https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:47:55.410241+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-115544 EUVD-2026-115544 2026-10-03T03:47:55.469673+00:00 EUVD-2026-115544 https://cve.radiocsirt.org/vuln/fkie_cve-2011-2487 fkie_cve-2011-2487 2026-10-03T03:47:55.469721+00:00

The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.

 https://cve.radiocsirt.org/vuln/ghsa-4qqf-hmv6-r6wh GHSA-4qqf-hmv6-r6wh — Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J 2026-10-03T03:47:55.469755+00:00

Affected: Maven: org.apache.ws.security:wss4j, Maven: wss4j:wss4j

The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.

 https://cve.radiocsirt.org/vuln/gsd-2011-2487 gsd-2011-2487 2026-10-03T03:47:55.469783+00:00 gsd-2011-2487 https://cve.radiocsirt.org/vuln/rhsa-2013:0191 RHSA-2013:0191 — Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 update 2026-10-03T03:47:55.469796+00:00

JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing jbossws: Prone to character encoding pattern attack (XML Encryption flaw) jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key Framework: Information (internal server information, classpath, local working directories, session IDs) disclosure CSRF on jmx-console allows invocation of operations on mbeans Console: XSS in invoke operation Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs JBoss invoker servlets do not require authentication JGroups diagnostics service enabled by default with no authentication when a JGroups channel is started apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token JBoss: CallerIdentityLoginModule retaining password from previous call if a null password is provided JBoss: SecurityAssociation.getCredential() will return the previous credential if no security context is provided Web: Bypass of security constraints JBoss: AuthorizationInterceptor allows JMX operation to proceed despite authorization failure