Sync EUVD catalog: Thu Sep 10 00:32:23 UTC 2026

Signed-off-by: AboutCode Automation <automation@aboutcode.org>

Author: aboutcode-automation

advisories/2024/10/EUVD-2024-2916.json

@@ -3,11 +3,11 @@
   "enisaUuid": "5807c4d5-6b28-3f75-abb2-38d836fd5d06",
   "description": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
   "datePublished": "Oct 1, 2024, 6:17:29 PM",
-  "dateUpdated": "Sep 8, 2026, 9:23:06 PM",
+  "dateUpdated": "Sep 9, 2026, 4:14:42 PM",
   "baseScore": 6.5,
   "baseScoreVersion": "3.1",
   "baseScoreVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
-  "references": "https://access.redhat.com/errata/RHSA-2024:10133\nhttps://access.redhat.com/errata/RHSA-2024:7502\nhttps://access.redhat.com/errata/RHSA-2024:7550\nhttps://access.redhat.com/errata/RHSA-2024:8327\nhttps://access.redhat.com/errata/RHSA-2024:8678\nhttps://access.redhat.com/errata/RHSA-2024:8847\nhttps://access.redhat.com/errata/RHSA-2024:9551\nhttps://access.redhat.com/errata/RHSA-2025:2416\nhttps://access.redhat.com/errata/RHSA-2025:7118\nhttps://access.redhat.com/errata/RHSA-2025:7256\nhttps://access.redhat.com/errata/RHSA-2025:7624\nhttps://access.redhat.com/errata/RHSA-2026:55520\nhttps://access.redhat.com/errata/RHSA-2026:55525\nhttps://access.redhat.com/errata/RHSA-2026:59439\nhttps://access.redhat.com/security/cve/CVE-2024-9355\nhttps://bugzilla.redhat.com/show_bug.cgi?id=2315719\nhttps://github.com/golang-fips/openssl/pull/198\n",
+  "references": "https://access.redhat.com/errata/RHSA-2024:10133\nhttps://access.redhat.com/errata/RHSA-2024:7502\nhttps://access.redhat.com/errata/RHSA-2024:7550\nhttps://access.redhat.com/errata/RHSA-2024:8327\nhttps://access.redhat.com/errata/RHSA-2024:8678\nhttps://access.redhat.com/errata/RHSA-2024:8847\nhttps://access.redhat.com/errata/RHSA-2024:9551\nhttps://access.redhat.com/errata/RHSA-2025:2416\nhttps://access.redhat.com/errata/RHSA-2025:7118\nhttps://access.redhat.com/errata/RHSA-2025:7256\nhttps://access.redhat.com/errata/RHSA-2025:7624\nhttps://access.redhat.com/errata/RHSA-2026:55520\nhttps://access.redhat.com/errata/RHSA-2026:55525\nhttps://access.redhat.com/errata/RHSA-2026:59439\nhttps://access.redhat.com/errata/RHSA-2026:66016\nhttps://access.redhat.com/security/cve/CVE-2024-9355\nhttps://bugzilla.redhat.com/show_bug.cgi?id=2315719\nhttps://github.com/golang-fips/openssl/pull/198\n",
   "aliases": "GHSA-3h3x-2hwv-hr52\nCVE-2024-9355\n",
   "assigner": "redhat",
   "epss": 0.3,
@@ -52,6 +52,16 @@
       },
       "product_version": "patch: 0:1.21.13-4.el9_4"
     },
+    {
+      "id": "5a82576b-4614-3fb0-8aae-d6c3077923a4",
+      "product": {
+        "name": "Red Hat Enterprise Linux 8",
+        "vendor": {
+          "name": "Red Hat"
+        }
+      },
+      "product_version": "patch: 0:101.5-2.el8_10"
+    },
     {
       "id": "66974e22-654e-324c-9dab-d06d2d949e11",
       "product": {

