https://vulnerability.circl.lu/sightings/feed 2026-08-08T10:05:21.384444+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/b1276349-7a80-4c72-b246-5e18813f154e/export 2026-08-08T10:05:21.393631+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "b1276349-7a80-4c72-b246-5e18813f154e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-xhf5-7wjv-pqxp", "type": "seen", "source": "https://gist.github.com/cwayne18/f47690bfa6aef6e901eb661447319fe1", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/k3s:v1.36.3-k3s1 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH --llm --llm-command \"gh copilot\" --mine-advisories --triage\nLLM overlay: asking command gh\nExtracting docker.io/rancher/k3s:v1.36.3-k3s1 (linux/amd64)...\nScanning for Go binaries...\nFound 4 Go binaries.\nResolving advisories for 457 components (457 OSV queries)...\nVEX hub https://github.com/rancher/vexhub: 1090 products indexed\nVEX hub https://github.com/rancher/vexhub: 16 finding(s) already covered by a published statement\nTriaging 18 findings against EPSS and CISA KEV (16 CVE ids)\nvexscan report (image) for docker.io/rancher/k3s:v1.36.3-k3s1\nNOTE: --severity CRITICAL,HIGH withheld 34 of 52 findings:\n 21 unknown (no rating was published), 13 medium\nNOTE: --triage could not score 2 of 18 findings, so they sort last for lack of data rather than lack of risk:\n 2 carry no CVE id, which is the only key either feed has\n\n golang Go 457 components 18 findings\n affected by severity: 2 high\n 2 affected: 1 unique advisories, 2 fixable, 0 with no fix yet\n already vexed: 5 by Rancher Security team\n priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 0 scored, 2 unscored\n priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n\nAFFECTED (2) - vulnerable code is present and can be loaded\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN BASIS\nHIGH GO-2026-6061 google.golang.org/grpc v1.80.0 1.82.1\nHIGH GO-2026-6061 google.golang.org/grpc v1.79.3 1.82.1\n\nALREADY VEXED (5) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS VEX STATUS JUSTIFICATION\nHIGH GHSA-x744-4wpc-v9h2 github.com/docker/docker v25.0.15-0.20260325154711-d\u2026 29.3.1 95.2% not_affected vulnerable_code_not_in_execute_path\nHIGH GHSA-33vj-92qq-66hc github.com/containerd/containerd/v2 v2.3.2-k3s2 2.3.2 27.3% not_affected vulnerable_code_not_present\nCRITICAL GHSA-cvxm-645q-p574 github.com/containerd/containerd/v2 v2.3.2-k3s2 2.3.2 25.8% not_affected vulnerable_code_not_present\nHIGH GHSA-rgh6-rfwx-v388 github.com/containerd/containerd/v2 v2.3.2-k3s2 2.3.2 8.5% not_affected vulnerable_code_not_present\nHIGH GHSA-xhf5-7wjv-pqxp github.com/containerd/containerd/v2 v2.3.2-k3s2 2.3.2 7.3% not_affected vulnerable_code_not_present\n\nRULED OUT (11) - the vulnerable code is not present or cannot run\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS BASIS\nCRITICAL GO-2026-5017 golang.org/x/crypto v0.47.0 0.52.0 46.4% pclntab\nCRITICAL GO-2026-5006 golang.org/x/crypto v0.47.0 0.52.0 45.4% pclntab\nCRITICAL GO-2026-5021 golang.org/x/crypto v0.47.0 0.52.0 43.9% pclntab\nCRITICAL GO-2026-5020 golang.org/x/crypto v0.47.0 0.52.0 41.6% pclntab\nCRITICAL GO-2026-5023 golang.org/x/crypto v0.47.0 0.52.0 40.3% pclntab\nHIGH GO-2026-5013 golang.org/x/crypto v0.47.0 0.52.0 38.4% pclntab\nHIGH GO-2026-5018 golang.org/x/crypto v0.47.0 0.52.0 38.0% pclntab\nCRITICAL GO-2026-5019 golang.org/x/crypto v0.47.0 0.52.0 34.6% pclntab\nCRITICAL GO-2026-5005 golang.org/x/crypto v0.47.0 0.52.0 33.9% pclntab\nHIGH GO-2026-5746 github.com/docker/docker v25.0.15-0.20260325154711-d\u2026 no fix 5.1% pclntab\nHIGH GO-2026-5617 github.com/docker/docker v25.0.15-0.20260325154711-d\u2026 no fix 1.2% pclntab\n\nNOTE: --severity CRITICAL,HIGH withheld 34 of 52 findings:\n 21 unknown (no rating was published), 13 medium\nNOTE: --triage could not score 2 of 18 findings, so they sort last for lack of data rather than lack of