https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T20:16:58.877513+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-1229 CVE-2026-1229 — Incorrect calculation in CIRCL secp384r1 CombinedMult 2026-10-10T20:16:58.937089+00:00

Affected: Cloudflare CIRCL

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected.

The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .

 https://cve.radiocsirt.org/vuln/ghsa-j88v-2chj-qfwx GHSA-j88v-2chj-qfwx — pgx: SQL Injection via placeholder confusion with dollar quoted string literals 2026-10-10T20:16:58.937157+00:00

Affected: Go: github.com/jackc/pgx/v5, Go: github.com/jackc/pgx/v4, Go: github.com/jackc/pgx

### Impact

SQL Injection can occur when:

1. The non-default simple protocol is used. 2. A dollar quoted string literal is used in the SQL query. 3. That string literal contains text that would be would be interpreted as a placeholder outside of a string literal. 4. The value of that placeholder is controllable by the attacker.

e.g.

```go attackValue := `$tag$; drop table canary; --` _, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue) ```

This is unlikely to occur outside of a contrived scenario.

### Patches

The problem is resolved in v5.9.2.

### Workarounds

Do not use the simple protocol to execute queries matching all the above conditions.