https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T14:52:59.215068+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-47907 CVE-2025-47907 — Incorrect results returned from Rows.Scan in database/sql 2026-10-08T14:52:59.476937+00:00

Affected: Go standard library database/sql

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.

 https://cve.radiocsirt.org/vuln/ghsa-273p-m2cw-6833 GHSA-273p-m2cw-6833 — Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message 2026-10-08T14:52:59.477008+00:00

Affected: Go: github.com/sigstore/rekor

## Summary

Rekor’s cose v0.0.1 entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty `spec.message`. `validate()` returns nil (success) when `message` is empty, leaving `sign1Msg` uninitialized, and `Canonicalize()` later dereferences `v.sign1Msg.Payload`.

## Impact

A malformed proposed entry of the `cose/v0.0.1` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.

## Patches

Upgrade to v1.5.0

## Workarounds

None