https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T17:34:16.192975+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2020:4670 ALSA-2020:4670 — Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update 2026-10-02T17:34:16.283847+00:00

Affected: AlmaLinux:8: custodia, AlmaLinux:8: python3-custodia, AlmaLinux:8: python3-jwcrypto, AlmaLinux:8: python3-kdcproxy, AlmaLinux:8: python3-pyusb, AlmaLinux:8: python3-qrcode, AlmaLinux:8: python3-qrcode-core, AlmaLinux:8: python3-yubico

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

The following packages have been upgraded to a later upstream version: ipa (4.8.7), softhsm (2.6.0), opendnssec (2.1.6). (BZ#1759888, BZ#1818765, BZ#1818877)

Security Fix(es):

* js-jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

* bootstrap: XSS in the data-target attribute (CVE-2016-10735)

* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

* bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

* bootstrap: XSS in the tooltip data-viewport attribute (CVE-2018-20676)

* bootstrap: XSS in the affix configuration target property (CVE-2018-20677)

* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

* js-jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)

* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

* ipa: No password length restriction leads to denial of service (CVE-2020-1722)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information o…

 https://cve.radiocsirt.org/vuln/cnvd-2021-26417 cnvd-2021-26417 2026-10-02T17:34:16.283944+00:00 cnvd-2021-26417 https://cve.radiocsirt.org/vuln/euvd-2026-35567 EUVD-2026-35567 2026-10-02T17:34:16.283963+00:00 EUVD-2026-35567 https://cve.radiocsirt.org/vuln/fkie_cve-2020-1722 fkie_cve-2020-1722 2026-10-02T17:34:16.283977+00:00

A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability.

 https://cve.radiocsirt.org/vuln/ghsa-mvj3-pw74-8w47 GHSA-mvj3-pw74-8w47 2026-10-02T17:34:16.284002+00:00

A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability.

 https://cve.radiocsirt.org/vuln/gsd-2020-1722 gsd-2020-1722 2026-10-02T17:34:16.284020+00:00 gsd-2020-1722 https://cve.radiocsirt.org/vuln/rhsa-2020:3936 RHSA-2020:3936 — Red Hat Security Advisory: ipa security, bug fix, and enhancement update 2026-10-02T17:34:16.284031+00:00

jquery: Cross-site scripting via cross-domain ajax requests bootstrap: XSS in the data-target attribute bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip bootstrap: XSS in the tooltip data-viewport attribute bootstrap: XSS in the affix configuration target property bootstrap: XSS in the tooltip or popover data-template attribute jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection ipa: No password length restriction leads to denial of service jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method

 https://cve.radiocsirt.org/vuln/rhsa-2020:4670 RHSA-2020:4670 — Red Hat Security Advisory: idm:DL1 and idm:client security, bug fix, and enhancement update 2026-10-02T17:34:16.284067+00:00

jquery: Cross-site scripting via cross-domain ajax requests bootstrap: XSS in the data-target attribute bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip bootstrap: XSS in the tooltip data-viewport attribute bootstrap: XSS in the affix configuration target property bootstrap: XSS in the tooltip or popover data-template attribute jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection ipa: No password length restriction leads to denial of service jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-1722 UBUNTU-CVE-2020-1722 2026-10-02T17:34:16.284101+00:00

Affected: Ubuntu:Pro:14.04:LTS: freeipa, Ubuntu:Pro:16.04:LTS: freeipa, Ubuntu:18.04:LTS: freeipa, Ubuntu:20.04:LTS: freeipa, Ubuntu:22.04:LTS: freeipa, Ubuntu:24.04:LTS: freeipa, Ubuntu:25.10: freeipa, Ubuntu:26.04:LTS: freeipa

A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability.