https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T20:35:04.114134+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-25679 CVE-2026-25679 — Incorrect parsing of IPv6 host literals in net/url 2026-10-06T20:35:04.213475+00:00

Affected: Go standard library net/url, Red Hat Cryostat 4 on RHEL 9, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8 and 135 more

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

 https://vulnerability.circl.lu/vuln/ghsa-gxhx-2686-5h9g GHSA-gxhx-2686-5h9g — slack-go `SecretsVerifier` accepts empty signing secret without precondition 2026-10-06T20:35:04.215464+00:00

Affected: Go: github.com/slack-go/slack

`SecretsVerifier` in slack-go/slack before v0.23.1 accepts an empty signing secret without error. If an application is misconfigured (e.g., an unset or empty `SLACK_SIGNING_SECRET`), `NewSecretsVerifier` builds an HMAC-SHA256 keyed with an empty string, allowing an unauthenticated attacker to forge a valid `X-Slack-Signature` and bypass Slack request authentication. Fixed in v0.23.1, which rejects empty secrets with `ErrInvalidConfiguration`. This is patched in version 0.23.1.