https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T18:15:55.626724+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-1229 CVE-2026-1229 — Incorrect calculation in CIRCL secp384r1 CombinedMult 2026-10-15T18:15:55.686267+00:00

Affected: Cloudflare CIRCL

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected.

The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .

 https://cve.radiocsirt.org/vuln/ghsa-9h8m-3fm2-qjrq GHSA-9h8m-3fm2-qjrq — OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking 2026-10-15T18:15:55.686352+00:00

Affected: Go: go.opentelemetry.io/otel/sdk

### Impact The OpenTelemetry Go SDK in version `v1.20.0`-`1.39.0` is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in `sdk/resource/host_id.go` executes the `ioreg` system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application.

### Patches This has been patched in [d45961b](https://github.com/open-telemetry/opentelemetry-go/commit/d45961bcda453fcbdb6469c22d6e88a1f9970a53), which was released with `v1.40.0`.

### References - [CWE-426: Untrusted Search Path](https://cwe.mitre.org/data/definitions/426.html)