https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T21:00:10.576369+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2020-05622 bdu:2020-05622 2026-10-04T21:00:10.780046+00:00 bdu:2020-05622 https://cve.radiocsirt.org/vuln/bit-activemq-2020-26217 BIT-activemq-2020-26217 — Remote Code Execution in XStream 2026-10-04T21:00:10.780089+00:00

Affected: Bitnami: activemq

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

 https://cve.radiocsirt.org/vuln/certfr-2021-avi-490 certfr-2021-avi-490 — De multiples vulnérabilités ont été découvertes dans IBM Spectrum Protect. Certaines d'entre elles permettent à un atta… 2026-10-04T21:00:10.780126+00:00 certfr-2021-avi-490 https://cve.radiocsirt.org/vuln/cnvd-2020-63975 cnvd-2020-63975 2026-10-04T21:00:10.780143+00:00 cnvd-2020-63975 https://cve.radiocsirt.org/vuln/euvd-2026-45982 EUVD-2026-45982 2026-10-04T21:00:10.780155+00:00 EUVD-2026-45982 https://cve.radiocsirt.org/vuln/fkie_cve-2020-26217 fkie_cve-2020-26217 2026-10-04T21:00:10.780165+00:00

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

 https://cve.radiocsirt.org/vuln/ghsa-mw36-7c6c-q4q2 GHSA-mw36-7c6c-q4q2 — XStream can be used for Remote Code Execution 2026-10-04T21:00:10.780188+00:00

Affected: Maven: com.thoughtworks.xstream:xstream

### Impact The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.

### Patches If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.14.

### Workarounds No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.

Users of XStream 1.4.13 or below who still want to use XStream default blacklist can use a workaround depending on their version in use.

Users of XStream 1.4.13 can simply add two lines to XStream's setup code: ```Java xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class }); ``` Users of XStream 1.4.12 to 1.4.7 who want to use XStream with a black list will have to setup such a list from scratch and deny at least the following types: _javax.imageio.ImageIO$ContainsFilter_, _java.beans.EventHandler_, _java.lang.ProcessBuilder_, _java.lang.Void_ and _void_. ```Java xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class }); ``` Users of XStream 1.4…

 https://cve.radiocsirt.org/vuln/gsd-2020-26217 gsd-2020-26217 2026-10-04T21:00:10.780233+00:00 gsd-2020-26217 https://cve.radiocsirt.org/vuln/opensuse-su-2021:0140-1 openSUSE-SU-2021:0140-1 — Security update for xstream 2026-10-04T21:00:10.780245+00:00

Security update for xstream

 https://cve.radiocsirt.org/vuln/rhsa-2021:0105 RHSA-2021:0105 — Red Hat Security Advisory: Red Hat Process Automation Manager 7.9.1 security update 2026-10-04T21:00:10.780264+00:00

XStream: remote code execution due to insecure XML deserialization when relying on blocklists

 https://cve.radiocsirt.org/vuln/suse-su-2021:0176-1 SUSE-SU-2021:0176-1 — Security update for xstream 2026-10-04T21:00:10.780279+00:00

Security update for xstream

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-26217 UBUNTU-CVE-2020-26217 2026-10-04T21:00:10.780293+00:00

Affected: Ubuntu:Pro:14.04:LTS: libxstream-java, Ubuntu:Pro:16.04:LTS: libxstream-java, Ubuntu:18.04:LTS: libxstream-java, Ubuntu:20.04:LTS: libxstream-java

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0094 WID-SEC-W-2024-0094 — Atlassian Bamboo: Mehrere Schwachstellen 2026-10-04T21:00:10.780318+00:00

Ein entfernter Angreifer kann mehrere Schwachstellen in Atlassian Bamboo ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder einen Request Smuggling-Angriff durchzuführen.