https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T13:33:11.987704+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cleanstart-2026-hx99883 Withdrawn: CLEANSTART-2026-HX99883 — Security fixes in grafana 13.1.0-r3 2026-09-30T13:33:12.285060+00:00

Withdrawn by the publisher.

Affected: CleanStart: grafana

Package grafana version 13.1.0-r3 fixes 10 vulnerabilities: ghsa-r277-6w6q-xmqw, ghsa-jpcw-4wr7-c3vq, ghsa-gcjh-h69q-9w9g, CVE-2026-46600, CVE-2026-56852...

 https://vulnerability.circl.lu/vuln/cve-2026-73502 CVE-2026-73502 — kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter w… 2026-09-30T13:33:12.285265+00:00

Affected: getkin kin-openapi

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.