https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T19:20:07.012975+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-25680 CVE-2026-25680 — Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html 2026-10-05T19:20:07.104224+00:00

Affected: golang.org/x/net/html

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

 https://cve.radiocsirt.org/vuln/ghsa-fpg8-7664-jc5q GHSA-fpg8-7664-jc5q — melange: Incomplete package integrity verification allows data section substitution 2026-10-05T19:20:07.104287+00:00

Affected: Go: chainguard.dev/apko, Go: chainguard.dev/melange

Previously, Apko verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed.