https://vulnerability.circl.lu/sightings/feed 2026-08-06T02:38:22.019185+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c4aa82cb-fac9-4594-b712-a38a461410fc/export 2026-08-06T02:38:22.043260+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "c4aa82cb-fac9-4594-b712-a38a461410fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46600", "type": "seen", "source": "https://gist.github.com/cwayne18/5a965b20d5d77b66faec2e6e18802a48", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/helm-controller:v0.17.7 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN --llm --llm-command \"gh copilot\" --mine-advisories --triage --details\nLLM overlay: asking command gh\nExtracting docker.io/rancher/helm-controller:v0.17.7 (linux/amd64)...\nScanning for Go binaries...\nFound 1 Go binaries.\nResolving advisories for 73 components (73 OSV queries)...\nFound 16 OS packages to check (Alpine:v3.24).\nResolving advisories for 10 components (14 OSV queries)...\nBuilding the shared-library closure...\n 18 ELF objects\n 8 of 18 reachable from 6 roots\nVEX hub https://github.com/rancher/vexhub: 1090 products indexed\nVEX hub https://github.com/rancher/vexhub: 2 finding(s) already covered by a published statement\nTriaging 5 findings against EPSS and CISA KEV (5 CVE ids)\nvexscan report (image) for docker.io/rancher/helm-controller:v0.17.7\n\n golang Go 73 components 5 findings\n os Alpine:v3.24 16 components 0 findings\n affected by severity: 3 unknown\n 3 affected: 1 fixable, 2 with no fix yet\n already vexed: 1 by Rancher Security team\n priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS BASIS\nUNKNOWN GO-2025-3521 k8s.io/kubernetes v1.35.1 no fix 41.1%\nUNKNOWN GO-2026-5970 golang.org/x/text v0.37.0 0.39.0 36.6%\nUNKNOWN GO-2025-3547 k8s.io/kubernetes v1.35.1 no fix 22.3%\n\n[LINKED] k8s.io/kubernetes@v1.35.1\n cve: GO-2025-3521\n from: golang\n epss: 41.1% percentile (epss 0.00516) for CVE-2025-1767\n purl: pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n binary: /usr/bin/helm-controller (stripped)\n packages: k8s.io/kubernetes (module)\n detail: linked\n llm: exploitable=unlikely confidence=medium\n helm-controller merely vendors k8s.io/kubernetes as a library dependency and static analysis shows only linkage, not call-graph reachability; such binaries typically use small subsets (client/apimachinery types) rather than the vulnerable server-side code paths, and GO-2025-3521 class kube vulnerabilities generally require running as an apiserver/kubelet component to be triggered by attacker input.\n\n[LINKED] golang.org/x/text@v0.37.0\n cve: GO-2026-5970\n from: golang\n fixed in: 0.39.0\n epss: 36.6% percentile (epss 0.00446) for CVE-2026-56852\n purl: pkg:golang/golang.org%2Fx%2Ftext@v0.37.0\n binary: /usr/bin/helm-controller (stripped)\n packages: golang.org/x/text/unicode/norm (package)\n detail: linked\n llm: exploitable=unlikely confidence=medium\n golang.org/x/text/unicode/norm is a transitive dependency typically pulled in for string normalization; helm-controller is a Kubernetes reconciliation controller unlikely to run Unicode normalization on attacker-controlled input paths, and static linkage alone doesn't establish reachability from network-facing code.\n\n[LINKED] k8s.io/kubernetes@v1.35.1\n cve: GO-2025-3547\n from: golang\n epss: 22.3% percentile (epss 0.00301) for CVE-2024-7598\n purl: pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n binary: /usr/bin/helm-controller (stripped)\n packages: k8s.io/kubernetes (module)\n detail: linked\n llm: exploitable=unlikely confidence=low\n k8s.io/kubernetes is a large module often pulled in only for API types/client libraries rather than actual server logic, and static analysis shows only linkage (not reachability) in a helm-controller binary, which typically doesn't run the vulnerable kube-apiserver/kubelet code paths; without confirmed call-path reachability or attacker-controlled input to the vulnerable function, real-world exploitability is low.