https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:36:40.777195+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-113176 EUVD-2026-113176 2026-10-03T03:36:40.835590+00:00 EUVD-2026-113176 https://cve.radiocsirt.org/vuln/fkie_cve-2012-5575 fkie_cve-2012-5575 2026-10-03T03:36:40.835636+00:00

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."

 https://cve.radiocsirt.org/vuln/ghsa-7v5v-9v8r-w864 GHSA-7v5v-9v8r-w864 — Inadequate Encryption Strength in Apache CXF 2026-10-03T03:36:40.835684+00:00

Affected: Maven: org.apache.cxf:cxf-rt-transports-http

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."

 https://cve.radiocsirt.org/vuln/gsd-2012-5575 gsd-2012-5575 2026-10-03T03:36:40.835725+00:00 gsd-2012-5575 https://cve.radiocsirt.org/vuln/rhsa-2013:0833 RHSA-2013:0833 — Red Hat Security Advisory: JBoss Enterprise Application Platform 6.1.0 update 2026-10-03T03:36:40.835739+00:00

Web: jsessionid exposed via encoded url when using cookie based session tracking JBoss: custom authorization module implementations shared between applications apache-cxf: XML encryption backwards compatibility attacks openssl: DoS due to improper handling of OCSP response verification SSL/TLS: CBC padding timing attack (lucky-13) Installer: Generated auto-install xml is world readable tomcat: Session fixation in form authenticator