https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 12:38:44 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:18480 <p><strong>Affected:</strong> AlmaLinux:10: sgx-common, AlmaLinux:10: sgx-libs, AlmaLinux:10: sgx-mpa, AlmaLinux:10: sgx-pccs, AlmaLinux:10: sgx-pccs-admin, AlmaLinux:10: sgx-pckid-tool, AlmaLinux:10: tdx-qgs</p> <p>The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.</p> <p>Security Fix(es):</p> <p>* qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284) * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745) * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950) * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465) * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: sgx-common, AlmaLinux:10: sgx-libs, AlmaLinux:10: sgx-mpa, AlmaLinux:10: sgx-pccs, AlmaLinux:10: sgx-pccs-admin, AlmaLinux:10: sgx-pckid-tool, AlmaLinux:10: tdx-qgs</p> <p>The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.</p> <p>Security Fix(es):</p> <p>* qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284) * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745) * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950) * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465) * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:18480 https://cve.radiocsirt.org/vuln/bdu:2026-09405 bdu:2026-09405 https://cve.radiocsirt.org/vuln/bdu:2026-09405 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0249 certfr-2026-avi-0249 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0249 https://cve.radiocsirt.org/vuln/cleanstart-2026-fe45272 <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>CVE-2025-13465 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>CVE-2025-13465 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-fe45272 https://cve.radiocsirt.org/vuln/euvd-2026-367728 EUVD-2026-367728 https://cve.radiocsirt.org/vuln/euvd-2026-367728 https://cve.radiocsirt.org/vuln/fkie_cve-2025-13465 <p>Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.</p> <p>The issue permits deletion of properties but does not allow overwriting their original behavior.</p> <p>This issue is patched on 4.17.23</p> <p>Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.</p> <p>The issue permits deletion of properties but does not allow overwriting their original behavior.</p> <p>This issue is patched on 4.17.23</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-13465 https://cve.radiocsirt.org/vuln/ghsa-xxjr-mmjv-4gpg <p><strong>Affected:</strong> npm: lodash, npm: lodash.unset, npm: lodash-es, npm: lodash-amd</p> <p>### Impact</p> <p>Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.</p> <p>The issue permits deletion of properties but does not allow overwriting their original behavior.</p> <p>### Patches</p> <p>This issue is patched on 4.17.23.</p> <p><strong>Affected:</strong> npm: lodash, npm: lodash.unset, npm: lodash-es, npm: lodash-amd</p> <p>### Impact</p> <p>Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.</p> <p>The issue permits deletion of properties but does not allow overwriting their original behavior.</p> <p>### Patches</p> <p>This issue is patched on 4.17.23.</p> https://cve.radiocsirt.org/vuln/ghsa-xxjr-mmjv-4gpg https://cve.radiocsirt.org/vuln/icsa-26-188-05 <p>A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue. A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue. A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corrup…</p> <p>A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue. A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue. A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corrup…</p> https://cve.radiocsirt.org/vuln/icsa-26-188-05 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10124-1 <p>golang-github-prometheus-prometheus-3.9.1-2.1 on GA media</p> <p>golang-github-prometheus-prometheus-3.9.1-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10124-1 https://cve.radiocsirt.org/vuln/rhsa-2026:11414 <p>lodash: prototype pollution in _.unset and _.omit functions golang: net/url: Memory exhaustion in query parameter parsing in net/url crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption rhacm: Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution axios: Axios: Remote Code Execution via Prototype Pollution escalation</p> <p>lodash: prototype pollution in _.unset and _.omit functions golang: net/url: Memory exhaustion in query parameter parsing in net/url crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption rhacm: Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution axios: Axios: Remote Code Execution via Prototype Pollution escalation</p> https://cve.radiocsirt.org/vuln/rhsa-2026:11414 https://cve.radiocsirt.org/vuln/rlsa-2026:18480 <p><strong>Affected:</strong> Rocky Linux:10: linux-sgx</p> <p>The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.</p> <p>Security Fix(es):</p> <p>* qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)</p> <p>* node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)</p> <p>* node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)</p> <p>* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)</p> <p>* node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</p> <p><strong>Affected:</strong> Rocky Linux:10: linux-sgx</p> <p>The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.</p> <p>Security Fix(es):</p> <p>* qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)</p> <p>* node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)</p> <p>* node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)</p> <p>* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)</p> <p>* node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:18480 https://cve.radiocsirt.org/vuln/ssa-253495 <p>A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue. A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue. A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corrup…</p> <p>A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue. A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue. A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corrup…</p> https://cve.radiocsirt.org/vuln/ssa-253495 https://cve.radiocsirt.org/vuln/suse-su-2026:0379-1 <p>Security update for cockpit-podman</p> <p>Security update for cockpit-podman</p> https://cve.radiocsirt.org/vuln/suse-su-2026:0379-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-13465 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: node-lodash, Ubuntu:Pro:18.04:LTS: node-lodash, Ubuntu:Pro:20.04:LTS: node-lodash, Ubuntu:Pro:22.04:LTS: node-lodash, Ubuntu:Pro:24.04:LTS: node-lodash, Ubuntu:25.10: node-lodash</p> <p>Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: node-lodash, Ubuntu:Pro:18.04:LTS: node-lodash, Ubuntu:Pro:20.04:LTS: node-lodash, Ubuntu:Pro:22.04:LTS: node-lodash, Ubuntu:Pro:24.04:LTS: node-lodash, Ubuntu:25.10: node-lodash</p> <p>Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-13465 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0362 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0362