risk:\n 2 carry no CVE id, which is the only key either feed has\n golang Go 457 components 18 findings\n affected by severity: 2 high\n 2 affected: 1 unique advisories, 2 fixable, 0 with no fix yet\n already vexed: 5 by Rancher Security team\n priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 0 scored, 2 unscored\n priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n 18 findings in 3 section(s): AFFECTED (2), ALREADY VEXED (5), RULED OUT (11)", "creation_timestamp": "2026-08-05T21:55:34.120084Z"} 2026-08-05T21:55:34.120084+00:00 https://vulnerability.circl.lu/sighting/a241a799-a07f-40be-a6b8-8e93e49c9ac9/export 2026-08-08T10:05:21.394843+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a241a799-a07f-40be-a6b8-8e93e49c9ac9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-xhf5-7wjv-pqxp", "type": "seen", "source": "https://gist.github.com/cwayne18/b5c32c67446c8ec50f54ec955ba4ef5b", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/k3s:v1.36.3-k3s1 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH\nExtracting docker.io/rancher/k3s:v1.36.3-k3s1 (linux/amd64)...\nScanning for Go binaries...\nFound 4 Go binaries.\nResolving advisories for 457 components (457 OSV queries)...\nVEX hub https://github.com/rancher/vexhub: 1086 products indexed\nVEX hub https://github.com/rancher/vexhub: 16 finding(s) already covered by a published statement\nvexscan report (image) for docker.io/rancher/k3s:v1.36.3-k3s1\nNOTE: --severity CRITICAL,HIGH withheld 34 of 53 findings:\n 20 unknown (no rating was published), 14 medium\n\n golang Go 457 components 19 findings\n affected by severity: 3 high\n already vexed: 5 by Rancher Security team\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY ADVISORY PACKAGE VERSION BASIS\nHIGH GHSA-m4hf-6vgr-75r2 github.com/k3s-io/k3s (devel)\nHIGH GO-2026-6061 google.golang.org/grpc v1.80.0\nHIGH GO-2026-6061 google.golang.org/grpc v1.79.3\n\nALREADY VEXED (5) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY ADVISORY PACKAGE VERSION VEX STATUS JUSTIFICATION\nCRITICAL GHSA-cvxm-645q-p574 github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-33vj-92qq-66hc github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-rgh6-rfwx-v388 github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-xhf5-7wjv-pqxp github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-x744-4wpc-v9h2 github.com/docker/docker v25.0.15-0.20260325154711-d\u2026 not_affected vulnerable_code_not_in_execute_path\n\nRULED OUT (11) - the vulnerable code is not present or cannot run\nSEVERITY ADVISORY PACKAGE VERSION BASIS\nCRITICAL GO-2026-5005 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5006 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5017 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5019 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5020 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5021 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5023 golang.org/x/crypto v0.47.0 pclntab\nHIGH GO-2026-5617 github.com/docker/docker v25.0.15-0.20260325154711-d\u2026 pclntab\nHIGH GO-2026-5746 github.com/docker/docker v25.0.15-0.20260325154711-d\u2026 pclntab\nHIGH GO-2026-5013 golang.org/x/crypto v0.47.0 pclntab\nHIGH GO-2026-5018 golang.org/x/crypto v0.47.0 pclntab\n\nNOTE: --severity CRITICAL,HIGH withheld 34 of 53 findings:\n 20 unknown (no rating was published), 14 medium\n golang Go 457 components 19 findings\n affected by severity: 3 high\n already vexed: 5 by Rancher Security team\n 19 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (5), RULED OUT (11)", "creation_timestamp": "2026-08-05T12:34:16.537515Z"} 2026-08-05T12:34:16.537515+00:00 https://vulnerability.circl.lu/sighting/dae41886-ccd4-4b99-8b5f-3ca827591067/export 2026-08-08T10:05:21.394984+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "dae41886-ccd4-4b99-8b5f-3ca827591067", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-xhf5-7wjv-pqxp", "type": "seen", "source": "https://gist.github.com/cwayne18/2df919c96745d903491c33321eb89359", "content": "cwayne@geeko ~ % /System/Volumes/Data/Users/cwayne/go/bin/vexscan --image docker.io/rancher/rke2-runtime:v1.36.2-rke2r1 --all --severity CRITICAL,HIGH --vexhub https://github.com/rancher/vexhub --gist\nExtracting docker.io/rancher/rke2-runtime:v1.36.2-rke2r1 (linux/amd64)...