{"vulnerability": "cve-2026-5685", "sightings": [{"uuid": "b980ce8b-f9ae-4057-8329-04eae7e955f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5685", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miubnrikwb2g", "content": "", "creation_timestamp": "2026-04-06T22:08:19.511140Z"}, {"uuid": "2999bff0-ed80-40c1-aecf-77fca67a7ac4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5685", "type": "seen", "source": "Telegram/F-tbnQCu7KGoJ0u4OEM4TknejxA1jNnRqA-1uSHs9aPRtPw", "content": "", "creation_timestamp": "2026-04-06T23:22:19.000000Z"}, {"uuid": "7138be66-b6a5-403b-a2a6-82c9d1e01174", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56850", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mrumtyo7h22j", "content": "\ud83d\udd17 CVE : CVE-2026-48934, CVE-2026-56846, CVE-2026-56847, CVE-2026-56848, CVE-2026-56850, CVE-2026-58039, CVE-2026-58040, CVE-2026-58041, CVE-2026-58042, CVE-2026-58043, CVE-2026-58044, CVE-2026-58045", "creation_timestamp": "2026-07-30T14:15:24.128533Z"}, {"uuid": "9e8a99f2-74e8-416d-9fd3-00c1fcf0798f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-56850", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20260730", "content": "", "creation_timestamp": "2026-07-30T04:46:42.292678Z"}, {"uuid": "4c91b871-8491-4ebf-974b-8bae00a6c0c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56852", "type": "seen", "source": "https://bsky.app/profile/mfahlandt.bsky.social/post/3ms6hejb7hx2j", "content": "\ud83d\ude80 LWCN Week 32: Cilium v1.20.0 released.\n- Cilium v1.20.0: Major release.\n- Prometheus v3.13.2: Security updates (CVE-2026-56852, GHSA-hrxh-6v49-42gf) + PromQL bug fix.\n- OPA v1.19.0: SQL injection vulnerability addressed, cgo-free WebAssembly runtime adde\u2026\n\nhttps://lwcn.dev/newsletter/2026-week-32/", "creation_timestamp": "2026-08-03T12:03:59.685336Z"}, {"uuid": "16cad227-e83c-4790-9be6-8a0a0e8b7e7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5685", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mkoi2ceiwf2z", "content": "\ud83d\udccc CVE-2026-5685 - A vulnerability was identified in Tenda CX12L 16.03.53.12. This affects the function fromAddressNat of the file /goform/addressNat. The manipulation o... https://www.cyberhub.blog/cves/CVE-2026-5685", "creation_timestamp": "2026-04-30T01:37:07.190212Z"}, {"uuid": "a006ca4f-42fb-4fdf-bed0-94c8226a04f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56853", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mtoa375le52w", "content": "\ud83d\udd0d Lambda Watchdog detected that CVE-2026-56853 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/667 #AWS #Lambda #Security #CVE #DevOps #SecOps", "creation_timestamp": "2026-08-22T12:01:13.006282Z"}, {"uuid": "e5cac0de-2ca4-4629-8b18-3068e49ceca6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56858", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mtoa3a3w4z2r", "content": "\ud83d\udd0d Lambda Watchdog detected that CVE-2026-56858 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/668 #AWS #Lambda #Security #CVE #DevOps #SecOps", "creation_timestamp": "2026-08-22T12:01:13.639086Z"}, {"uuid": "3889d297-ac47-45cd-ae3a-31dd035fa80a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56859", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mtoa3canjo2n", "content": "\ud83d\udd0d Lambda Watchdog detected that CVE-2026-56859 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/669 #AWS #Lambda #Security #CVE #DevOps #SecOps", "creation_timestamp": "2026-08-22T12:01:19.809047Z"}, {"uuid": "ae089d21-26b7-4f7c-ab01-af35ef64dd98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56858", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mt24dovar52y", "content": "\n\ud83d\udea8 New UNKNOWN CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-56858 impacts stdlib in 25 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/668\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-08-14T12:01:07.259747Z"}, {"uuid": "89f615ba-b8f3-4309-ab10-1c2561532afb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56853", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mt24dmdp3n27", "content": "\n\ud83d\udea8 New UNKNOWN CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-56853 impacts stdlib in 25 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/667\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-08-14T12:01:04.494539Z"}, {"uuid": "9464a36f-f657-4009-83a5-6c8af60340d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56859", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mt24drpyoo2x", "content": "\n\ud83d\udea8 New UNKNOWN CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-56859 impacts stdlib in 25 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/669\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-08-14T12:01:10.048234Z"}, {"uuid": "7d4dc319-573e-4014-9cad-e2e0416d524a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56852", "type": "seen", "source": "https://gist.github.com/cwayne18/5a965b20d5d77b66faec2e6e18802a48", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/helm-controller:v0.17.7 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN --llm --llm-command \"gh copilot\" --mine-advisories --triage --details\nLLM overlay: asking command gh\nExtracting docker.io/rancher/helm-controller:v0.17.7 (linux/amd64)...