https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T09:55:37.041276+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 certfr-2026-avi-0556 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-03T09:55:37.046575+00:00 certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/cnvd-2018-10139 cnvd-2018-10139 2026-10-03T09:55:37.046608+00:00 cnvd-2018-10139 https://cve.radiocsirt.org/vuln/euvd-2026-184803 EUVD-2026-184803 2026-10-03T09:55:37.046624+00:00 EUVD-2026-184803 https://cve.radiocsirt.org/vuln/fkie_cve-2018-1335 fkie_cve-2018-1335 2026-10-03T09:55:37.046635+00:00

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.

 https://cve.radiocsirt.org/vuln/ghsa-9r24-gp44-h3pm GHSA-9r24-gp44-h3pm — Command injection in org.apache.tika:tika-core 2026-10-03T09:55:37.046661+00:00

Affected: Maven: org.apache.tika:tika-core

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.

 https://cve.radiocsirt.org/vuln/gsd-2018-1335 gsd-2018-1335 2026-10-03T09:55:37.046684+00:00 gsd-2018-1335 https://cve.radiocsirt.org/vuln/rhsa-2019:3140 RHSA-2019:3140 — Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.4.8 security update 2026-10-03T09:55:37.046695+00:00

thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis thrift: Improper Access Control grants access to files outside the webservers docroot path jackson-databind: improper polymorphic deserialization of types from Jodd-db library jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver jackson-databind: arbitrary code execution in slf4j-ext class jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes jackson-databind: improper polymorphic deserialization in axis2-transport-jms class jackson-databind: improper polymorphic deserialization in openjpa class jackson-databind: improper polymorphic deserialization in jboss-common-core class zookeeper: Information disclosure in Apache ZooKeeper

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-1335 UBUNTU-CVE-2018-1335 2026-10-03T09:55:37.046724+00:00

Affected: Ubuntu:25.10: tika, Ubuntu:26.04:LTS: tika

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.