https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T23:49:29.869892+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-25679 CVE-2026-25679 — Incorrect parsing of IPv6 host literals in net/url 2026-10-01T23:49:29.885975+00:00

Affected: Go standard library net/url, Red Hat Cryostat 4 on RHEL 9, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8 and 135 more

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

 https://vulnerability.circl.lu/vuln/ghsa-9h8m-3fm2-qjrq GHSA-9h8m-3fm2-qjrq — OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking 2026-10-01T23:49:29.887985+00:00

Affected: Go: go.opentelemetry.io/otel/sdk

### Impact The OpenTelemetry Go SDK in version `v1.20.0`-`1.39.0` is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in `sdk/resource/host_id.go` executes the `ioreg` system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application.

### Patches This has been patched in [d45961b](https://github.com/open-telemetry/opentelemetry-go/commit/d45961bcda453fcbdb6469c22d6e88a1f9970a53), which was released with `v1.40.0`.

### References - [CWE-426: Untrusted Search Path](https://cwe.mitre.org/data/definitions/426.html)