\nScanning for Go binaries...\nFound 1 Go binaries.\nResolving advisories for 73 components (73 OSV queries)...\nFound 16 OS packages to check (Alpine:v3.24).\nResolving advisories for 10 components (14 OSV queries)...\nBuilding the shared-library closure...\n  18 ELF objects\n  8 of 18 reachable from 6 roots\nVEX hub https://github.com/rancher/vexhub: 1090 products indexed\nVEX hub https://github.com/rancher/vexhub: 2 finding(s) already covered by a published statement\nTriaging 5 findings against EPSS and CISA KEV (5 CVE ids)\nvexscan report (image) for docker.io/rancher/helm-controller:v0.17.7\n\n  golang   Go                         73 components     5 findings\n  os       Alpine:v3.24               16 components     0 findings\n  affected by severity: 3 unknown\n  3 affected: 1 fixable, 2 with no fix yet\n  already vexed: 1 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY  ADVISORY      PACKAGE            VERSION  FIXED IN  EPSS   BASIS\nUNKNOWN   GO-2025-3521  k8s.io/kubernetes  v1.35.1  no fix    41.1%\nUNKNOWN   GO-2026-5970  golang.org/x/text  v0.37.0  0.39.0    36.6%\nUNKNOWN   GO-2025-3547  k8s.io/kubernetes  v1.35.1  no fix    22.3%\n\n[LINKED]               k8s.io/kubernetes@v1.35.1\n  cve:      GO-2025-3521\n  from:     golang\n  epss:     41.1% percentile (epss 0.00516) for CVE-2025-1767\n  purl:     pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: k8s.io/kubernetes (module)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=medium\n            helm-controller merely vendors k8s.io/kubernetes as a library dependency and static analysis shows only linkage, not call-graph reachability; such binaries typically use small subsets (client/apimachinery types) rather than the vulnerable server-side code paths, and GO-2025-3521 class kube vulnerabilities generally require running as an apiserver/kubelet component to be triggered by attacker input.\n\n[LINKED]               golang.org/x/text@v0.37.0\n  cve:      GO-2026-5970\n  from:     golang\n  fixed in: 0.39.0\n  epss:     36.6% percentile (epss 0.00446) for CVE-2026-56852\n  purl:     pkg:golang/golang.org%2Fx%2Ftext@v0.37.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: golang.org/x/text/unicode/norm (package)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=medium\n            golang.org/x/text/unicode/norm is a transitive dependency typically pulled in for string normalization; helm-controller is a Kubernetes reconciliation controller unlikely to run Unicode normalization on attacker-controlled input paths, and static linkage alone doesn't establish reachability from network-facing code.\n\n[LINKED]               k8s.io/kubernetes@v1.35.1\n  cve:      GO-2025-3547\n  from:     golang\n  epss:     22.3% percentile (epss 0.00301) for CVE-2024-7598\n  purl:     pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: k8s.io/kubernetes (module)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=low\n            k8s.io/kubernetes is a large module often pulled in only for API types/client libraries rather than actual server logic, and static analysis shows only linkage (not reachability) in a helm-controller binary, which typically doesn't run the vulnerable kube-apiserver/kubelet code paths; without confirmed call-path reachability or attacker-controlled input to the vulnerable function, real-world exploitability is low.\n\n\nALREADY VEXED (1) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY  ADVISORY      PACKAGE           VERSION  FIXED IN  EPSS   VEX STATUS    JUSTIFICATION\nUNKNOWN   GO-2026-5942  golang.org/x/net  v0.55.0  0.56.0    26.4%  not_affected  vulnerable_code_not_present\n\n[LINKED]               golang.org/x/net@v0.55.0\n  cve:      GO-2026-5942\n  from:     golang\n  fixed in: 0.56.0\n  epss:     26.4% percentile (epss 0.00339) for CVE-2026-46600\n  purl:     pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: golang.org/x/net/dns/dnsmessage (package)\n  detail:   linked\n  evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  vendor:   Rancher Security team says not_affected (vulnerable_code_not_present)\n            Govulncheck determined that the vulnerable code isn't called\n            product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-22T03:28:02Z\n            matched loosely: statement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  llm:      exploitable=unlikely confidence=medium\n            helm-controller links golang.org/x/net/dns/dnsmessage transitively (e.g. via net/http or Kubernetes client libraries) but does not itself\nperform custom DNS message parsing of attacker-controlled data; typical Go DNS resolution paths rarely trigger the vulnerable code path with untrusted\n input.