https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T15:36:46.922409+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2023-avi-0428 certfr-2023-avi-0428 — De multiples vulnérabilités ont été découvertes dans les produits <span class="textit">Splunk</span>. Certaines d'entre… 2026-10-02T15:36:46.950672+00:00 certfr-2023-avi-0428 https://cve.radiocsirt.org/vuln/cnvd-2020-38875 cnvd-2020-38875 2026-10-02T15:36:46.950723+00:00 cnvd-2020-38875 https://cve.radiocsirt.org/vuln/euvd-2026-38075 EUVD-2026-38075 2026-10-02T15:36:46.950739+00:00 EUVD-2026-38075 https://cve.radiocsirt.org/vuln/fkie_cve-2020-7662 fkie_cve-2020-7662 2026-10-02T15:36:46.950751+00:00

websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

 https://cve.radiocsirt.org/vuln/ghsa-g78m-2chm-r7qv GHSA-g78m-2chm-r7qv — Regular Expression Denial of Service in websocket-extensions (NPM package) 2026-10-02T15:36:46.950781+00:00

Affected: npm: websocket-extensions

### Impact

The ReDoS flaw allows an attacker to exhaust the server's capacity to process incoming requests by sending a WebSocket handshake request containing a header of the following form:

Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...

That is, a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. The parser takes exponential time to reject this header as invalid, and this will block the processing of any other work on the same thread. Thus if you are running a single-threaded server, such a request can render your service completely unavailable.

### Patches

Users should upgrade to version 0.1.4.

### Workarounds

There are no known work-arounds other than disabling any public-facing WebSocket functionality you are operating.

### References

- https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/

 https://cve.radiocsirt.org/vuln/gsd-2020-7662 gsd-2020-7662 2026-10-02T15:36:46.950816+00:00 gsd-2020-7662 https://cve.radiocsirt.org/vuln/rhsa-2020:2796 RHSA-2020:2796 — Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-grafana security update 2026-10-02T15:36:46.950828+00:00

kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser grafana: XSS annotation popup vulnerability grafana: XSS via column.title or cellLinkTooltip grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL grafana: XSS via the OpenTSDB datasource

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1350 WID-SEC-W-2023-1350 — Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern 2026-10-02T15:36:46.950858+00:00

Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise in diversen Komponenten von Drittanbietern ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.