https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 06 Aug 2026 12:39:03 +0000 https://vulnerability.circl.lu/sighting/d47452e3-ed3e-4d1f-9f3b-3e1117b7893c/export {"uuid": "d47452e3-ed3e-4d1f-9f3b-3e1117b7893c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41178", "type": "seen", "source": "https://gist.github.com/cwayne18/5a965b20d5d77b66faec2e6e18802a48", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/helm-controller:v0.17.7 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN --llm --llm-command \"gh copilot\" --mine-advisories --triage --details\nLLM overlay: asking command gh\nExtracting docker.io/rancher/helm-controller:v0.17.7 (linux/amd64)...\nScanning for Go binaries...\nFound 1 Go binaries.\nResolving advisories for 73 components (73 OSV queries)...\nFound 16 OS packages to check (Alpine:v3.24).\nResolving advisories for 10 components (14 OSV queries)...\nBuilding the shared-library closure...\n 18 ELF objects\n 8 of 18 reachable from 6 roots\nVEX hub https://github.com/rancher/vexhub: 1090 products indexed\nVEX hub https://github.com/rancher/vexhub: 2 finding(s) already covered by a published statement\nTriaging 5 findings against EPSS and CISA KEV (5 CVE ids)\nvexscan report (image) for docker.io/rancher/helm-controller:v0.17.7\n\n golang Go 73 components 5 findings\n os Alpine:v3.24 16 components 0 findings\n affected by severity: 3 unknown\n 3 affected: 1 fixable, 2 with no fix yet\n already vexed: 1 by Rancher Security team\n priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS BASIS\nUNKNOWN GO-2025-3521 k8s.io/kubernetes v1.35.1 no fix 41.1%\nUNKNOWN GO-2026-5970 golang.org/x/text v0.37.0 0.39.0 36.6%\nUNKNOWN GO-2025-3547 k8s.io/kubernetes v1.35.1 no fix 22.3%\n\n[LINKED] k8s.io/kubernetes@v1.35.1\n cve: GO-2025-3521\n from: golang\n epss: 41.1% percentile (epss 0.00516) for CVE-2025-1767\n purl: pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n binary: /usr/bin/helm-controller (stripped)\n packages: k8s.io/kubernetes (module)\n detail: linked\n llm: exploitable=unlikely confidence=medium\n helm-controller merely vendors k8s.io/kubernetes as a library dependency and static analysis shows only linkage, not call-graph reachability; such binaries typically use small subsets (client/apimachinery types) rather than the vulnerable server-side code paths, and GO-2025-3521 class kube vulnerabilities generally require running as an apiserver/kubelet component to be triggered by attacker input.\n\n[LINKED] golang.org/x/text@v0.37.0\n cve: GO-2026-5970\n from: golang\n fixed in: 0.39.0\n epss: 36.6% percentile (epss 0.00446) for CVE-2026-56852\n purl: pkg:golang/golang.org%2Fx%2Ftext@v0.37.0\n binary: /usr/bin/helm-controller (stripped)\n packages: golang.org/x/text/unicode/norm (package)\n detail: linked\n llm: exploitable=unlikely confidence=medium\n golang.org/x/text/unicode/norm is a transitive dependency typically pulled in for string normalization; helm-controller is a Kubernetes reconciliation controller unlikely to run Unicode normalization on attacker-controlled input paths, and static linkage alone doesn't establish reachability from network-facing code.\n\n[LINKED] k8s.io/kubernetes@v1.35.1\n cve: GO-2025-3547\n from: golang\n epss: 22.3% percentile (epss 0.00301) for CVE-2024-7598\n purl: pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n binary: /usr/bin/helm-controller (stripped)\n packages: k8s.io/kubernetes (module)\n detail: linked\n llm: exploitable=unlikely confidence=low\n k8s.io/kubernetes is a large module often pulled in only for API types/client libraries rather than actual server logic, and static analysis shows only linkage (not reachability) in a helm-controller binary, which typically doesn't run the vulnerable kube-apiserver/kubelet code paths; without confirmed call-path reachability or attacker-controlled input to the vulnerable function, real-world exploitability is low.