https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T10:01:45.389293+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07865 bdu:2026-07865 2026-10-02T10:01:45.762358+00:00 bdu:2026-07865 https://cve.radiocsirt.org/vuln/bell-cve-2026-34040 BELL-CVE-2026-34040 2026-10-02T10:01:45.762400+00:00

Affected: Alpaquita:stream: docker

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0540 certfr-2026-avi-0540 — De multiples vulnérabilités ont été découvertes dans VMware Tanzu Gemfire. Elles permettent à un attaquant de provoquer… 2026-10-02T10:01:45.762428+00:00 certfr-2026-avi-0540 https://cve.radiocsirt.org/vuln/cleanstart-2026-ar38431 Withdrawn: CLEANSTART-2026-AR38431 — Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-… 2026-10-02T10:01:45.762444+00:00

Withdrawn by the publisher.

Affected: CleanStart: vault

Multiple security vulnerabilities affect the vault package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-278631 EUVD-2026-278631 2026-10-02T10:01:45.762471+00:00 EUVD-2026-278631 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34040 fkie_cve-2026-34040 2026-10-02T10:01:45.762483+00:00

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

 https://cve.radiocsirt.org/vuln/ghsa-x744-4wpc-v9h2 GHSA-x744-4wpc-v9h2 — Moby has AuthZ plugin bypass when provided oversized request bodies 2026-10-02T10:01:45.762502+00:00

Affected: Go: github.com/moby/moby, Go: github.com/moby/moby/v2

## Summary

A security vulnerability has been detected that allows attackers to bypass [authorization plugins (AuthZ)](https://docs.docker.com/engine/extend/plugins_authorization/) under specific circumstances. The base likelihood of this being exploited is low.

This is an incomplete fix for [CVE-2024-41110](https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq).

## Impact

**If you don't use AuthZ plugins, you are not affected.**

Using a specially-crafted API request, an attacker could make the Docker daemon forward the request to an authorization plugin without the body. The authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.

Anyone who depends on authorization plugins that introspect the request body to make access control decisions is potentially impacted.

## Workarounds

If unable to update immediately: - Avoid using AuthZ plugins that rely on request body inspection for security decisions. - Restrict access to the Docker API to trusted parties, following the principle of least privilege.

## Credits

- 1seal / Oleh Konko ([@1seal](https://github.com/1seal)) - Cody (c@wormhole.guru) - Asim Viladi Oglu Manizada (@manizada)

## Resources

- [CVE-2024-41110 / GHSA-v23v-6jw2-98fq](https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq)

 https://cve.radiocsirt.org/vuln/oesa-2026-1888 OESA-2026-1888 — docker security update 2026-10-02T10:01:45.762541+00:00

Affected: openEuler:24.03-LTS-SP1: docker, openEuler:24.03-LTS-SP2: docker, openEuler:24.03-LTS-SP3: docker, openEuler:20.03-LTS-SP4: docker, openEuler:22.03-LTS-SP4: docker, openEuler:24.03-LTS: docker

Docker is a product for you to build, ship and run any application as a lightweight container. Security Fix(es):

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.(CVE-2026-34040)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11075-1 openSUSE-SU-2026:11075-1 — docker-stable-24.0.9_ce-18.1 on GA media 2026-10-02T10:01:45.762571+00:00

docker-stable-24.0.9_ce-18.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:21769 RHSA-2026:21769 — Red Hat Security Advisory: Multicluster Global Hub 1.5.4 security update 2026-10-02T10:01:45.762594+00:00

grafana/tempo: Tempo: Denial of Service via large queries net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: Incorrect enforcement of email constraints in crypto/x509 github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed WebSockets frame github.com/nats-io/nats-server: NATS-Server: Denial of Service via leafnode compression crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation nats-server: NATS-Server: Session and message hijacking via MQTT Client ID malfeasance nats-server: github.com/nats-io/nats-server: NATS-Server: Information disclosure of MQTT passwords through monitoring endpoints nats-server: github.com/nats-io/nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace nats-server: github.com/nats-io/nats-server: NATS-Server: Denial of Service via mal…

 https://cve.radiocsirt.org/vuln/suse-su-2026:2578-1 SUSE-SU-2026:2578-1 — Security update for docker-stable 2026-10-02T10:01:45.762667+00:00

Security update for docker-stable

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-34040 UBUNTU-CVE-2026-34040 2026-10-02T10:01:45.762685+00:00

Affected: Ubuntu:Pro:16.04:LTS: docker.io, Ubuntu:Pro:18.04:LTS: docker.io, Ubuntu:Pro:20.04:LTS: docker.io, Ubuntu:Pro:20.04:LTS: docker.io-app, Ubuntu:Pro:22.04:LTS: docker.io, Ubuntu:Pro:22.04:LTS: docker.io-app, Ubuntu:Pro:24.04:LTS: docker.io, Ubuntu:Pro:24.04:LTS: docker.io-app, Ubuntu:25.10: docker.io, Ubuntu:25.10: docker.io-app and 2 more

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0873 WID-SEC-W-2026-0873 — docker: Mehrere Schwachstellen 2026-10-02T10:01:45.762719+00:00

Ein lokaler Angreifer kann mehrere Schwachstellen in docker ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen.