https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T10:01:15.389021+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2022-00278 bdu:2022-00278 2026-10-04T10:01:15.774387+00:00 bdu:2022-00278 https://cve.radiocsirt.org/vuln/certfr-2022-avi-928 certfr-2022-avi-928 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-04T10:01:15.774442+00:00 certfr-2022-avi-928 https://cve.radiocsirt.org/vuln/euvd-2026-215921 EUVD-2026-215921 2026-10-04T10:01:15.774462+00:00 EUVD-2026-215921 https://cve.radiocsirt.org/vuln/fkie_cve-2020-13936 fkie_cve-2020-13936 2026-10-04T10:01:15.774475+00:00

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

 https://cve.radiocsirt.org/vuln/ghsa-59j4-wjwp-mw9m GHSA-59j4-wjwp-mw9m — Sandbox Bypass in Apache Velocity Engine 2026-10-04T10:01:15.774505+00:00

Affected: Maven: org.apache.velocity:velocity-engine-parent, Maven: org.apache.velocity:velocity

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

 https://cve.radiocsirt.org/vuln/gsd-2020-13936 gsd-2020-13936 2026-10-04T10:01:15.774532+00:00 gsd-2020-13936 https://cve.radiocsirt.org/vuln/oesa-2021-1157 OESA-2021-1157 — velocity security update 2026-10-04T10:01:15.774544+00:00

Affected: openEuler:20.03-LTS-SP1: velocity

Velocity is a Java-based template engine. It permits anyone to use the simple yet powerful template language to reference objects defined in Java code. Security Fix(es): An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.(CVE-2020-13936)

 https://cve.radiocsirt.org/vuln/opensuse-su-2021:0447-1 openSUSE-SU-2021:0447-1 — Security update for velocity 2026-10-04T10:01:15.774566+00:00

Security update for velocity

 https://cve.radiocsirt.org/vuln/rhsa-2021:2046 RHSA-2021:2046 — Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.7 security update on RHEL 6 2026-10-04T10:01:15.774585+00:00

velocity: arbitrary code execution when attacker is able to modify templates netty: Information disclosure via the local system temporary directory netty: possible request smuggling in HTTP/2 due missing validation

 https://cve.radiocsirt.org/vuln/suse-su-2021:0800-1 SUSE-SU-2021:0800-1 — Security update for velocity 2026-10-04T10:01:15.774606+00:00

Security update for velocity

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-13936 UBUNTU-CVE-2020-13936 2026-10-04T10:01:15.774621+00:00

Affected: Ubuntu:Pro:16.04:LTS: velocity, Ubuntu:Pro:18.04:LTS: velocity, Ubuntu:20.04:LTS: velocity

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0809 WID-SEC-W-2023-0809 — IBM QRadar SIEM: Mehrere Schwachstellen 2026-10-04T10:01:15.774643+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Informationen falsch darzustellen, einen Denial of Service Zustand herbeizuführen, Sicherheitsvorkehrungen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen oder unbekannte Auswirkungen zu verursachen.