https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:34:22 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:35833 <p><strong>Affected:</strong> AlmaLinux:8: aardvark-dns, AlmaLinux:8: buildah, AlmaLinux:8: buildah-tests, AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: container-selinux, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: containers-common, AlmaLinux:8: crit, AlmaLinux:8: criu and 24 more</p> <p>The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.</p> <p>Security Fix(es):</p> <p>* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830) * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832) * golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: aardvark-dns, AlmaLinux:8: buildah, AlmaLinux:8: buildah-tests, AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: container-selinux, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: containers-common, AlmaLinux:8: crit, AlmaLinux:8: criu and 24 more</p> <p>The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.</p> <p>Security Fix(es):</p> <p>* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830) * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832) * golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:35833 https://cve.radiocsirt.org/vuln/bdu:2026-12029 bdu:2026-12029 https://cve.radiocsirt.org/vuln/bdu:2026-12029 https://cve.radiocsirt.org/vuln/bell-cve-2026-39832 <p><strong>Affected:</strong> Alpaquita:23: buildah, Alpaquita:23: containerd, Alpaquita:23: podman, Alpaquita:23: skopeo, Alpaquita:25: buildah, Alpaquita:25: containerd, Alpaquita:25: docker-cli-buildx, Alpaquita:25: google-guest-agent, Alpaquita:25: osv-scanner, Alpaquita:25: podman and 13 more</p> <p><strong>Affected:</strong> Alpaquita:23: buildah, Alpaquita:23: containerd, Alpaquita:23: podman, Alpaquita:23: skopeo, Alpaquita:25: buildah, Alpaquita:25: containerd, Alpaquita:25: docker-cli-buildx, Alpaquita:25: google-guest-agent, Alpaquita:25: osv-scanner, Alpaquita:25: podman and 13 more</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-39832 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/cleanstart-2026-ad30368 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: weaviate-fips</p> <p>Multiple security vulnerabilities affect the weaviate-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: weaviate-fips</p> <p>Multiple security vulnerabilities affect the weaviate-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ad30368 https://cve.radiocsirt.org/vuln/euvd-2026-368450 EUVD-2026-368450 https://cve.radiocsirt.org/vuln/euvd-2026-368450 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39832 <p>When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.</p> <p>When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-39832 https://cve.radiocsirt.org/vuln/ghsa-f5wc-c3c7-36mc <p><strong>Affected:</strong> Go: golang.org/x/crypto</p> <p>When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.</p> <p><strong>Affected:</strong> Go: golang.org/x/crypto</p> <p>When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.</p> https://cve.radiocsirt.org/vuln/ghsa-f5wc-c3c7-36mc https://cve.radiocsirt.org/vuln/msrc_cve-2026-39832 msrc_CVE-2026-39832 https://cve.radiocsirt.org/vuln/msrc_cve-2026-39832 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10842-1 <p>apptainer-1.4.5-5.1 on GA media</p> <p>apptainer-1.4.5-5.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10842-1 https://cve.radiocsirt.org/vuln/rhsa-2026:36319 <p>stackrox: stackrox: Unbounded GraphQL query depth allows authenticated denial of service form-data: form-data: Form field override via CRLF injection net/url: Incorrect parsing of IPv6 host literals in net/url golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME net/mail: golang: Go net/mail: Denial of Service via crafted email inputs golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate net/mail: golang: net/mail: Denial of Service via pathological email address parsing golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripti…</p> <p>stackrox: stackrox: Unbounded GraphQL query depth allows authenticated denial of service form-data: form-data: Form field override via CRLF injection net/url: Incorrect parsing of IPv6 host literals in net/url golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME net/mail: golang: Go net/mail: Denial of Service via crafted email inputs golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate net/mail: golang: net/mail: Denial of Service via pathological email address parsing golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripti…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:36319 https://cve.radiocsirt.org/vuln/rlsa-2026:35833 <p><strong>Affected:</strong> Rocky Linux:8: aardvark-dns, Rocky Linux:8: cockpit-podman, Rocky Linux:8: buildah, Rocky Linux:8: conmon, Rocky Linux:8: containernetworking-plugins, Rocky Linux:8: containers-common, Rocky Linux:8: container-selinux, Rocky Linux:8: criu, Rocky Linux:8: crun, Rocky Linux:8: fuse-overlayfs and 9 more</p> <p>The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.</p> <p>Security Fix(es):</p> <p>* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)</p> <p>* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)</p> <p>* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)</p> <p>* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)</p> <p>* golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:8: aardvark-dns, Rocky Linux:8: cockpit-podman, Rocky Linux:8: buildah, Rocky Linux:8: conmon, Rocky Linux:8: containernetworking-plugins, Rocky Linux:8: containers-common, Rocky Linux:8: container-selinux, Rocky Linux:8: criu, Rocky Linux:8: crun, Rocky Linux:8: fuse-overlayfs and 9 more</p> <p>The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.</p> <p>Security Fix(es):</p> <p>* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)</p> <p>* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)</p> <p>* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)</p> <p>* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)</p> <p>* golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:35833 https://cve.radiocsirt.org/vuln/suse-su-2026:22065-1 <p>Security update for elemental-toolkit</p> <p>Security update for elemental-toolkit</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22065-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-39832 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:16.04:LTS: snapd, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: snapd, Ubuntu:Pro:20.04:LTS: snapd, Ubuntu:Pro:20.04:LTS: golang-go.crypto, Ubuntu:22.04:LTS: snapd, Ubuntu:Pro:22.04:LTS: golang-go.crypto, Ubuntu:24.04:LTS: snapd, Ubuntu:Pro:24.04:LTS: golang-go.crypto and 4 more</p> <p>When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:16.04:LTS: snapd, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: snapd, Ubuntu:Pro:20.04:LTS: snapd, Ubuntu:Pro:20.04:LTS: golang-go.crypto, Ubuntu:22.04:LTS: snapd, Ubuntu:Pro:22.04:LTS: golang-go.crypto, Ubuntu:24.04:LTS: snapd, Ubuntu:Pro:24.04:LTS: golang-go.crypto and 4 more</p> <p>When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-39832 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1653 <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um erweiterte Privilegien zu erlangen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um erweiterte Privilegien zu erlangen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1653