https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:48:33.181013+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2018-05482 cnvd-2018-05482 2026-10-02T19:48:33.339511+00:00 cnvd-2018-05482 https://cve.radiocsirt.org/vuln/euvd-2026-177779 EUVD-2026-177779 2026-10-02T19:48:33.339553+00:00 EUVD-2026-177779 https://cve.radiocsirt.org/vuln/fkie_cve-2017-10689 fkie_cve-2017-10689 2026-10-02T19:48:33.339569+00:00

In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-vw22-465p-8j5w GHSA-vw22-465p-8j5w — Tarball permission preservation in puppet 2026-10-02T19:48:33.339602+00:00

Affected: RubyGems: puppet

When installing a module using the system tar, the PMT will filter filesystem permissions to a sane value. This may just be based on the user's umask.

When using minitar, files are unpacked with whatever permissions are in the tarball. This is potentially unsafe, as tarballs can be easily created with weird permissions.

 https://cve.radiocsirt.org/vuln/gsd-2017-10689 gsd-2017-10689 2026-10-02T19:48:33.339632+00:00 gsd-2017-10689 https://cve.radiocsirt.org/vuln/rhsa-2018:2927 RHSA-2018:2927 — Red Hat Security Advisory: Satellite 6.4 security, bug fix, and enhancement update 2026-10-02T19:48:33.339645+00:00

bouncycastle: Information disclosure in GCMBlockCipher bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data bouncycastle: Information leak in AESFastEngine class bouncycastle: Carry propagation bug in math.raw.Nat??? class bouncycastle: Information exposure in DSA signature generation via timing attack bouncycastle: ECDSA improper validation of ASN.1 encoding of signature bouncycastle: DSA key pair generator generates a weak private key by default bouncycastle: DHIES implementation allowed the use of ECB mode bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack bouncycastle: Other party DH public keys are not fully validated bouncycastle: ECIES implementation allowed the use of ECB mode logback: Serialization vulnerability in SocketServer and ServerSocketReceiver python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs hibernate-validator: Privilege escalation when running under the security manager puppet: Unpacking of tarballs in tar/mini.rb can create files with insecure permissions puppet: Environment leakage in puppet-agent 6: XSS in discovery rule filter autocomplete functionality jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) foreman: Stored XSS in fact name or value pulp: sensitive credentials revealed through the API foreman: SQL injection due to improper handling of the widget…

 https://cve.radiocsirt.org/vuln/suse-su-2018:0571-1 SUSE-SU-2018:0571-1 — Security update for puppet 2026-10-02T19:48:33.339719+00:00

Security update for puppet

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-10689 UBUNTU-CVE-2017-10689 2026-10-02T19:48:33.339737+00:00

Affected: Ubuntu:14.04:LTS: puppet, Ubuntu:Pro:16.04:LTS: puppet

In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.