\n\n\nALREADY VEXED (1) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS VEX STATUS JUSTIFICATION\nUNKNOWN GO-2026-5942 golang.org/x/net v0.55.0 0.56.0 26.4% not_affected vulnerable_code_not_present\n\n[LINKED] golang.org/x/net@v0.55.0\n cve: GO-2026-5942\n from: golang\n fixed in: 0.56.0\n epss: 26.4% percentile (epss 0.00339) for CVE-2026-46600\n purl: pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n binary: /usr/bin/helm-controller (stripped)\n packages: golang.org/x/net/dns/dnsmessage (package)\n detail: linked\n evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n vendor: Rancher Security team says not_affected (vulnerable_code_not_present)\n Govulncheck determined that the vulnerable code isn't called\n product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-22T03:28:02Z\n matched loosely: statement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n llm: exploitable=unlikely confidence=medium\n helm-controller links golang.org/x/net/dns/dnsmessage transitively (e.g. via net/http or Kubernetes client libraries) but does not itself\nperform custom DNS message parsing of attacker-controlled data; typical Go DNS resolution paths rarely trigger the vulnerable code path with untrusted\n input.\n\n\nRULED OUT (1) - the vulnerable code is not present or cannot run\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS BASIS\nUNKNOWN GO-2026-5158 go.opentelemetry.io/otel v1.41.0 1.44.0 14.7% pclntab\n\n[NOT PRESENT] go.opentelemetry.io/otel@v1.41.0\n cve: GO-2026-5158\n from: golang\n fixed in: 1.44.0\n epss: 14.7% percentile (epss 0.00237) for CVE-2026-41178\n purl: pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n binary: /usr/bin/helm-controller (stripped)\n packages: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation (package)\n vex: vulnerable_code_not_present [pclntab]\n evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n vendor: Rancher Security team says not_affected (vulnerable_code_not_present)\n Govulncheck determined that the vulnerable code isn't called\n product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-25T03:31:58Z\n matched loosely: statement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n\n\n golang Go 73 components 5 findings\n os Alpine:v3.24 16 components 0 findings\n affected by severity: 3 unknown\n 3 affected: 1 fixable, 2 with no fix yet\n already vexed: 1 by Rancher Security team\n priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n 5 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (1), RULED OUT (1)", "creation_timestamp": "2026-08-06T00:00:17.944674Z"} {"uuid": "d47452e3-ed3e-4d1f-9f3b-3e1117b7893c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41178", "type": "seen", "source": "https://gist.github.com/cwayne18/5a965b20d5d77b66faec2e6e18802a48", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/helm-controller:v0.17.7 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN --llm --llm-command \"gh copilot\" --mine-advisories --triage --details\nLLM overlay: asking command gh\nExtracting docker.io/rancher/helm-controller:v0.17.7 (linux/amd64)...\nScanning for Go binaries...\nFound 1 Go binaries.\nResolving advisories for 73 components (73 OSV queries)...\nFound 16 OS packages to check (Alpine:v3.24).\nResolving advisories for 10 components (14 OSV queries)...\nBuilding the shared-library closure...\n 18 ELF objects\n 8 of 18 reachable from 6 roots\nVEX hub https://github.com/rancher/vexhub: 1090 products indexed\nVEX hub https://github.com/rancher/vexhub: 2 finding(s) already covered by a published statement\nTriaging 5 findings against EPSS and CISA KEV (5 CVE ids)\nvexscan report (image) for docker.io/rancher/helm-controller:v0.17.7\n\n golang Go 73 components 5 findings\n os Alpine:v3.24 16 components 0 findings\n affected by severity: 3 unknown\n 3 affected: 1 fixable, 2 with no fix yet\n already vexed: 1 by Rancher Security team\n priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS BASIS\nUNKNOWN