<?xml version='1.0' encoding='UTF-8'?>
<?xml-stylesheet href="/static/style.xsl" type="text/xsl"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title>Most recent entries from all</title>
    <link>https://vulnerability.circl.lu</link>
    <description>Contains only the most 10 recent entries.</description>
    <docs>http://www.rssboard.org/rss-specification</docs>
    <generator>python-feedgen</generator>
    <language>en</language>
    <lastBuildDate>Fri, 02 Oct 2026 00:25:33 +0000</lastBuildDate>
    <item>
      <title>CVE-2026-46595 — Invoking  VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh</title>
      <link>https://vulnerability.circl.lu/vuln/cve-2026-46595</link>
      <description>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; golang.org/x/crypto/ssh, Red Hat Cryostat 4 on RHEL 9, Red Hat RHEM 1.0 for RHEL 9, Red Hat RHEM 1.1 for RHEL 10, Red Hat RHEM 1.1 for RHEL 9, Red Hat Cert Manager support for Red Hat OpenShift release 1.19, Red Hat Cluster Observability Operator 1.5.0, Red Hat DevWorkspace Operator 0.42, Red Hat Logging Subsystem for Red Hat OpenShift 6.6, Red Hat multicluster engine for Kubernetes 2.8 and 46 more&lt;/p&gt;
&lt;p&gt;Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; golang.org/x/crypto/ssh, Red Hat Cryostat 4 on RHEL 9, Red Hat RHEM 1.0 for RHEL 9, Red Hat RHEM 1.1 for RHEL 10, Red Hat RHEM 1.1 for RHEL 9, Red Hat Cert Manager support for Red Hat OpenShift release 1.19, Red Hat Cluster Observability Operator 1.5.0, Red Hat DevWorkspace Operator 0.42, Red Hat Logging Subsystem for Red Hat OpenShift 6.6, Red Hat multicluster engine for Kubernetes 2.8 and 46 more&lt;/p&gt;
&lt;p&gt;Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://vulnerability.circl.lu/vuln/cve-2026-46595</guid>
    </item>
  </channel>
</rss>
