https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:00:20.145508+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 certfr-2026-avi-0556 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-02T11:00:20.446514+00:00 certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/cleanstart-2026-ly29111 CLEANSTART-2026-LY29111 — DataRow 2026-10-02T11:00:20.446584+00:00

Affected: CleanStart: grafana-alloy

Security vulnerability affects the grafana-alloy package. The DataRow.

 https://cve.radiocsirt.org/vuln/euvd-2026-366112 EUVD-2026-366112 2026-10-02T11:00:20.446618+00:00 EUVD-2026-366112 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32286 fkie_cve-2026-32286 2026-10-02T11:00:20.446632+00:00

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

 https://cve.radiocsirt.org/vuln/ghsa-jqcq-xjh3-6g23 GHSA-jqcq-xjh3-6g23 — Denial of service in github.com/jackc/pgproto3/v2 2026-10-02T11:00:20.446655+00:00

Affected: Go: github.com/jackc/pgproto3/v2

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

 https://cve.radiocsirt.org/vuln/rhsa-2026:11070 RHSA-2026:11070 — Red Hat Security Advisory: RHACS 4.8.11 security and bug fix update 2026-10-02T11:00:20.446675+00:00

immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

 https://cve.radiocsirt.org/vuln/rhsa-2026:22450 RHSA-2026:22450 — Red Hat Security Advisory: osbuild-composer security update 2026-10-02T11:00:20.446704+00:00

golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: Incorrect enforcement of email constraints in crypto/x509 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

 https://cve.radiocsirt.org/vuln/rlsa-2026:22450 RLSA-2026:22450 — Important: osbuild-composer security update 2026-10-02T11:00:20.446737+00:00

Affected: Rocky Linux:10: osbuild-composer

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)

* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key updat…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-32286 UBUNTU-CVE-2026-32286 2026-10-02T11:00:20.446777+00:00

Affected: Ubuntu:24.04:LTS: golang-github-jackc-pgproto3, Ubuntu:25.10: golang-github-jackc-pgproto3, Ubuntu:26.04:LTS: golang-github-jackc-pgproto3

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.