\n\n\nALREADY VEXED (1) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS VEX STATUS JUSTIFICATION\nUNKNOWN GO-2026-5942 golang.org/x/net v0.55.0 0.56.0 26.4% not_affected vulnerable_code_not_present\n\n[LINKED] golang.org/x/net@v0.55.0\n cve: GO-2026-5942\n from: golang\n fixed in: 0.56.0\n epss: 26.4% percentile (epss 0.00339) for CVE-2026-46600\n purl: pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n binary: /usr/bin/helm-controller (stripped)\n packages: golang.org/x/net/dns/dnsmessage (package)\n detail: linked\n evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n vendor: Rancher Security team says not_affected (vulnerable_code_not_present)\n Govulncheck determined that the vulnerable code isn't called\n product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-22T03:28:02Z\n matched loosely: statement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n llm: exploitable=unlikely confidence=medium\n helm-controller links golang.org/x/net/dns/dnsmessage transitively (e.g. via net/http or Kubernetes client libraries) but does not itself\nperform custom DNS message parsing of attacker-controlled data; typical Go DNS resolution paths rarely trigger the vulnerable code path with untrusted\n input.\n\n\nRULED OUT (1) - the vulnerable code is not present or cannot run\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS BASIS\nUNKNOWN GO-2026-5158 go.opentelemetry.io/otel v1.41.0 1.44.0 14.7% pclntab\n\n[NOT PRESENT] go.opentelemetry.io/otel@v1.41.0\n cve: GO-2026-5158\n from: golang\n fixed in: 1.44.0\n epss: 14.7% percentile (epss 0.00237) for CVE-2026-41178\n purl: pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n binary: /usr/bin/helm-controller (stripped)\n packages: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation (package)\n vex: vulnerable_code_not_present [pclntab]\n evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n vendor: Rancher Security team says not_affected (vulnerable_code_not_present)\n Govulncheck determined that the vulnerable code isn't called\n product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-25T03:31:58Z\n matched loosely: statement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n\n\n golang Go 73 components 5 findings\n os Alpine:v3.24 16 components 0 findings\n affected by severity: 3 unknown\n 3 affected: 1 fixable, 2 with no fix yet\n already vexed: 1 by Rancher Security team\n priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n 5 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (1), RULED OUT (1)", "creation_timestamp": "2026-08-06T00:00:17.992969Z"} 2026-08-06T00:00:17.992969+00:00 https://vulnerability.circl.lu/sighting/d516b60f-0a70-44f6-a4a8-d9ca22ed13fd/export 2026-08-06T02:38:22.046855+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "d516b60f-0a70-44f6-a4a8-d9ca22ed13fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46600", "type": "seen", "source": "https://gist.github.com/cwayne18/5a965b20d5d77b66faec2e6e18802a48", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/helm-controller:v0.17.7 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN --llm --llm-command \"gh copilot\" --mine-advisories --triage --details\nLLM overlay: asking command gh\nExtracting docker.io/rancher/helm-controller:v0.17.7 (linux/amd64)...\nScanning for Go binaries...\nFound 1 Go binaries.\nResolving advisories for 73 components (73 OSV queries)...\nFound 16 OS packages to check (Alpine:v3.24).\nResolving advisories for 10 components (14 OSV queries)...\nBuilding the shared-library closure...