advisories/2025/06/EUVD-2025-17572.json

@@ -3,7 +3,7 @@
   "enisaUuid": "f8a0a0e3-5848-3b1f-a267-f702d529f3a5",
   "description": "A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.",
   "datePublished": "Jun 9, 2025, 7:53:48 PM",
-  "dateUpdated": "Sep 7, 2026, 7:28:29 PM",
+  "dateUpdated": "Sep 9, 2026, 3:00:07 AM",
   "baseScore": 7.8,
   "baseScoreVersion": "3.1",
   "baseScoreVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
@@ -22,16 +22,6 @@
       },
       "product_version": "patch: 1.36.0-18"
     },
-    {
-      "id": "01d1b9ad-77ac-331f-9fed-adf5c80e3b39",
-      "product": {
-        "name": "Red Hat OpenShift distributed tracing 3.5",
-        "vendor": {
-          "name": "Red Hat"
-        }
-      },
-      "product_version": "patch: rhosdt-3.5-1756125872"
-    },
     {
       "id": "02216292-3fe4-3ca4-a46b-4afc33922f5f",
       "product": {
@@ -82,6 +72,16 @@
       },
       "product_version": "patch: 0:3.3.3-1.el8_4.1"
     },
+    {
+      "id": "1486fe2c-7b53-31c6-b975-0b414bcc5e33",
+      "product": {
+        "name": "Red Hat OpenShift distributed tracing 3.5.3",
+        "vendor": {
+          "name": "Red Hat"
+        }
+      },
+      "product_version": "patch: rhosdt-3.5-1756116455"
+    },
     {
       "id": "1d4a0699-bb0b-3635-8720-5d64c6effabf",
       "product": {
@@ -92,6 +92,46 @@
       },
       "product_version": "patch: 1.36.0-4"
     },
+    {
+      "id": "24a88416-47db-3e3d-8796-3f98b4cf9fd4",
+      "product": {
+        "name": "Red Hat OpenShift distributed tracing 3.5.3",
+        "vendor": {
+          "name": "Red Hat"
+        }
+      },
+      "product_version": "patch: rhosdt-3.5-1756116439"
+    },
+    {
+      "id": "2bab4393-126c-3d2d-8ef6-2fd26d9f2957",
+      "product": {
+        "name": "Red Hat OpenShift distributed tracing 3.5.3",
+        "vendor": {
+          "name": "Red Hat"
+        }
+      },
+      "product_version": "patch: rhosdt-3.5-1756116445"
+    },
+    {
+      "id": "2fe70a7b-5244-3636-8c12-680b517a0315",
+      "product": {
+        "name": "Red Hat OpenShift distributed tracing 3.5.3",
+        "vendor": {
+          "name": "Red Hat"
+        }
+      },
+      "product_version": "patch: rhosdt-3.5-1756125872"
+    },
+    {
+      "id": "3a11d944-de02-3438-a902-f87788a53fc3",
+      "product": {
+        "name": "Red Hat OpenShift distributed tracing 3.5.3",
+        "vendor": {
+          "name": "Red Hat"
+        }
+      },
+      "product_version": "patch: rhosdt-3.5-1756116482"
+    },
     {
       "id": "3c607848-fc9f-3bca-930f-4700a224c551",
       "product": {
@@ -142,16 +182,6 @@
       },
       "product_version": "patch: 1.36.0-11"
     },
-    {
-      "id": "5cbc9684-86da-3f4f-a42b-dd7d938b38f9",
-      "product": {
-        "name": "Red Hat OpenShift distributed tracing 3.5",
-        "vendor": {
-          "name": "Red Hat"
-        }
-      },
-      "product_version": "patch: rhosdt-3.5-1756116482"
-    },
     {
       "id": "6509d724-9e3f-3b36-a982-0eaa22fe3bc0",
       "product": {
@@ -162,16 +192,6 @@
       },
       "product_version": "patch: 0:3.3.3-6.el8_6"
     },
-    {
-      "id": "68adbe41-e490-3c69-938f-fe7e10a61666",
-      "product": {
-        "name": "Red Hat OpenShift distributed tracing 3.5",
-        "vendor": {
-          "name": "Red Hat"
-        }
-      },
-      "product_version": "patch: rhosdt-3.5-1756116445"
-    },
     {
       "id": "69e74a5b-2444-3414-8e03-ae2d801263e9",
       "product": {
@@ -192,16 +212,6 @@
       },
       "product_version": "patch: 1.10.2-1757421846"
     },
-    {
-      "id": "753e054d-3332-3f17-bc51-be508e442b78",
-      "product": {
-        "name": "Red Hat OpenShift distributed tracing 3.5",
-        "vendor": {
-          "name": "Red Hat"
-        }
-      },
-      "product_version": "patch: rhosdt-3.5-1756116455"
-    },
     {
       "id": "804ad419-c2c0-38e8-96ef-72133c1261dd",
       "product": {
