https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T12:16:09.947568+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-24051 CVE-2026-24051 — OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking 2026-10-09T12:16:09.949699+00:00

Affected: open-telemetry opentelemetry-go

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.

 https://cve.radiocsirt.org/vuln/ghsa-fw7p-63qq-7hpr GHSA-fw7p-63qq-7hpr — filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity 2026-10-09T12:16:09.949754+00:00

Affected: Go: filippo.io/edwards25519

`(*Point).MultiScalarMult` failed to initialize its receiver.

If the method was called on an initialized point that is not the identity point, MultiScalarMult produced an incorrect result.

If the method was called on an uninitialized point, the behavior was undefined. In particular, if the receiver was the zero value, MultiScalarMult returned an invalid point that compared Equal to every point.

*Note that MultiScalarMult is a rarely used advanced API. For example, if you only depend on `filippo.io/edwards25519` via `github.com/go-sql-driver/mysql`, **you are not affected**. If you were notified of this issue despite not being affected, consider switching to a vulnerability scanner that is more precise and respectful of your attention, like [govulncheck](https://go.dev/doc/tutorial/govulncheck).*