\n 18 ELF objects\n 8 of 18 reachable from 6 roots\nVEX hub https://github.com/rancher/vexhub: 1090 products indexed\nVEX hub https://github.com/rancher/vexhub: 2 finding(s) already covered by a published statement\nTriaging 5 findings against EPSS and CISA KEV (5 CVE ids)\nvexscan report (image) for docker.io/rancher/helm-controller:v0.17.7\n\n golang Go 73 components 5 findings\n os Alpine:v3.24 16 components 0 findings\n affected by severity: 3 unknown\n 3 affected: 1 fixable, 2 with no fix yet\n already vexed: 1 by Rancher Security team\n priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS BASIS\nUNKNOWN GO-2025-3521 k8s.io/kubernetes v1.35.1 no fix 41.1%\nUNKNOWN GO-2026-5970 golang.org/x/text v0.37.0 0.39.0 36.6%\nUNKNOWN GO-2025-3547 k8s.io/kubernetes v1.35.1 no fix 22.3%\n\n[LINKED] k8s.io/kubernetes@v1.35.1\n cve: GO-2025-3521\n from: golang\n epss: 41.1% percentile (epss 0.00516) for CVE-2025-1767\n purl: pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n binary: /usr/bin/helm-controller (stripped)\n packages: k8s.io/kubernetes (module)\n detail: linked\n llm: exploitable=unlikely confidence=medium\n helm-controller merely vendors k8s.io/kubernetes as a library dependency and static analysis shows only linkage, not call-graph reachability; such binaries typically use small subsets (client/apimachinery types) rather than the vulnerable server-side code paths, and GO-2025-3521 class kube vulnerabilities generally require running as an apiserver/kubelet component to be triggered by attacker input.\n\n[LINKED] golang.org/x/text@v0.37.0\n cve: GO-2026-5970\n from: golang\n fixed in: 0.39.0\n epss: 36.6% percentile (epss 0.00446) for CVE-2026-56852\n purl: pkg:golang/golang.org%2Fx%2Ftext@v0.37.0\n binary: /usr/bin/helm-controller (stripped)\n packages: golang.org/x/text/unicode/norm (package)\n detail: linked\n llm: exploitable=unlikely confidence=medium\n golang.org/x/text/unicode/norm is a transitive dependency typically pulled in for string normalization; helm-controller is a Kubernetes reconciliation controller unlikely to run Unicode normalization on attacker-controlled input paths, and static linkage alone doesn't establish reachability from network-facing code.\n\n[LINKED] k8s.io/kubernetes@v1.35.1\n cve: GO-2025-3547\n from: golang\n epss: 22.3% percentile (epss 0.00301) for CVE-2024-7598\n purl: pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n binary: /usr/bin/helm-controller (stripped)\n packages: k8s.io/kubernetes (module)\n detail: linked\n llm: exploitable=unlikely confidence=low\n k8s.io/kubernetes is a large module often pulled in only for API types/client libraries rather than actual server logic, and static analysis shows only linkage (not reachability) in a helm-controller binary, which typically doesn't run the vulnerable kube-apiserver/kubelet code paths; without confirmed call-path reachability or attacker-controlled input to the vulnerable function, real-world exploitability is low.\n\n\nALREADY VEXED (1) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS VEX STATUS JUSTIFICATION\nUNKNOWN GO-2026-5942 golang.org/x/net v0.55.0 0.56.0 26.4% not_affected vulnerable_code_not_present\n\n[LINKED] golang.org/x/net@v0.55.0\n cve: GO-2026-5942\n from: golang\n fixed in: 0.56.0\n epss: 26.4% percentile (epss 0.00339) for CVE-2026-46600\n purl: pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n binary: /usr/bin/helm-controller (stripped)\n packages: golang.org/x/net/dns/dnsmessage (package)\n detail: linked\n evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n vendor: Rancher Security team says not_affected (vulnerable_code_not_present)\n Govulncheck determined that the vulnerable code isn't called\n product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-22T03:28:02Z\n matched loosely: statement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n llm: exploitable=unlikely confidence=medium\n helm-controller links golang.org/x/net/dns/dnsmessage transitively (e.g. via net/http or Kubernetes client libraries) but does not itself\nperform custom DNS message parsing of attacker-controlled data; typical Go DNS resolution paths rarely trigger the vulnerable code path with untrusted\n input.