https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T18:26:41.433059+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-61732 CVE-2025-61732 — Potential code smuggling via doc comments in cmd/cgo 2026-10-10T18:26:41.519070+00:00

Affected: Go toolchain cmd/cgo, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions and 23 more

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

 https://cve.radiocsirt.org/vuln/ghsa-9h8m-3fm2-qjrq GHSA-9h8m-3fm2-qjrq — OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking 2026-10-10T18:26:41.520239+00:00

Affected: Go: go.opentelemetry.io/otel/sdk

### Impact The OpenTelemetry Go SDK in version `v1.20.0`-`1.39.0` is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in `sdk/resource/host_id.go` executes the `ioreg` system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application.

### Patches This has been patched in [d45961b](https://github.com/open-telemetry/opentelemetry-go/commit/d45961bcda453fcbdb6469c22d6e88a1f9970a53), which was released with `v1.40.0`.

### References - [CWE-426: Untrusted Search Path](https://cwe.mitre.org/data/definitions/426.html)