\n\n\nRULED OUT (1) - the vulnerable code is not present or cannot run\nSEVERITY  ADVISORY      PACKAGE                   VERSION  FIXED IN  EPSS   BASIS\nUNKNOWN   GO-2026-5158  go.opentelemetry.io/otel  v1.41.0  1.44.0    14.7%  pclntab\n\n[NOT PRESENT]          go.opentelemetry.io/otel@v1.41.0\n  cve:      GO-2026-5158\n  from:     golang\n  fixed in: 1.44.0\n  epss:     14.7% percentile (epss 0.00237) for CVE-2026-41178\n  purl:     pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation (package)\n  vex:      vulnerable_code_not_present [pclntab]\n  evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n  vendor:   Rancher Security team says not_affected (vulnerable_code_not_present)\n            Govulncheck determined that the vulnerable code isn't called\n            product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-25T03:31:58Z\n            matched loosely: statement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n\n\n  golang   Go                         73 components     5 findings\n  os       Alpine:v3.24               16 components     0 findings\n  affected by severity: 3 unknown\n  3 affected: 1 fixable, 2 with no fix yet\n  already vexed: 1 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n  5 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (1), RULED OUT (1)", "creation_timestamp": "2026-08-05T22:37:18.527716Z"}, {"uuid": "39c3e6ad-905e-44bf-9acb-7680712b09b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56852", "type": "seen", "source": "https://gist.github.com/cwayne18/5a965b20d5d77b66faec2e6e18802a48", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/helm-controller:v0.17.7 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN --llm --llm-command \"gh copilot\" --mine-advisories --triage --details\nLLM overlay: asking command gh\nExtracting docker.io/rancher/helm-controller:v0.17.7 (linux/amd64)...\nScanning for Go binaries...\nFound 1 Go binaries.\nResolving advisories for 73 components (73 OSV queries)...\nFound 16 OS packages to check (Alpine:v3.24).\nResolving advisories for 10 components (14 OSV queries)...\nBuilding the shared-library closure...\n  18 ELF objects\n  8 of 18 reachable from 6 roots\nVEX hub https://github.com/rancher/vexhub: 1090 products indexed\nVEX hub https://github.com/rancher/vexhub: 2 finding(s) already covered by a published statement\nTriaging 5 findings against EPSS and CISA KEV (5 CVE ids)\nvexscan report (image) for docker.io/rancher/helm-controller:v0.17.7\n\n  golang   Go                         73 components     5 findings\n  os       Alpine:v3.24               16 components     0 findings\n  affected by severity: 3 unknown\n  3 affected: 1 fixable, 2 with no fix yet\n  already vexed: 1 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY  ADVISORY      PACKAGE            VERSION  FIXED IN  EPSS   BASIS\nUNKNOWN   GO-2025-3521  k8s.io/kubernetes  v1.35.1  no fix    41.1%\nUNKNOWN   GO-2026-5970  golang.org/x/text  v0.37.0  0.39.0    36.6%\nUNKNOWN   GO-2025-3547  k8s.io/kubernetes  v1.35.1  no fix    22.3%\n\n[LINKED]               k8s.io/kubernetes@v1.35.1\n  cve:      GO-2025-3521\n  from:     golang\n  epss:     41.1% percentile (epss 0.00516) for CVE-2025-1767\n  purl:     pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: k8s.io/kubernetes (module)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=medium\n            helm-controller merely vendors k8s.io/kubernetes as a library dependency and static analysis shows only linkage, not call-graph reachability; such binaries typically use small subsets (client/apimachinery types) rather than the vulnerable server-side code paths, and GO-2025-3521 class kube vulnerabilities generally require running as an apiserver/kubelet component to be triggered by attacker input.\n\n[LINKED]               golang.org/x/text@v0.37.0\n  cve:      GO-2026-5970\n  from:     golang\n  fixed in: 0.39.0\n  epss:     36.6% percentile (epss 0.00446) for CVE-2026-56852\n  purl:     pkg:golang/golang.org%2Fx%2Ftext@v0.37.