GO-2025-3521 k8s.io/kubernetes v1.35.1 no fix 41.1%\nUNKNOWN GO-2026-5970 golang.org/x/text v0.37.0 0.39.0 36.6%\nUNKNOWN GO-2025-3547 k8s.io/kubernetes v1.35.1 no fix 22.3%\n\n[LINKED] k8s.io/kubernetes@v1.35.1\n cve: GO-2025-3521\n from: golang\n epss: 41.1% percentile (epss 0.00516) for CVE-2025-1767\n purl: pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n binary: /usr/bin/helm-controller (stripped)\n packages: k8s.io/kubernetes (module)\n detail: linked\n llm: exploitable=unlikely confidence=medium\n helm-controller merely vendors k8s.io/kubernetes as a library dependency and static analysis shows only linkage, not call-graph reachability; such binaries typically use small subsets (client/apimachinery types) rather than the vulnerable server-side code paths, and GO-2025-3521 class kube vulnerabilities generally require running as an apiserver/kubelet component to be triggered by attacker input.\n\n[LINKED] golang.org/x/text@v0.37.0\n cve: GO-2026-5970\n from: golang\n fixed in: 0.39.0\n epss: 36.6% percentile (epss 0.00446) for CVE-2026-56852\n purl: pkg:golang/golang.org%2Fx%2Ftext@v0.37.0\n binary: /usr/bin/helm-controller (stripped)\n packages: golang.org/x/text/unicode/norm (package)\n detail: linked\n llm: exploitable=unlikely confidence=medium\n golang.org/x/text/unicode/norm is a transitive dependency typically pulled in for string normalization; helm-controller is a Kubernetes reconciliation controller unlikely to run Unicode normalization on attacker-controlled input paths, and static linkage alone doesn't establish reachability from network-facing code.\n\n[LINKED] k8s.io/kubernetes@v1.35.1\n cve: GO-2025-3547\n from: golang\n epss: 22.3% percentile (epss 0.00301) for CVE-2024-7598\n purl: pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n binary: /usr/bin/helm-controller (stripped)\n packages: k8s.io/kubernetes (module)\n detail: linked\n llm: exploitable=unlikely confidence=low\n k8s.io/kubernetes is a large module often pulled in only for API types/client libraries rather than actual server logic, and static analysis shows only linkage (not reachability) in a helm-controller binary, which typically doesn't run the vulnerable kube-apiserver/kubelet code paths; without confirmed call-path reachability or attacker-controlled input to the vulnerable function, real-world exploitability is low.\n\n\nALREADY VEXED (1) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS VEX STATUS JUSTIFICATION\nUNKNOWN GO-2026-5942 golang.org/x/net v0.55.0 0.56.0 26.4% not_affected vulnerable_code_not_present\n\n[LINKED] golang.org/x/net@v0.55.0\n cve: GO-2026-5942\n from: golang\n fixed in: 0.56.0\n epss: 26.4% percentile (epss 0.00339) for CVE-2026-46600\n purl: pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n binary: /usr/bin/helm-controller (stripped)\n packages: golang.org/x/net/dns/dnsmessage (package)\n detail: linked\n evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n vendor: Rancher Security team says not_affected (vulnerable_code_not_present)\n Govulncheck determined that the vulnerable code isn't called\n product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-22T03:28:02Z\n matched loosely: statement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n llm: exploitable=unlikely confidence=medium\n helm-controller links golang.org/x/net/dns/dnsmessage transitively (e.g. via net/http or Kubernetes client libraries) but does not itself\nperform custom DNS message parsing of attacker-controlled data; typical Go DNS resolution paths rarely trigger the vulnerable code path with untrusted\n input.