https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T23:04:40.845031+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-25681 CVE-2026-25681 — Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html 2026-09-30T23:04:41.070911+00:00

Affected: golang.org/x/net/html

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

 https://vulnerability.circl.lu/vuln/ghsa-fw7p-63qq-7hpr GHSA-fw7p-63qq-7hpr — filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity 2026-09-30T23:04:41.071014+00:00

Affected: Go: filippo.io/edwards25519

`(*Point).MultiScalarMult` failed to initialize its receiver.

If the method was called on an initialized point that is not the identity point, MultiScalarMult produced an incorrect result.

If the method was called on an uninitialized point, the behavior was undefined. In particular, if the receiver was the zero value, MultiScalarMult returned an invalid point that compared Equal to every point.

*Note that MultiScalarMult is a rarely used advanced API. For example, if you only depend on `filippo.io/edwards25519` via `github.com/go-sql-driver/mysql`, **you are not affected**. If you were notified of this issue despite not being affected, consider switching to a vulnerability scanner that is more precise and respectful of your attention, like [govulncheck](https://go.dev/doc/tutorial/govulncheck).*