\n\n\nRULED OUT (1) - the vulnerable code is not present or cannot run\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS BASIS\nUNKNOWN GO-2026-5158 go.opentelemetry.io/otel v1.41.0 1.44.0 14.7% pclntab\n\n[NOT PRESENT] go.opentelemetry.io/otel@v1.41.0\n cve: GO-2026-5158\n from: golang\n fixed in: 1.44.0\n epss: 14.7% percentile (epss 0.00237) for CVE-2026-41178\n purl: pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n binary: /usr/bin/helm-controller (stripped)\n packages: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation (package)\n vex: vulnerable_code_not_present [pclntab]\n evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n vendor: Rancher Security team says not_affected (vulnerable_code_not_present)\n Govulncheck determined that the vulnerable code isn't called\n product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-25T03:31:58Z\n matched loosely: statement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n\n\n golang Go 73 components 5 findings\n os Alpine:v3.24 16 components 0 findings\n affected by severity: 3 unknown\n 3 affected: 1 fixable, 2 with no fix yet\n already vexed: 1 by Rancher Security team\n priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n 5 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (1), RULED OUT (1)", "creation_timestamp": "2026-08-05T22:37:18.444968Z"} 2026-08-05T22:37:18.444968+00:00 https://vulnerability.circl.lu/sighting/652871a6-f923-4cb0-a831-a1227db5dcb5/export 2026-08-06T02:38:22.047054+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "652871a6-f923-4cb0-a831-a1227db5dcb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46600", "type": "seen", "source": "https://gist.github.com/sherine-k/eeebb5de0dc45167d6be9ddd7b51d2ef", "content": "# Automating VEX Triage for a Go Project with Vexflow\n[Vexflow](https://github.com/carabiner-dev/vexflow) is a CLI tool that manages the lifecycle of VEX (Vulnerability Exploitability eXchange) data through GitHub issues. It scans your code for vulnerabilities, opens triage issues, lets maintainers assess impact via slash commands, and publishes signed OpenVEX attestations.\n\nI set it up on [sherine-k/gophers-api](https://github.com/sherine-k/gophers-api) (a fork of [scraly/gophers-api](https://github.com/scraly/gophers-api)) to see the full flow in action: scan, triage, assess, and attest.\n\n## What you need\n- A code repository to scan (Go ecosystem supported)\n- A triage repository where vexflow manages issues and stores attestations\n- A GitHub Actions workflow in the code repository\n- An OWNERS file in the triage repository listing authorized approvers\n\n## Step 1: Create the triage repository\n\nI created [sherine-k/.vexflow](https://github.com/sherine-k/.vexflow) as a public repository. This is where vexflow opens triage issues and publishes VEX attestations.\n\nAlthough Vexflow's [README](https://github.com/carabiner-dev/vexflow/blob/main/README.md) suggests the repository can stay private, I was not able to make the GitHub Actions workflow read from that repository unless it was public. (Issue to be open)\n\nThe name .vexflow is the convention that vexflow uses by default. You can change that by using the `--triage-repo` flag.\n\nAt the root of this repository, I added an OWNERS file:\n```\napprovers:\n - sherine-k\n```\n\nOnly users listed under approvers can issue slash commands. \n\n## Step 2: Create a fine-grained secret\n\nUnder my GitHub account (on the top right), I went to Settings -> Credentials -> Fine-grained personal access tokens. \n\nI created a token there with permissions on 2 repositories only ([sherine-k/gophers-api](https://github.com/sherine-k/gophers-api) and [sherine-k/.vexflow](https://github.com/sherine-k/.vexflow)), with :\n* _Read access to code_\n* _Read access to metadata_ (default)\n* _Read **and write** access to attestations api_\n* _Read **and write** access to issues_\n\nUnder [sherine-k/gophers-api](https://github.com/sherine-k/gophers-api) -> Settings -> Secrets and variables -> Actions, I created a new secret, `VEXFLOW_TOKEN`, and I pasted in the token value.