https://vulnerability.circl.lu/sightings/feed 2026-08-14T16:10:14.675379+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/3ecadcf4-e5aa-42f5-8b90-e90e905b08b7/export 2026-08-14T16:10:14.691015+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "3ecadcf4-e5aa-42f5-8b90-e90e905b08b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-m4hf-6vgr-75r2", "type": "seen", "source": "https://gist.github.com/cwayne18/b5c32c67446c8ec50f54ec955ba4ef5b", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/k3s:v1.36.3-k3s1 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH\nExtracting docker.io/rancher/k3s:v1.36.3-k3s1 (linux/amd64)...\nScanning for Go binaries...\nFound 4 Go binaries.\nResolving advisories for 457 components (457 OSV queries)...\nVEX hub https://github.com/rancher/vexhub: 1086 products indexed\nVEX hub https://github.com/rancher/vexhub: 16 finding(s) already covered by a published statement\nvexscan report (image) for docker.io/rancher/k3s:v1.36.3-k3s1\nNOTE: --severity CRITICAL,HIGH withheld 34 of 53 findings:\n 20 unknown (no rating was published), 14 medium\n\n golang Go 457 components 19 findings\n affected by severity: 3 high\n already vexed: 5 by Rancher Security team\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY ADVISORY PACKAGE VERSION BASIS\nHIGH GHSA-m4hf-6vgr-75r2 github.com/k3s-io/k3s (devel)\nHIGH GO-2026-6061 google.golang.org/grpc v1.80.0\nHIGH GO-2026-6061 google.golang.org/grpc v1.79.3\n\nALREADY VEXED (5) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY ADVISORY PACKAGE VERSION VEX STATUS JUSTIFICATION\nCRITICAL GHSA-cvxm-645q-p574 github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-33vj-92qq-66hc github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-rgh6-rfwx-v388 github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-xhf5-7wjv-pqxp github.com/containerd/containerd/v2 v2.3.2-k3s2 not_affected vulnerable_code_not_present\nHIGH GHSA-x744-4wpc-v9h2 github.com/docker/docker v25.0.15-0.20260325154711-d\u2026 not_affected vulnerable_code_not_in_execute_path\n\nRULED OUT (11) - the vulnerable code is not present or cannot run\nSEVERITY ADVISORY PACKAGE VERSION BASIS\nCRITICAL GO-2026-5005 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5006 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5017 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5019 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5020 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5021 golang.org/x/crypto v0.47.0 pclntab\nCRITICAL GO-2026-5023 golang.org/x/crypto v0.47.0 pclntab\nHIGH GO-2026-5617 github.com/docker/docker v25.0.15-0.20260325154711-d\u2026 pclntab\nHIGH GO-2026-5746 github.com/docker/docker v25.0.15-0.20260325154711-d\u2026 pclntab\nHIGH GO-2026-5013 golang.org/x/crypto v0.47.0 pclntab\nHIGH GO-2026-5018 golang.org/x/crypto v0.47.0 pclntab\n\nNOTE: --severity CRITICAL,HIGH withheld 34 of 53 findings:\n 20 unknown (no rating was published), 14 medium\n golang Go 457 components 19 findings\n affected by severity: 3 high\n already vexed: 5 by Rancher Security team\n 19 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (5), RULED OUT (11)", "creation_timestamp": "2026-08-05T12:34:16.686548Z"} 2026-08-05T12:34:16.686548+00:00