https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:48:15.687023+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2020-05183 bdu:2020-05183 2026-10-02T11:48:15.695241+00:00 bdu:2020-05183 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 certfr-2026-avi-0556 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-02T11:48:15.695273+00:00 certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/cnvd-2020-00500 cnvd-2020-00500 2026-10-02T11:48:15.695292+00:00 cnvd-2020-00500 https://cve.radiocsirt.org/vuln/euvd-2026-256155 EUVD-2026-256155 2026-10-02T11:48:15.695306+00:00 EUVD-2026-256155 https://cve.radiocsirt.org/vuln/fkie_cve-2019-17558 fkie_cve-2019-17558 2026-10-02T11:48:15.695316+00:00

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).

 https://cve.radiocsirt.org/vuln/ghsa-ww97-9w65-2crx GHSA-ww97-9w65-2crx — Improper Input Validation in Apache Solr 2026-10-02T11:48:15.695346+00:00

Affected: Maven: org.apache.solr:solr-core

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).

 https://cve.radiocsirt.org/vuln/gsd-2019-17558 gsd-2019-17558 2026-10-02T11:48:15.695373+00:00 gsd-2019-17558 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-17558 Withdrawn: UBUNTU-CVE-2019-17558 2026-10-02T11:48:15.695385+00:00

Withdrawn by the publisher.

Affected: Ubuntu:Pro:14.04:LTS: lucene-solr, Ubuntu:Pro:16.04:LTS: lucene-solr, Ubuntu:Pro:18.04:LTS: lucene-solr, Ubuntu:20.04:LTS: lucene-solr, Ubuntu:22.04:LTS: lucene-solr, Ubuntu:24.10: lucene-solr, Ubuntu:24.04:LTS: lucene-solr

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1048 WID-SEC-W-2023-1048 — Oracle Construction and Engineering: Mehrere Schwachstellen 2026-10-02T11:48:15.695414+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Construction and Engineering ausnutzen, um die Verfügbarkeit, Vertraulichkeit und Integrität zu gefährden.