https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:15:34.740492+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certa-2011-avi-504 certa-2011-avi-504 — Plusieurs vulnérabilités de Spring Framework ont été corrigées. Certaines permettent l'exécution de code arbitraire à d… 2026-10-03T11:15:34.778098+00:00 certa-2011-avi-504 https://cve.radiocsirt.org/vuln/euvd-2026-115716 EUVD-2026-115716 2026-10-03T11:15:34.778150+00:00 EUVD-2026-115716 https://cve.radiocsirt.org/vuln/fkie_cve-2011-2730 fkie_cve-2011-2730 2026-10-03T11:15:34.778166+00:00

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."

 https://cve.radiocsirt.org/vuln/ghsa-wv88-pf73-x22p GHSA-wv88-pf73-x22p — Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework 2026-10-03T11:15:34.778200+00:00

Affected: Maven: org.springframework:spring-core

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."

 https://cve.radiocsirt.org/vuln/gsd-2011-2730 gsd-2011-2730 2026-10-03T11:15:34.778232+00:00 gsd-2011-2730 https://cve.radiocsirt.org/vuln/rhsa-2013:0191 RHSA-2013:0191 — Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 update 2026-10-03T11:15:34.778244+00:00

JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing jbossws: Prone to character encoding pattern attack (XML Encryption flaw) jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key Framework: Information (internal server information, classpath, local working directories, session IDs) disclosure CSRF on jmx-console allows invocation of operations on mbeans Console: XSS in invoke operation Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs JBoss invoker servlets do not require authentication JGroups diagnostics service enabled by default with no authentication when a JGroups channel is started apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token JBoss: CallerIdentityLoginModule retaining password from previous call if a null password is provided JBoss: SecurityAssociation.getCredential() will return the previous credential if no security context is provided Web: Bypass of security constraints JBoss: AuthorizationInterceptor allows JMX operation to proceed despite authorization failure