@@ -252,16 +262,6 @@
       },
       "product_version": "patch: 1.12-4"
     },
-    {
-      "id": "8919beb5-1a23-3abc-88c3-1cd3c864dab4",
-      "product": {
-        "name": "Red Hat OpenShift distributed tracing 3.5",
-        "vendor": {
-          "name": "Red Hat"
-        }
-      },
-      "product_version": "patch: rhosdt-3.5-1756128595"
-    },
     {
       "id": "8fdc5409-1a6f-3c26-83e5-395efcda9a72",
       "product": {
@@ -303,14 +303,14 @@
       "product_version": "patch: 1.10.2-1757422070"
     },
     {
-      "id": "9a00fca0-18cc-3663-ab0a-9dcf7874303b",
+      "id": "9712f0a5-3830-3538-aad6-6196231ab90e",
       "product": {
-        "name": "Red Hat OpenShift distributed tracing 3.5",
+        "name": "Red Hat OpenShift distributed tracing 3.5.3",
         "vendor": {
           "name": "Red Hat"
         }
       },
-      "product_version": "patch: rhosdt-3.5-1756116447"
+      "product_version": "patch: rhosdt-3.5-1756116449"
     },
     {
       "id": "9d83453e-1e52-31eb-ae30-e817a07dcf1e",
@@ -332,16 +332,6 @@
       },
       "product_version": "patch: 0:3.3.3-5.el8_8.1"
     },
-    {
-      "id": "a76f5368-7753-34a5-9c62-3793aaa04e6a",
-      "product": {
-        "name": "Red Hat OpenShift distributed tracing 3.5",
-        "vendor": {
-          "name": "Red Hat"
-        }
-      },
-      "product_version": "patch: rhosdt-3.5-1756116441"
-    },
     {
       "id": "abab5b11-a615-389f-b215-3d425e8266d3",
       "product": {
@@ -402,16 +392,6 @@
       },
       "product_version": "patch: 0:3.3.3-6.el8_6"
     },
-    {
-      "id": "c051d534-03d4-32c4-8c67-fa21bbc11d14",
-      "product": {
-        "name": "Red Hat OpenShift distributed tracing 3.5",
-        "vendor": {
-          "name": "Red Hat"
-        }
-      },
-      "product_version": "patch: rhosdt-3.5-1756116449"
-    },
     {
       "id": "cb51c50c-87b8-35cb-9057-c42eabeab6c8",
       "product": {
@@ -443,34 +423,54 @@
       "product_version": "patch: 1.36.0-7"
     },
     {
-      "id": "dcc1d67f-670d-3650-b017-ce244ff12337",
+      "id": "d4edc727-2b9f-362e-98f7-9e609f618e22",
       "product": {
-        "name": "Red Hat OpenShift Container Platform 4.17",
+        "name": "Red Hat OpenShift distributed tracing 3.5.3",
         "vendor": {
           "name": "Red Hat"
         }
       },
-      "product_version": "patch: 417.94.202510112152-0"
+      "product_version": "patch: rhosdt-3.5-1756116447"
     },
     {
-      "id": "df768bd0-b8d0-341e-bc83-6a78140c2dcf",
+      "id": "d5398b8d-36f9-39db-904e-3e7cc13eb61e",
       "product": {
-        "name": "Red Hat OpenShift sandboxed containers 1.1",
+        "name": "Red Hat OpenShift distributed tracing 3.5.3",
         "vendor": {
           "name": "Red Hat"
         }
       },
-      "product_version": "patch: 1.10.2-1757422401"
+      "product_version": "patch: rhosdt-3.5-1756116441"
     },
     {
-      "id": "e095ba8e-a053-3688-8666-e945669b015e",
+      "id": "d60a5746-6a40-3650-b706-3752dbce29a4",
       "product": {
-        "name": "Red Hat OpenShift distributed tracing 3.5",
+        "name": "Red Hat OpenShift distributed tracing 3.5.3",
         "vendor": {
           "name": "Red Hat"
         }
       },
-      "product_version": "patch: rhosdt-3.5-1756116439"
+      "product_version": "patch: rhosdt-3.5-1756128595"
+    },
+    {
+      "id": "dcc1d67f-670d-3650-b017-ce244ff12337",
+      "product": {
+        "name": "Red Hat OpenShift Container Platform 4.17",
+        "vendor": {
+          "name": "Red Hat"
+        }
+      },
+      "product_version": "patch: 417.94.202510112152-0"
+    },
+    {
+      "id": "df768bd0-b8d0-341e-bc83-6a78140c2dcf",
+      "product": {
+        "name": "Red Hat OpenShift sandboxed containers 1.1",
+        "vendor": {
+          "name": "Red Hat"
+        }
+      },
+      "product_version": "patch: 1.10.2-1757422401"
     },
     {
       "id": "e37c796d-0897-3d5d-8a98-8d27d5803ba8",

