https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T10:59:07.691600+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-04129 bdu:2026-04129 2026-10-02T10:59:08.847721+00:00 bdu:2026-04129 https://cve.radiocsirt.org/vuln/bell-cve-2026-27142 BELL-CVE-2026-27142 2026-10-02T10:59:08.847768+00:00

Affected: Alpaquita:23: go, Alpaquita:25: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go

 https://cve.radiocsirt.org/vuln/bit-golang-2026-27142 BIT-golang-2026-27142 — URLs in meta content attribute actions are not escaped in html/template 2026-10-02T10:59:08.847806+00:00

Affected: Bitnami: golang

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0315 certfr-2026-avi-0315 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-02T10:59:08.847833+00:00 certfr-2026-avi-0315 https://cve.radiocsirt.org/vuln/cleanstart-2026-aa33691 Withdrawn: CLEANSTART-2026-AA33691 — Security fixes in calico-fips 3.28.5-r4 2026-10-02T10:59:08.847850+00:00

Withdrawn by the publisher.

Affected: CleanStart: calico-fips

Package calico-fips version 3.28.5-r4 fixes 5 vulnerabilities: CVE-2026-33186, CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, CVE-2025-13281

 https://cve.radiocsirt.org/vuln/euvd-2026-276161 EUVD-2026-276161 2026-10-02T10:59:08.847871+00:00 EUVD-2026-276161 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27142 fkie_cve-2026-27142 2026-10-02T10:59:08.847882+00:00

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

 https://cve.radiocsirt.org/vuln/ghsa-j4j7-vw47-rhfq GHSA-j4j7-vw47-rhfq 2026-10-02T10:59:08.847905+00:00

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-27142 msrc_CVE-2026-27142 — URLs in meta content attribute actions are not escaped in html/template 2026-10-02T10:59:08.847920+00:00 msrc_CVE-2026-27142 https://cve.radiocsirt.org/vuln/oesa-2026-1850 OESA-2026-1850 — golang security update 2026-10-02T10:59:08.847936+00:00

Affected: openEuler:24.03-LTS-SP1: golang

. Security Fix(es):

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.(CVE-2026-27142)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10299-1 openSUSE-SU-2026:10299-1 — go1.26-1.26.1-1.1 on GA media 2026-10-02T10:59:08.847957+00:00

go1.26-1.26.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:5192 RHSA-2026:5192 — Red Hat Security Advisory: Red Hat Hardened Images RPM Release 2026-10-02T10:59:08.847975+00:00

html/template: URLs in meta content attribute actions are not escaped in html/template

 https://cve.radiocsirt.org/vuln/suse-su-2026:21195-1 SUSE-SU-2026:21195-1 — Security update for go1.26-openssl 2026-10-02T10:59:08.847990+00:00

Security update for go1.26-openssl

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-27142 UBUNTU-CVE-2026-27142 2026-10-02T10:59:08.848006+00:00

Affected: Ubuntu:22.04:LTS: golang-1.24, Ubuntu:24.04:LTS: golang-1.24, Ubuntu:25.10: golang-1.24, Ubuntu:25.10: golang-1.25, Ubuntu:26.04:LTS: golang-1.24, Ubuntu:26.04:LTS: golang-1.25, Ubuntu:26.04:LTS: golang-1.26

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0548 WID-SEC-W-2026-0548 — Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff 2026-10-02T10:59:08.848034+00:00

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.