https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:07:31.177732+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-56854 BELL-CVE-2026-56854 2026-10-02T11:07:31.607056+00:00

Affected: Alpaquita:23: buildah, Alpaquita:23: containerd, Alpaquita:23: podman, Alpaquita:23: skopeo, Alpaquita:25: buildah, Alpaquita:25: calicoctl, Alpaquita:25: cilium-cli, Alpaquita:25: containerd, Alpaquita:25: docker, Alpaquita:25: docker-cli-buildx and 23 more

 https://cve.radiocsirt.org/vuln/cleanstart-2026-bc74118 Withdrawn: CLEANSTART-2026-BC74118 — source-address critical option in the Permissions returned by an authentication callback was only enforced for the Publ… 2026-10-02T11:07:31.607170+00:00

Withdrawn by the publisher.

Affected: CleanStart: external-secrets-operator

Multiple security vulnerabilities affect the external-secrets-operator package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-361457 EUVD-2026-361457 2026-10-02T11:07:31.607201+00:00 EUVD-2026-361457 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56854 fkie_cve-2026-56854 2026-10-02T11:07:31.607236+00:00

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

 https://cve.radiocsirt.org/vuln/ghsa-gjhq-gjfw-99mq GHSA-gjhq-gjfw-99mq 2026-10-02T11:07:31.607265+00:00

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11699-1 openSUSE-SU-2026:11699-1 — google-guest-agent-20260903.00-1.1 on GA media 2026-10-02T11:07:31.607283+00:00

google-guest-agent-20260903.00-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:68333 RHSA-2026:68333 — Red Hat Security Advisory: Red Hat build of Cryostat security update 2026-10-02T11:07:31.607301+00:00

vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service v…

 https://cve.radiocsirt.org/vuln/suse-su-2026:23736-1 SUSE-SU-2026:23736-1 — Security update for google-guest-agent 2026-10-02T11:07:31.607377+00:00

Security update for google-guest-agent

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56854 UBUNTU-CVE-2026-56854 2026-10-02T11:07:31.607396+00:00

Affected: Ubuntu:Pro:16.04:LTS: golang-go.crypto, Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:16.04:LTS: snapd, Ubuntu:Pro:16.04:LTS: google-guest-agent, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: snapd, Ubuntu:Pro:18.04:LTS: golang-go.crypto, Ubuntu:Pro:18.04:LTS: google-guest-agent, Ubuntu:Pro:20.04:LTS: google-guest-agent, Ubuntu:Pro:20.04:LTS: snapd and 10 more

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3487 WID-SEC-W-2026-3487 — Red Hat OpenShift Builds: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2026-10-02T11:07:31.607445+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift Builds ausnutzen, um Sicherheitsvorkehrungen zu umgehen.