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: golang.org/x/text/unicode/norm (package)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=medium\n            golang.org/x/text/unicode/norm is a transitive dependency typically pulled in for string normalization; helm-controller is a Kubernetes reconciliation controller unlikely to run Unicode normalization on attacker-controlled input paths, and static linkage alone doesn't establish reachability from network-facing code.\n\n[LINKED]               k8s.io/kubernetes@v1.35.1\n  cve:      GO-2025-3547\n  from:     golang\n  epss:     22.3% percentile (epss 0.00301) for CVE-2024-7598\n  purl:     pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: k8s.io/kubernetes (module)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=low\n            k8s.io/kubernetes is a large module often pulled in only for API types/client libraries rather than actual server logic, and static analysis shows only linkage (not reachability) in a helm-controller binary, which typically doesn't run the vulnerable kube-apiserver/kubelet code paths; without confirmed call-path reachability or attacker-controlled input to the vulnerable function, real-world exploitability is low.\n\n\nALREADY VEXED (1) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY  ADVISORY      PACKAGE           VERSION  FIXED IN  EPSS   VEX STATUS    JUSTIFICATION\nUNKNOWN   GO-2026-5942  golang.org/x/net  v0.55.0  0.56.0    26.4%  not_affected  vulnerable_code_not_present\n\n[LINKED]               golang.org/x/net@v0.55.0\n  cve:      GO-2026-5942\n  from:     golang\n  fixed in: 0.56.0\n  epss:     26.4% percentile (epss 0.00339) for CVE-2026-46600\n  purl:     pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: golang.org/x/net/dns/dnsmessage (package)\n  detail:   linked\n  evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  vendor:   Rancher Security team says not_affected (vulnerable_code_not_present)\n            Govulncheck determined that the vulnerable code isn't called\n            product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-22T03:28:02Z\n            matched loosely: statement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  llm:      exploitable=unlikely confidence=medium\n            helm-controller links golang.org/x/net/dns/dnsmessage transitively (e.g. via net/http or Kubernetes client libraries) but does not itself\nperform custom DNS message parsing of attacker-controlled data; typical Go DNS resolution paths rarely trigger the vulnerable code path with untrusted\n input.\n\n\nRULED OUT (1) - the vulnerable code is not present or cannot run\nSEVERITY  ADVISORY      PACKAGE                   VERSION  FIXED IN  EPSS   BASIS\nUNKNOWN   GO-2026-5158  go.opentelemetry.io/otel  v1.41.0  1.44.0    14.7%  pclntab\n\n[NOT PRESENT]          go.opentelemetry.io/otel@v1.41.0\n  cve:      GO-2026-5158\n  from:     golang\n  fixed in: 1.44.0\n  epss:     14.7% percentile (epss 0.00237) for CVE-2026-41178\n  purl:     pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation (package)\n  vex:      vulnerable_code_not_present [pclntab]\n  evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n  vendor:   Rancher Security team says not_affected (vulnerable_code_not_present)\n            Govulncheck determined that the vulnerable code isn't called\n            product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-25T03:31:58Z\n            matched loosely: statement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n\n\n  golang   Go                         73 components     5 findings\n  os       Alpine:v3.24               16 components     0 findings\n  affected by severity: 3 unknown\n  3 affected: 1 fixable, 2 with no fix yet\n  already vexed: 1 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n  5 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (1), RULED OUT (1)", "creation_timestamp": "2026-08-06T00:00:18.084572Z"}, {"uuid": "9cc15036-c0d5-4493-a796-a5d868271a0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56852", "type": "seen", "source": "Telegram/DqV-nqMSCmTU-M49w7S4IFLGMz_hqpuL1Ny1I6RAHqLyMqU", "content": "", "creation_timestamp": "2026-08-17T18:00:04.134799Z"}, {"uuid": "4169623f-5a42-4c2b-a4a0-57eb720ca174", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56854", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mu7vonc6cz25", "content": "\ud83d\udc1b VULNERABILITIES (CVSS 9.1) CVE-2026-56854:  \u2014 severity critical \u2014 Red Hat Security Data (JSON)\nhttps://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-56854.json #Vulnerability #CVE #ZeroDay", "creation_timestamp": "2026-08-29T12:43:08.859029Z"}, {"uuid": "ebcb36a6-aa65-4055-9b3d-f91a1ae0a0d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56852", "type": "published-proof-of-concept", "source": "Telegram/DqV-nqMSCmTU-M49w7S4IFLGMz_hqpuL1Ny1I6RAHqLyMqU", "content": "", "creation_timestamp": "2026-08-18T00:00:12.781735Z"}]}