https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 01:05:52 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-11599 bdu:2025-11599 https://cve.radiocsirt.org/vuln/bdu:2025-11599 https://cve.radiocsirt.org/vuln/bell-cve-2025-47910 <p><strong>Affected:</strong> Alpaquita:stream: go, BellSoft Hardened Containers:stream: go</p> <p><strong>Affected:</strong> Alpaquita:stream: go, BellSoft Hardened Containers:stream: go</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-47910 https://cve.radiocsirt.org/vuln/bit-golang-2025-47910 <p><strong>Affected:</strong> Bitnami: golang</p> <p>When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.</p> <p><strong>Affected:</strong> Bitnami: golang</p> <p>When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.</p> https://cve.radiocsirt.org/vuln/bit-golang-2025-47910 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0938 certfr-2025-avi-0938 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0938 https://cve.radiocsirt.org/vuln/cleanstart-2026-ds01292 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cert-manager-fips</p> <p>Multiple security vulnerabilities affect the cert-manager-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cert-manager-fips</p> <p>Multiple security vulnerabilities affect the cert-manager-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ds01292 https://cve.radiocsirt.org/vuln/euvd-2026-253360 EUVD-2026-253360 https://cve.radiocsirt.org/vuln/euvd-2026-253360 https://cve.radiocsirt.org/vuln/fkie_cve-2025-47910 <p>When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.</p> <p>When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-47910 https://cve.radiocsirt.org/vuln/ghsa-8pjc-487g-w6p2 <p>When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.</p> <p>When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.</p> https://cve.radiocsirt.org/vuln/ghsa-8pjc-487g-w6p2 https://cve.radiocsirt.org/vuln/oesa-2026-3879 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: git-lfs</p> <p>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es):</p> <p>The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)</p> <p>Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk&amp;apos;s Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)</p> <p>Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)</p> <p>If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (&amp;quot;&amp;quot;, &amp;quot;.&amp;quot;, and &amp;quot;..&amp;quot;), can result in the bin…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: git-lfs</p> <p>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es):</p> <p>The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)</p> <p>Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk&amp;apos;s Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)</p> <p>Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)</p> <p>If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (&amp;quot;&amp;quot;, &amp;quot;.&amp;quot;, and &amp;quot;..&amp;quot;), can result in the bin…</p> https://cve.radiocsirt.org/vuln/oesa-2026-3879 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15525-1 <p>go1.25-1.25.1-1.1 on GA media</p> <p>go1.25-1.25.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15525-1 https://cve.radiocsirt.org/vuln/rhsa-2026:7291 <p>os: os: Information disclosure via path traversal using specially crafted filenames net/http: CrossOriginProtection bypass in net/http golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html net/url: Insufficient validation of bracketed IPv6 hostnames in net/url golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication golang: archive/tar: Unbounded allocation when parsing GNU sparse map encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1 golang.org/net/http: Lack of limit when parsing cookies can cause memory exhaustion in net/http crypto/x509: Quadratic complexity when checking name constraints in crypto/x509 crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509 crypto/tls: go crypto/tls ALPN negotiation error contains attacker controlled information golang.org/x/net/html: Infinite parsing loop in golang.org/x/net encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem net/textproto: Excessive CPU consumption in Reader.ReadResponse in net/textproto net/mail: Excessive CPU consumption in ParseAddress in net/mail golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs golang: archive/zip: Excessive CPU co…</p> <p>os: os: Information disclosure via path traversal using specially crafted filenames net/http: CrossOriginProtection bypass in net/http golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html net/url: Insufficient validation of bracketed IPv6 hostnames in net/url golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication golang: archive/tar: Unbounded allocation when parsing GNU sparse map encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1 golang.org/net/http: Lack of limit when parsing cookies can cause memory exhaustion in net/http crypto/x509: Quadratic complexity when checking name constraints in crypto/x509 crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509 crypto/tls: go crypto/tls ALPN negotiation error contains attacker controlled information golang.org/x/net/html: Infinite parsing loop in golang.org/x/net encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem net/textproto: Excessive CPU consumption in Reader.ReadResponse in net/textproto net/mail: Excessive CPU consumption in ParseAddress in net/mail golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs golang: archive/zip: Excessive CPU co…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:7291 https://cve.radiocsirt.org/vuln/suse-su-2025:21192-1 <p>Security update for go1.25</p> <p>Security update for go1.25</p> https://cve.radiocsirt.org/vuln/suse-su-2025:21192-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-47910 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 26 more</p> <p>When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 26 more</p> <p>When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-47910 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1963 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Golang Go ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Golang Go ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1963