https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T21:06:37.188609+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 certfr-2026-avi-0556 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-03T21:06:37.278557+00:00 certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/cnvd-2018-20684 cnvd-2018-20684 2026-10-03T21:06:37.278600+00:00 cnvd-2018-20684 https://cve.radiocsirt.org/vuln/euvd-2026-167751 EUVD-2026-167751 2026-10-03T21:06:37.278617+00:00 EUVD-2026-167751 https://cve.radiocsirt.org/vuln/fkie_cve-2018-11796 fkie_cve-2018-11796 2026-10-03T21:06:37.278629+00:00

In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.

 https://cve.radiocsirt.org/vuln/ghsa-h8q5-g2cj-qr5h GHSA-h8q5-g2cj-qr5h — Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack 2026-10-03T21:06:37.278660+00:00

Affected: Maven: org.apache.tika:tika-core

In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.

 https://cve.radiocsirt.org/vuln/gsd-2018-11796 gsd-2018-11796 2026-10-03T21:06:37.278688+00:00 gsd-2018-11796 https://cve.radiocsirt.org/vuln/rhsa-2019:3892 RHSA-2019:3892 — Red Hat Security Advisory: Red Hat Fuse 7.5.0 security update 2026-10-03T21:06:37.278700+00:00

jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) infinispan: deserialization of data in XML and JSON transcoders hadoop: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file tomcat: Host name verification missing in WebSocket client jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis activemq: ActiveMQ Client Missing TLS Hostname Verification tika: Incomplete fix allows for XML entity expansion resulting in denial of service jackson-databind: improper polymorphic deserialization of types from Jodd-db library jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver jackson-databind: arbitrary code execution in slf4j-ext class jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes jackson-databind: exfiltration/XXE in some JDK classes jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class jackson-databind: improper polymorphic deserialization in axis2-transport-jms class jackson-databind: improper polymorphic deserialization in openjpa class jackson-databind: improper polymorphic deserialization in jboss-common-core class retrofit: Directory traversal in RequestBuilder allows manipulation of resources zookeeper: Information disclosure in Apa…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-11796 UBUNTU-CVE-2018-11796 2026-10-03T21:06:37.278765+00:00

Affected: Ubuntu:16.04:LTS: tika, Ubuntu:18.04:LTS: tika, Ubuntu:Pro:20.04:LTS: tika, Ubuntu:Pro:22.04:LTS: tika

In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.