\n\n\nRULED OUT (1) - the vulnerable code is not present or cannot run\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS BASIS\nUNKNOWN GO-2026-5158 go.opentelemetry.io/otel v1.41.0 1.44.0 14.7% pclntab\n\n[NOT PRESENT] go.opentelemetry.io/otel@v1.41.0\n cve: GO-2026-5158\n from: golang\n fixed in: 1.44.0\n epss: 14.7% percentile (epss 0.00237) for CVE-2026-41178\n purl: pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n binary: /usr/bin/helm-controller (stripped)\n packages: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation (package)\n vex: vulnerable_code_not_present [pclntab]\n evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n vendor: Rancher Security team says not_affected (vulnerable_code_not_present)\n Govulncheck determined that the vulnerable code isn't called\n product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-25T03:31:58Z\n matched loosely: statement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n\n\n golang Go 73 components 5 findings\n os Alpine:v3.24 16 components 0 findings\n affected by severity: 3 unknown\n 3 affected: 1 fixable, 2 with no fix yet\n already vexed: 1 by Rancher Security team\n priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n 5 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (1), RULED OUT (1)", "creation_timestamp": "2026-08-06T00:00:17.944674Z"} https://vulnerability.circl.lu/sighting/d47452e3-ed3e-4d1f-9f3b-3e1117b7893c/export Thu, 06 Aug 2026 00:00:17 +0000 https://vulnerability.circl.lu/sighting/5764ea21-d5b4-4b8d-9a6d-47333927dd35/export {"uuid": "5764ea21-d5b4-4b8d-9a6d-47333927dd35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41178", "type": "seen", "source": "https://gist.github.com/cwayne18/5a965b20d5d77b66faec2e6e18802a48", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/helm-controller:v0.17.7 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN --llm --llm-command \"gh copilot\" --mine-advisories --triage --details\nLLM overlay: asking command gh\nExtracting docker.io/rancher/helm-controller:v0.17.7 (linux/amd64)...\nScanning for Go binaries...\nFound 1 Go binaries.\nResolving advisories for 73 components (73 OSV queries)...\nFound 16 OS packages to check (Alpine:v3.24).\nResolving advisories for 10 components (14 OSV queries)...\nBuilding the shared-library closure...\n 18 ELF objects\n 8 of 18 reachable from 6 roots\nVEX hub https://github.com/rancher/vexhub: 1090 products indexed\nVEX hub https://github.com/rancher/vexhub: 2 finding(s) already covered by a published statement\nTriaging 5 findings against EPSS and CISA KEV (5 CVE ids)\nvexscan report (image) for docker.io/rancher/helm-controller:v0.17.7\n\n golang Go 73 components 5 findings\n os Alpine:v3.24 16 components 0 findings\n affected by severity: 3 unknown\n 3 affected: 1 fixable, 2 with no fix yet\n already vexed: 1 by Rancher Security team\n priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS BASIS\nUNKNOWN GO-2025-3521 k8s.io/kubernetes v1.35.1 no fix 41.1%\nUNKNOWN GO-2026-5970 golang.org/x/text v0.37.0 0.39.0 36.6%\nUNKNOWN GO-2025-3547 k8s.io/kubernetes v1.35.1 no fix 22.3%\n\n[LINKED] k8s.io/kubernetes@v1.35.1\n cve: GO-2025-3521\n from: golang\n epss: 41.1% percentile (epss 0.00516) for CVE-2025-1767\n purl: pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n binary: /usr/bin/helm-controller (stripped)\n packages: k8s.io/kubernetes (module)\n detail: linked\n llm: exploitable=unlikely confidence=medium\n helm-controller merely vendors k8s.io/kubernetes as a library dependency and static analysis shows only linkage, not call-graph reachability; such binaries typically use small subsets (client/apimachinery types) rather than the vulnerable server-side code paths, and GO-2025-3521 class kube vulnerabilities generally require running as an apiserver/kubelet component to be triggered by attacker input.\n\n[LINKED] golang.org/x/text@v0.37.0\n cve: GO-2026-5970\n from: golang\n fixed in: 0.39.0\n epss: 36.6% percentile (epss 0.00446) for CVE-2026-56852\n purl: pkg:golang/golang.org%2Fx%2Ftext@v0.37.0\n binary: /usr/bin/helm-controller (stripped)\n packages: golang.org/x/text/unicode/norm (package)\n detail: linked\n llm: exploitable=unlikely confidence=medium\n golang.org/x/text/unicode/norm is a transitive dependency typically pulled in for string normalization; helm-controller is a Kubernetes reconciliation controller unlikely to run Unicode normalization on attacker-controlled input paths, and static linkage alone doesn't establish reachability from network-facing code.