advisories/2025/12/EUVD-2025-204437.json

@@ -3,14 +3,14 @@
   "enisaUuid": "e73c364a-6676-383a-9712-27b1bf269b8b",
   "description": "An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\n\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.",
   "datePublished": "Dec 19, 2025, 12:01:55 AM",
-  "dateUpdated": "Aug 10, 2026, 7:36:36 PM",
+  "dateUpdated": "Sep 9, 2026, 4:18:10 AM",
   "baseScore": 9.3,
   "baseScoreVersion": "4.0",
   "baseScoreVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red",
   "references": "https://psirt.watchguard.com/CVE-2025-14733\nhttps://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027\n",
   "aliases": "GHSA-hv82-jj64-jf47\nCVE-2025-14733\n",
   "assigner": "WatchGuard",
-  "epss": 22.29,
+  "epss": 26.51,
   "exploitedSince": "Dec 19, 2025, 12:00:00 AM",
   "enisaIdProduct": [
     {

advisories/2026/01/EUVD-2025-206229.json

@@ -3,7 +3,7 @@
   "enisaUuid": "5c80e1c9-34b1-35a3-a513-6e385992e61a",
   "description": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.",
   "datePublished": "Jan 5, 2026, 10:00:17 PM",
-  "dateUpdated": "Sep 7, 2026, 12:05:11 PM",
+  "dateUpdated": "Sep 9, 2026, 12:04:44 PM",
   "baseScore": 7.5,
   "baseScoreVersion": "3.1",
   "baseScoreVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",

advisories/2026/01/EUVD-2025-206319.json

@@ -3,7 +3,7 @@
   "enisaUuid": "182c81c9-b777-3d6d-9fd3-3f82aeca6da7",
   "description": "Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset\u00a0and _.omit\u00a0functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23",
   "datePublished": "Jan 21, 2026, 7:05:28 PM",
-  "dateUpdated": "Sep 7, 2026, 12:05:01 PM",
+  "dateUpdated": "Sep 9, 2026, 12:04:45 PM",
   "baseScore": 6.9,
   "baseScoreVersion": "4.0",
   "baseScoreVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P",

advisories/2026/01/EUVD-2025-206445.json

@@ -3,14 +3,14 @@
   "enisaUuid": "d3f329e2-783a-3c98-95d8-59b4e2a6947d",
   "description": "The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.",
   "datePublished": "Jan 28, 2026, 7:30:31 PM",
-  "dateUpdated": "Sep 7, 2026, 12:04:56 PM",
+  "dateUpdated": "Sep 9, 2026, 12:05:05 PM",
   "baseScore": 7.5,
   "baseScoreVersion": "3.1",
   "baseScoreVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
   "references": "https://go.dev/cl/736712\nhttps://go.dev/issue/77101\nhttps://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc\nhttps://pkg.go.dev/vuln/GO-2026-4341\n",
   "aliases": "GHSA-gm9r-q53w-2gh4\nCVE-2025-61726\n",
   "assigner": "Go",
-  "epss": 1.98,
+  "epss": 2.13,
   "enisaIdProduct": [
     {
       "id": "1db149d6-c9ab-35d0-b767-f339d613a57e",

advisories/2026/01/EUVD-2025-206447.json

@@ -3,7 +3,7 @@
   "enisaUuid": "9260b64f-05ee-3c90-bf9b-ed7c14d91c7f",
   "description": "Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The \"#cgo pkg-config:\" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a \"--log-file\" argument to this directive, causing pkg-config to write to an attacker-controlled location.",
   "datePublished": "Jan 28, 2026, 7:30:30 PM",
-  "dateUpdated": "Sep 7, 2026, 12:05:06 PM",
+  "dateUpdated": "Sep 9, 2026, 12:04:58 PM",
   "baseScore": 7.8,
   "baseScoreVersion": "3.1",
   "baseScoreVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",

advisories/2026/01/EUVD-2026-1188.json

@@ -3,7 +3,7 @@
   "enisaUuid": "8ffe6b86-04ea-3855-b0d3-25633b2bccbc",
   "description": "urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.",
   "datePublished": "Jan 7, 2026, 10:09:01 PM",
-  "dateUpdated": "Sep 7, 2026, 12:04:47 PM",
+  "dateUpdated": "Sep 9, 2026, 12:04:55 PM",
   "baseScore": 8.9,
   "baseScoreVersion": "4.0",
   "baseScoreVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",

advisories/2026/01/EUVD-2026-1465.json

@@ -3,14 +3,14 @@
   "enisaUuid": "0fc07b00-abbf-358d-ab7f-617b06665058",
   "description": "React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.",
   "datePublished": "Jan 10, 2026, 2:42:32 AM",
-  "dateUpdated": "Sep 7, 2026, 12:05:06 PM",
+  "dateUpdated": "Sep 9, 2026, 12:04:42 PM",
   "baseScore": 8.0,
   "baseScoreVersion": "3.1",
   "baseScoreVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
   "references": "https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx\n",
   "aliases": "GHSA-2w69-qvjg-hvjx\nCVE-2026-22029\n",
   "assigner": "GitHub_M",
-  "epss": 0.8,
+  "epss": 0.88,
   "enisaIdProduct": [
     {
       "id": "2d2d79dc-9f66-3651-a6ef-b59e082e7f11",