https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T09:37:28.870011+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-43139 EUVD-2026-43139 2026-10-05T09:37:28.981854+00:00 EUVD-2026-43139 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15720 fkie_cve-2020-15720 2026-10-05T09:37:28.981896+00:00

In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.

 https://cve.radiocsirt.org/vuln/ghsa-hpcm-hcj8-c96c GHSA-hpcm-hcj8-c96c 2026-10-05T09:37:28.981930+00:00

In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.

 https://cve.radiocsirt.org/vuln/gsd-2020-15720 gsd-2020-15720 2026-10-05T09:37:28.981948+00:00 gsd-2020-15720 https://cve.radiocsirt.org/vuln/rhsa-2020:4847 RHSA-2020:4847 — Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update 2026-10-05T09:37:28.981961+00:00

jquery: Cross-site scripting via cross-domain ajax requests bootstrap: XSS in the data-target attribute bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip bootstrap: XSS in the tooltip or popover data-template attribute pki-core: Reflected XSS in 'path length' constraint field in CA's Agent page pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab pki-core: Reflected XSS in getcookies?url= endpoint in CA jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection pki-core: KRA vulnerable to reflected XSS via the getPk12 page tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods pki: Dogtag's python client does not validate certificates pki-core: XSS in the certificate search results tomcat: request mixup

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-15720 UBUNTU-CVE-2020-15720 2026-10-05T09:37:28.982013+00:00

Affected: Ubuntu:Pro:16.04:LTS: dogtag-pki, Ubuntu:Pro:18.04:LTS: dogtag-pki

In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.