\n\n[LINKED] k8s.io/kubernetes@v1.35.1\n cve: GO-2025-3547\n from: golang\n epss: 22.3% percentile (epss 0.00301) for CVE-2024-7598\n purl: pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n binary: /usr/bin/helm-controller (stripped)\n packages: k8s.io/kubernetes (module)\n detail: linked\n llm: exploitable=unlikely confidence=low\n k8s.io/kubernetes is a large module often pulled in only for API types/client libraries rather than actual server logic, and static analysis shows only linkage (not reachability) in a helm-controller binary, which typically doesn't run the vulnerable kube-apiserver/kubelet code paths; without confirmed call-path reachability or attacker-controlled input to the vulnerable function, real-world exploitability is low.\n\n\nALREADY VEXED (1) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS VEX STATUS JUSTIFICATION\nUNKNOWN GO-2026-5942 golang.org/x/net v0.55.0 0.56.0 26.4% not_affected vulnerable_code_not_present\n\n[LINKED] golang.org/x/net@v0.55.0\n cve: GO-2026-5942\n from: golang\n fixed in: 0.56.0\n epss: 26.4% percentile (epss 0.00339) for CVE-2026-46600\n purl: pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n binary: /usr/bin/helm-controller (stripped)\n packages: golang.org/x/net/dns/dnsmessage (package)\n detail: linked\n evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n vendor: Rancher Security team says not_affected (vulnerable_code_not_present)\n Govulncheck determined that the vulnerable code isn't called\n product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-22T03:28:02Z\n matched loosely: statement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n llm: exploitable=unlikely confidence=medium\n helm-controller links golang.org/x/net/dns/dnsmessage transitively (e.g. via net/http or Kubernetes client libraries) but does not itself\nperform custom DNS message parsing of attacker-controlled data; typical Go DNS resolution paths rarely trigger the vulnerable code path with untrusted\n input.\n\n\nRULED OUT (1) - the vulnerable code is not present or cannot run\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS BASIS\nUNKNOWN GO-2026-5158 go.opentelemetry.io/otel v1.41.0 1.44.0 14.7% pclntab\n\n[NOT PRESENT] go.opentelemetry.io/otel@v1.41.0\n cve: GO-2026-5158\n from: golang\n fixed in: 1.44.0\n epss: 14.7% percentile (epss 0.00237) for CVE-2026-41178\n purl: pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n binary: /usr/bin/helm-controller (stripped)\n packages: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation (package)\n vex: vulnerable_code_not_present [pclntab]\n evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n vendor: Rancher Security team says not_affected (vulnerable_code_not_present)\n Govulncheck determined that the vulnerable code isn't called\n product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-25T03:31:58Z\n matched loosely: statement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n\n\n golang Go 73 components 5 findings\n os Alpine:v3.24 16 components 0 findings\n affected by severity: 3 unknown\n 3 affected: 1 fixable, 2 with no fix yet\n already vexed: 1 by Rancher Security team\n priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n 5 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (1), RULED OUT (1)", "creation_timestamp": "2026-08-05T22:37:18.396564Z"} {"uuid": "5764ea21-d5b4-4b8d-9a6d-47333927dd35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41178", "type": "seen", "source": "https://gist.github.com/cwayne18/5a965b20d5d77b66faec2e6e18802a48", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/helm-controller:v0.17.7 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN --llm --llm-command \"gh copilot\" --mine-advisories --triage --details\nLLM overlay: asking command gh\nExtracting docker.io/rancher/helm-controller:v0.17.7 (linux/amd64)...