https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T22:26:35.982070+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-338635 EUVD-2026-338635 2026-10-03T22:26:35.990500+00:00 EUVD-2026-338635 https://cve.radiocsirt.org/vuln/fkie_cve-2026-62309 fkie_cve-2026-62309 2026-10-03T22:26:35.990549+00:00

CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plugin is enabled because plugin/pkg/proxyproto/proxyproto.go PacketConn.ReadFrom handles a PROXY v2 header with non-UDP transport such as family byte 0x11, reassigns addr from a nil readFrom result after parseProxyProtocol errors, and calls addr.String() in the warning log before ServeDNS recovery applies. This issue is fixed in version 1.14.4.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-62309 msrc_CVE-2026-62309 — CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS 2026-10-03T22:26:35.990600+00:00 msrc_CVE-2026-62309 https://cve.radiocsirt.org/vuln/rhsa-2026:63016 RHSA-2026:63016 — Red Hat Security Advisory: Submariner v0.24 security fixes and container updates 2026-10-03T22:26:35.990630+00:00

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering github.com/coredns/coredns: CoreDNS: Denial of Service via crafted UDP datagram with proxyproto plugin submariner-operator: Broker ServiceAccount Secret (token + CA) logged in full at TRACE verbosity submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication submariner-operator: Operator ClusterRole grants cluster-wide create/update on all ConfigMaps submariner-operator: Release workflow consumes same-org composite action via mutable @devel branch ref submariner: IPsec PSK secrets file created with default world-readable permissions submariner: submariner: ipsec.conf stanza injection via remote-supplied CableName and Subnets lighthouse: Go pprof profiling endpoint enabled unconditionally on lighthouse-agent :8082 lighthouse: Dockerfile build stages use end-of-life Fedora 40 referenced by mutable tag

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2271 WID-SEC-W-2026-2271 — CoreDNS: Mehrere Schwachstellen ermöglichen Denial of Service 2026-10-03T22:26:35.990703+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in CoreDNS ausnutzen, um einen Denial of Service Angriff durchzuführen.