\nThis is what will allow vexflow to scan the gophers-api source code, and create and update issues in the .vexflow repository.\n\n## Step 3: Add the GitHub Actions workflow\n\nIn [sherine-k/gophers-api](https://github.com/sherine-k/gophers-api), I created .github/workflows/vexflow.yml:\n```yaml\nname: VEX Triage\n\non:\n push:\n branches: [main]\n schedule:\n - cron: '0 */6 * * *'\n workflow_dispatch:\n\npermissions:\n contents: read\n issues: write\n id-token: write\n attestations: write\n\njobs:\n vexflow-update:\n runs-on: ubuntu-latest\n steps:\n - name: Set up Go\n uses: actions/setup-go@v5\n with:\n go-version: '1.26'\n cache: false\n\n - name: Install vexflow\n run: go install github.com/carabiner-dev/vexflow@latest\n\n - name: Run vexflow update\n env:\n GITHUB_TOKEN: ${{ secrets.VEXFLOW_TOKEN }}\n run: |\n vexflow update \\\n --repo sherine-k/gophers-api \\\n --branch main \\\n --triage-repo sherine-k/.vexflow\n```\n\n**Key points:**\n- No actions/checkout is needed -- vexflow clones the target repo itself.\n- Since no recent release binaries were available, the workflow compiles vexflow from source with go install.\n- The `VEXFLOW_TOKEN` is used here as the GITHUB_TOKEN to give the workflow access to scan the code, to update GitHub issues and generate VEX attestations.\n\n## Step 4: First scan -- issues created\nThe [first workflow run](https://github.com/sherine-k/gophers-api/actions/runs/30887582253/job/91922877505) scanned the main branch with OSV Scanner. Vexflow found multiple vulnerabilities in the Go dependencies and automatically opened a triage issue for each one in [sherine-k/.vexflow/issues](https://github.com/sherine-k/.vexflow/issues).\nEach issue is titled `: VEX Exploitability Triage` and contains:\n- A summary table with the vulnerability ID, repository, branch, and affected component (purl)\n- Instructions and examples for all available slash commands\n- Hidden machine-readable data used by vexflow to track the triage state\n\nAt the time of writing, 59 open triage issues were tracked.\n\n## Step 5: Assess a vulnerability with a slash command\n\nSince gophers-api is written in go, I used GoVulnCheck to quickly assess some of the vulnerabilities using:\n```bash\ngovulncheck -format openvex ./...\n```\n\nFor one of the vulnerabilities detected, [CVE-2026-46600](https://github.com/sherine-k/.vexflow/issues/30), govulncheck identifies that the vulnerable code isn't reacheable from the executable path. \n\nTherefore, I commented on the issue with a slash command:\n`/not_affected:vulnerable_code_not_in_execute_path`\n\nThe vulnerable function is not used in the API server code path.\nThe text after the slash command becomes the VEX impact statement published in the attestation.\n\n## Step 5: Vexflow processes the assessment\nOn the next workflow run (https://github.com/sherine-k/gophers-api/actions/runs/30887582253/job/91927094887), vexflow:\n1. Read the slash command on issue [#30](https://github.com/sherine-k/.vexflow/issues/30)\n2. Verified that `sherine-k` is listed in the `OWNERS` file\n3. Generated an OpenVEX document with status `not_affected` and justification `vulnerable_code_not_in_execute_path`\n4. Signed it with Sigstore and published it as a [GitHub attestation](https://github.com/sherine-k/.vexflow/attestations/38737637)\n5. Posted a confirmation comment on the issue\n6. Closed the issue\nThe attestation subject is git+https://github.com/sherine-k/gophers-api@main, and it can be verified with:\n```bash\ngh attestation verify \\\n --owner sherine-k \\\n --predicate-type \"https://openvex.dev/ns\" \\\n \n```", "creation_timestamp": "2026-08-04T08:52:34.743674Z"} 2026-08-04T08:52:34.743674+00:00