https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T03:17:28.026594+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-1229 CVE-2026-1229 — Incorrect calculation in CIRCL secp384r1 CombinedMult 2026-10-15T03:17:28.055022+00:00

Affected: Cloudflare CIRCL

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected.

The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .

 https://cve.radiocsirt.org/vuln/ghsa-xmrv-pmrh-hhx2 GHSA-xmrv-pmrh-hhx2 — Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder 2026-10-15T03:17:28.055081+00:00

Affected: Go: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream, Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentcore, Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime, Go: github.com/aws/aws-sdk-go-v2/service/bedrockruntime, Go: github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs, Go: github.com/aws/aws-sdk-go-v2/service/iotsitewise, Go: github.com/aws/aws-sdk-go-v2/service/kinesis, Go: github.com/aws/aws-sdk-go-v2/service/lambda, Go: github.com/aws/aws-sdk-go-v2/service/lexruntimev2, Go: github.com/aws/aws-sdk-go-v2/service/s3 and 2 more

**CVSSv3.1 Rating**: [Medium] **CVSSv3.1 Score**: [5.9] **CVSSv3.1 Vector String**: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]

## Summary and Impact An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23). An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.

Impacted versions: < [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23)

## Patches This issue has been addressed in versions [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23) and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

## Workarounds Not Applicable

## References If you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.