\nScanning for Go binaries...\nFound 1 Go binaries.\nResolving advisories for 73 components (73 OSV queries)...\nFound 16 OS packages to check (Alpine:v3.24).\nResolving advisories for 10 components (14 OSV queries)...\nBuilding the shared-library closure...\n 18 ELF objects\n 8 of 18 reachable from 6 roots\nVEX hub https://github.com/rancher/vexhub: 1090 products indexed\nVEX hub https://github.com/rancher/vexhub: 2 finding(s) already covered by a published statement\nTriaging 5 findings against EPSS and CISA KEV (5 CVE ids)\nvexscan report (image) for docker.io/rancher/helm-controller:v0.17.7\n\n golang Go 73 components 5 findings\n os Alpine:v3.24 16 components 0 findings\n affected by severity: 3 unknown\n 3 affected: 1 fixable, 2 with no fix yet\n already vexed: 1 by Rancher Security team\n priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS BASIS\nUNKNOWN GO-2025-3521 k8s.io/kubernetes v1.35.1 no fix 41.1%\nUNKNOWN GO-2026-5970 golang.org/x/text v0.37.0 0.39.0 36.6%\nUNKNOWN GO-2025-3547 k8s.io/kubernetes v1.35.1 no fix 22.3%\n\n[LINKED] k8s.io/kubernetes@v1.35.1\n cve: GO-2025-3521\n from: golang\n epss: 41.1% percentile (epss 0.00516) for CVE-2025-1767\n purl: pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n binary: /usr/bin/helm-controller (stripped)\n packages: k8s.io/kubernetes (module)\n detail: linked\n llm: exploitable=unlikely confidence=medium\n helm-controller merely vendors k8s.io/kubernetes as a library dependency and static analysis shows only linkage, not call-graph reachability; such binaries typically use small subsets (client/apimachinery types) rather than the vulnerable server-side code paths, and GO-2025-3521 class kube vulnerabilities generally require running as an apiserver/kubelet component to be triggered by attacker input.\n\n[LINKED] golang.org/x/text@v0.37.0\n cve: GO-2026-5970\n from: golang\n fixed in: 0.39.0\n epss: 36.6% percentile (epss 0.00446) for CVE-2026-56852\n purl: pkg:golang/golang.org%2Fx%2Ftext@v0.37.0\n binary: /usr/bin/helm-controller (stripped)\n packages: golang.org/x/text/unicode/norm (package)\n detail: linked\n llm: exploitable=unlikely confidence=medium\n golang.org/x/text/unicode/norm is a transitive dependency typically pulled in for string normalization; helm-controller is a Kubernetes reconciliation controller unlikely to run Unicode normalization on attacker-controlled input paths, and static linkage alone doesn't establish reachability from network-facing code.\n\n[LINKED] k8s.io/kubernetes@v1.35.1\n cve: GO-2025-3547\n from: golang\n epss: 22.3% percentile (epss 0.00301) for CVE-2024-7598\n purl: pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n binary: /usr/bin/helm-controller (stripped)\n packages: k8s.io/kubernetes (module)\n detail: linked\n llm: exploitable=unlikely confidence=low\n k8s.io/kubernetes is a large module often pulled in only for API types/client libraries rather than actual server logic, and static analysis shows only linkage (not reachability) in a helm-controller binary, which typically doesn't run the vulnerable kube-apiserver/kubelet code paths; without confirmed call-path reachability or attacker-controlled input to the vulnerable function, real-world exploitability is low.