https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T01:04:54.648265+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-112103 EUVD-2026-112103 2026-10-03T01:04:54.653514+00:00 EUVD-2026-112103 https://cve.radiocsirt.org/vuln/fkie_cve-2012-3867 fkie_cve-2012-3867 2026-10-03T01:04:54.653554+00:00

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

 https://cve.radiocsirt.org/vuln/ghsa-q44r-f2hm-v76v GHSA-q44r-f2hm-v76v — Pupper does not properly restrict characters in Common Name field of Certificate Signing Request 2026-10-03T01:04:54.653608+00:00

Affected: RubyGems: puppet

`lib/puppet/ssl/certificate_authority.rb` in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

 https://cve.radiocsirt.org/vuln/gsd-2012-3867 gsd-2012-3867 2026-10-03T01:04:54.653637+00:00 gsd-2012-3867 https://cve.radiocsirt.org/vuln/opensuse-su-2024:10581-1 openSUSE-SU-2024:10581-1 — ruby2.2-rubygem-puppet-3.8.7-2.2 on GA media 2026-10-03T01:04:54.653661+00:00

ruby2.2-rubygem-puppet-3.8.7-2.2 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2012:1542 RHSA-2012:1542 — Red Hat Security Advisory: CloudForms Commons 1.1 security update 2026-10-03T01:04:54.653683+00:00

puppet: Filebucket arbitrary file read puppet: Filebucket denial of service puppet: Filebucket arbitrary code execution rubygem-mail: directory traversal rubygem-mail: arbitrary command execution when using exim or sendmail from commandline rubygem-actionpack: Unsafe query generation rubygem-activerecord: SQL injection when processing nested query paramaters rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660) rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than CVE-2012-2661) rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest rubygem-actionpack: potential XSS vulnerability in select_tag prompt rubygem-actionpack: potential XSS vulnerability rubygem-actionpack: XSS Vulnerability in strip_tags puppet: authenticated clients allowed to read arbitrary files from the puppet master puppet: authenticated clients allowed to delete arbitrary files on the puppet master puppet: insufficient validation of agent names in CN of SSL certificate requests