version `v2.0.7` or later.

### Workarounds

1. Block or drop incoming requests with invalid HTTP methods or unknown request paths at a reverse proxy or load balancer before they reach the timestamp authority server. 2. Configure rate-limiting on the public interface to prevent remote attackers from issuing millions of unique requests in a short duration.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11398-1 openSUSE-SU-2026:11398-1 — tekton-cli-0.45.1-1.1 on GA media 2026-10-04T00:55:26.625488+00:00

tekton-cli-0.45.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-49835 UBUNTU-CVE-2026-49835 2026-10-04T00:55:26.625515+00:00

Affected: Ubuntu:26.04:LTS: golang-github-sigstore-timestamp-authority

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.