\n\n\nALREADY VEXED (1) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS VEX STATUS JUSTIFICATION\nUNKNOWN GO-2026-5942 golang.org/x/net v0.55.0 0.56.0 26.4% not_affected vulnerable_code_not_present\n\n[LINKED] golang.org/x/net@v0.55.0\n cve: GO-2026-5942\n from: golang\n fixed in: 0.56.0\n epss: 26.4% percentile (epss 0.00339) for CVE-2026-46600\n purl: pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n binary: /usr/bin/helm-controller (stripped)\n packages: golang.org/x/net/dns/dnsmessage (package)\n detail: linked\n evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n vendor: Rancher Security team says not_affected (vulnerable_code_not_present)\n Govulncheck determined that the vulnerable code isn't called\n product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-22T03:28:02Z\n matched loosely: statement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n llm: exploitable=unlikely confidence=medium\n helm-controller links golang.org/x/net/dns/dnsmessage transitively (e.g. via net/http or Kubernetes client libraries) but does not itself\nperform custom DNS message parsing of attacker-controlled data; typical Go DNS resolution paths rarely trigger the vulnerable code path with untrusted\n input.\n\n\nRULED OUT (1) - the vulnerable code is not present or cannot run\nSEVERITY ADVISORY PACKAGE VERSION FIXED IN EPSS BASIS\nUNKNOWN GO-2026-5158 go.opentelemetry.io/otel v1.41.0 1.44.0 14.7% pclntab\n\n[NOT PRESENT] go.opentelemetry.io/otel@v1.41.0\n cve: GO-2026-5158\n from: golang\n fixed in: 1.44.0\n epss: 14.7% percentile (epss 0.00237) for CVE-2026-41178\n purl: pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n binary: /usr/bin/helm-controller (stripped)\n packages: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation (package)\n vex: vulnerable_code_not_present [pclntab]\n evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n vendor: Rancher Security team says not_affected (vulnerable_code_not_present)\n Govulncheck determined that the vulnerable code isn't called\n product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-25T03:31:58Z\n matched loosely: statement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n\n\n golang Go 73 components 5 findings\n os Alpine:v3.24 16 components 0 findings\n affected by severity: 3 unknown\n 3 affected: 1 fixable, 2 with no fix yet\n already vexed: 1 by Rancher Security team\n priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n 5 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (1), RULED OUT (1)", "creation_timestamp": "2026-08-05T22:37:18.396564Z"} https://vulnerability.circl.lu/sighting/5764ea21-d5b4-4b8d-9a6d-47333927dd35/export Wed, 05 Aug 2026 22:37:18 +0000 https://vulnerability.circl.lu/sighting/c5aafc14-2624-485a-b161-2dcb668f4226/export {"uuid": "c5aafc14-2624-485a-b161-2dcb668f4226", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95321", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41179\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a s-vx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-27 04:18:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRCE in rclone\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-28T00:00:44.431168Z"} {"uuid": "c5aafc14-2624-485a-b161-2dcb668f4226", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95321", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41179\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a s-vx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-27 04:18:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRCE in rclone\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-28T00:00:44.431168Z"} https://vulnerability.circl.lu/sighting/c5aafc14-2624-485a-b161-2dcb668f4226/export Tue, 28 Jul 2026 00:00:44 +0000 https://vulnerability.circl.lu/sighting/fbbd5124-271a-487c-911e-aaaeed77147e/export {"uuid": "fbbd5124-271a-487c-911e-aaaeed77147e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "published-proof-of-concept", "source": "Telegram/kn38l-BAxVCicUp4xe_VlmwdfqsYeVojoIvsltdH6OF8az4", "content": "", "creation_timestamp": "2026-07-28T00:00:37.935528Z"} {"uuid": "fbbd5124-271a-487c-911e-aaaeed77147e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "published-proof-of-concept", "source": "Telegram/kn38l-BAxVCicUp4xe_VlmwdfqsYeVojoIvsltdH6OF8az4", "content": "", "creation_timestamp": "2026-07-28T00:00:37.935528Z"} https://vulnerability.circl.lu/sighting/fbbd5124-271a-487c-911e-aaaeed77147e/export Tue, 28 Jul 2026 00:00:37 +0000 https://vulnerability.circl.lu/sighting/c1b7fb89-406e-4976-bc06-ae64c8668d6c/export {"uuid": "c1b7fb89-406e-4976-bc06-ae64c8668d6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "Telegram/kn38l-BAxVCicUp4xe_VlmwdfqsYeVojoIvsltdH6OF8az4", "content": "", "creation_timestamp": "2026-07-27T10:00:04.484027Z"} {"uuid": "c1b7fb89-406e-4976-bc06-ae64c8668d6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "Telegram/kn38l-BAxVCicUp4xe_VlmwdfqsYeVojoIvsltdH6OF8az4", "content": "", "creation_timestamp": "2026-07-27T10:00:04.484027Z"} https://vulnerability.circl.lu/sighting/c1b7fb89-406e-4976-bc06-ae64c8668d6c/export Mon, 27 Jul 2026 10:00:04 +0000 https://vulnerability.circl.lu/sighting/53ce4447-817e-45a4-bd54-a518d560b6b8/export {"uuid": "53ce4447-817e-45a4-bd54-a518d560b6b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "https://t.me/GithubRedTeam/95321", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41179\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a s-vx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-27 04:18:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRCE in rclone\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-27T06:00:04.806659Z"} {"uuid": "53ce4447-817e-45a4-bd54-a518d560b6b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "https://t.me/GithubRedTeam/95321", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41179\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a s-vx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-27 04:18:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRCE in rclone\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-27T06:00:04.806659Z"} https://vulnerability.circl.lu/sighting/53ce4447-817e-45a4-bd54-a518d560b6b8/export Mon, 27 Jul 2026 06:00:04 +0000 https://vulnerability.circl.lu/sighting/9caf48c8-de63-4867-9ef0-c24ae6b2ce9f/export {"uuid": "9caf48c8-de63-4867-9ef0-c24ae6b2ce9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "published-proof-of-concept", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-19T00:00:41.061754Z"} {"uuid": "9caf48c8-de63-4867-9ef0-c24ae6b2ce9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "published-proof-of-concept", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-19T00:00:41.061754Z"} https://vulnerability.circl.lu/sighting/9caf48c8-de63-4867-9ef0-c24ae6b2ce9f/export Sun, 19 Jul 2026 00:00:41 +0000 https://vulnerability.circl.lu/sighting/b0cd122a-3ea4-4385-86b9-cd8ce7890d56/export {"uuid": "b0cd122a-3ea4-4385-86b9-cd8ce7890d56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "published-proof-of-concept", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-18T02:00:06.398912Z"} {"uuid": "b0cd122a-3ea4-4385-86b9-cd8ce7890d56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "published-proof-of-concept", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-18T02:00:06.398912Z"} https://vulnerability.circl.lu/sighting/b0cd122a-3ea4-4385-86b9-cd8ce7890d56/export Sat, 18 Jul 2026 02:00:06 +0000 https://vulnerability.circl.lu/sighting/5b19b16e-2e6b-4b24-b801-7f0a4a554f52/export {"uuid": "5b19b16e-2e6b-4b24-b801-7f0a4a554f52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-17T00:00:45.996267Z"} {"uuid": "5b19b16e-2e6b-4b24-b801-7f0a4a554f52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-17T00:00:45.996267Z"} https://vulnerability.circl.lu/sighting/5b19b16e-2e6b-4b24-b801-7f0a4a554f52/export Fri, 17 Jul 2026 00:00:45 +0000 https://vulnerability.circl.lu/sighting/fe493b4b-057c-4879-9b3e-514df3f85db9/export {"uuid": "fe493b4b-057c-4879-9b3e-514df3f85db9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-16T19:00:28.558049Z"} {"uuid": "fe493b4b-057c-4879-9b3e-514df3f85db9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41179", "type": "seen", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-16T19:00:28.558049Z"} https://vulnerability.circl.lu/sighting/fe493b4b-057c-4879-9b3e-514df3f85db9/export Thu, 16 Jul 2026 19:00:28 +0000