\nScanning for Go binaries...\nFound 7 Go binaries.\nResolving advisories for 306 components (306 OSV queries)...\nVEX hub https://github.com/rancher/vexhub: 1083 products indexed\nVEX hub https://github.com/rancher/vexhub: 29 finding(s) already covered by a published statement\nvexscan report (image) for docker.io/rancher/rke2-runtime:v1.36.2-rke2r1\nNOTE: --severity CRITICAL,HIGH withheld 125 of 161 findings:\n 99 unknown (no rating was published), 24 medium, 2 low\n\n golang Go 306 components 36 findings\n affected by severity: 7 high\n already vexed: 15 by Rancher Security team\n\nAFFECTED (7) - vulnerable code is present and can be loaded\nSEVERITY ADVISORY PACKAGE VERSION BASIS\nHIGH GO-2026-6061 google.golang.org/grpc v1.80.0\nHIGH GO-2026-6061 google.golang.org/grpc v1.80.0\nHIGH GO-2026-6061 google.golang.org/grpc v1.80.0\nHIGH GO-2026-6061 google.golang.org/grpc v1.80.0\nHIGH GO-2026-6061 google.golang.org/grpc v1.79.3\nHIGH GO-2022-0965 k8s.io/apimachinery (devel)\nHIGH GO-2022-0965 k8s.io/apimachinery (devel)\n\nALREADY VEXED (15) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY ADVISORY PACKAGE VERSION VEX STATUS JUSTIFICATION\nCRITICAL GHSA-cvxm-645q-p574 github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nCRITICAL GHSA-cvxm-645q-p574 github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nCRITICAL GHSA-cvxm-645q-p574 github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-33vj-92qq-66hc github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-33vj-92qq-66hc github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-33vj-92qq-66hc github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-rgh6-rfwx-v388 github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-rgh6-rfwx-v388 github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-rgh6-rfwx-v388 github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-xhf5-7wjv-pqxp github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-xhf5-7wjv-pqxp github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-xhf5-7wjv-pqxp github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-x744-4wpc-v9h2 github.com/docker/docker v27.1.1+incompatible not_affected vulnerable_code_not_in_execute_path\nHIGH GO-2026-5426 go.opentelemetry.io/otel/sdk v1.42.0 not_affected vulnerable_code_not_in_execute_path\nHIGH GO-2026-5426 go.opentelemetry.io/otel/sdk v1.40.0 not_affected vulnerable_code_not_present\n\nRULED OUT (14) - the vulnerable code is not present or cannot run\nSEVERITY ADVISORY PACKAGE VERSION BASIS\nCRITICAL GO-2026-5005 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5006 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5017 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5019 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5020 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5021 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5023 golang.org/x/crypto v0.47.0 pclntab\nHIGH GHSA-x744-4wpc-v9h2 github.com/docker/docker v27.3.1+incompatible pclntab-module\nHIGH GO-2026-5617 github.com/docker/docker v27.3.1+incompatible pclntab\nHIGH GO-2026-5617 github.com/docker/docker v27.1.1+incompatible pclntab\nHIGH GO-2026-5746 github.com/docker/docker v27.3.1+incompatible pclntab\nHIGH GO-2026-5746 github.com/docker/docker v27.1.1+incompatible pclntab\nHIGH GO-2026-5013 golang.org/x/crypto v0.47.0 pclntab\nHIGH GO-2026-5018 golang.org/x/crypto v0.47.0 pclntab", "creation_timestamp": "2026-08-04T15:15:12.659469Z"} 2026-08-04T15:15:12.659469+00:00