https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:55:26 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-56854 <p><strong>Affected:</strong> Alpaquita:23: buildah, Alpaquita:23: containerd, Alpaquita:23: podman, Alpaquita:23: skopeo, Alpaquita:25: buildah, Alpaquita:25: calicoctl, Alpaquita:25: cilium-cli, Alpaquita:25: containerd, Alpaquita:25: docker, Alpaquita:25: docker-cli-buildx and 23 more</p> <p><strong>Affected:</strong> Alpaquita:23: buildah, Alpaquita:23: containerd, Alpaquita:23: podman, Alpaquita:23: skopeo, Alpaquita:25: buildah, Alpaquita:25: calicoctl, Alpaquita:25: cilium-cli, Alpaquita:25: containerd, Alpaquita:25: docker, Alpaquita:25: docker-cli-buildx and 23 more</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-56854 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1249 certfr-2026-avi-1249 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1249 https://cve.radiocsirt.org/vuln/cleanstart-2026-bc74118 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: external-secrets-operator</p> <p>Multiple security vulnerabilities affect the external-secrets-operator package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: external-secrets-operator</p> <p>Multiple security vulnerabilities affect the external-secrets-operator package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-bc74118 https://cve.radiocsirt.org/vuln/euvd-2026-361457 EUVD-2026-361457 https://cve.radiocsirt.org/vuln/euvd-2026-361457 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56854 <p>The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client&#39;s remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.</p> <p>The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client&#39;s remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56854 https://cve.radiocsirt.org/vuln/ghsa-gjhq-gjfw-99mq <p>The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client&#39;s remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.</p> <p>The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client&#39;s remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.</p> https://cve.radiocsirt.org/vuln/ghsa-gjhq-gjfw-99mq https://cve.radiocsirt.org/vuln/opensuse-su-2026:11699-1 <p>google-guest-agent-20260903.00-1.1 on GA media</p> <p>google-guest-agent-20260903.00-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11699-1 https://cve.radiocsirt.org/vuln/rhsa-2026:68333 <p>vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service v…</p> <p>vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service v…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:68333 https://cve.radiocsirt.org/vuln/suse-su-2026:23736-1 <p>Security update for google-guest-agent</p> <p>Security update for google-guest-agent</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23736-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56854 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: golang-go.crypto, Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:16.04:LTS: snapd, Ubuntu:Pro:16.04:LTS: google-guest-agent, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: snapd, Ubuntu:Pro:18.04:LTS: golang-go.crypto, Ubuntu:Pro:18.04:LTS: google-guest-agent, Ubuntu:Pro:20.04:LTS: google-guest-agent, Ubuntu:Pro:20.04:LTS: snapd and 10 more</p> <p>The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client&#39;s remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: golang-go.crypto, Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:16.04:LTS: snapd, Ubuntu:Pro:16.04:LTS: google-guest-agent, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: snapd, Ubuntu:Pro:18.04:LTS: golang-go.crypto, Ubuntu:Pro:18.04:LTS: google-guest-agent, Ubuntu:Pro:20.04:LTS: google-guest-agent, Ubuntu:Pro:20.04:LTS: snapd and 10 more</p> <p>The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client&#39;s remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56854 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3487 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift Builds ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift Builds ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3487