https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T13:05:17.838212+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2021:3623 ALSA-2021:3623 — Important: nodejs:12 security and bug fix update 2026-10-02T13:05:17.893232+00:00

Affected: AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: npm

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)

* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)

* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)

* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)

* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)

 https://cve.radiocsirt.org/vuln/bdu:2022-01892 bdu:2022-01892 2026-10-02T13:05:17.893324+00:00 bdu:2022-01892 https://cve.radiocsirt.org/vuln/bell-cve-2021-22931 Withdrawn: BELL-CVE-2021-22931 — CVE-2021-22931 does not affect BellSoft software 2026-10-02T13:05:17.893341+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/bit-node-2021-22931 BIT-node-2021-22931 2026-10-02T13:05:17.893358+00:00

Affected: Bitnami: node

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

 https://cve.radiocsirt.org/vuln/certfr-2021-avi-670 certfr-2021-avi-670 — De multiples vulnérabilités ont été découvertes dans les produits Elastic. Elles permettent à un attaquant de provoquer… 2026-10-02T13:05:17.893379+00:00 certfr-2021-avi-670 https://cve.radiocsirt.org/vuln/cleanstart-2026-bd71263 Withdrawn: CLEANSTART-2026-BD71263 — Security fixes for CVE-2017-14919, CVE-2017-15896, CVE-2018-0734, CVE-2018-0735, CVE-2018-1000168, CVE-2018-12121, CVE-… 2026-10-02T13:05:17.893395+00:00

Withdrawn by the publisher.

Affected: CleanStart: nodejs

Multiple security vulnerabilities affect the nodejs package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-236167 EUVD-2026-236167 2026-10-02T13:05:17.893419+00:00 EUVD-2026-236167 https://cve.radiocsirt.org/vuln/fkie_cve-2021-22931 fkie_cve-2021-22931 2026-10-02T13:05:17.893430+00:00

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

 https://cve.radiocsirt.org/vuln/fsa-202302 FSA-202302 — Festo: Several vulnerabilities in FactoryViews 2026-10-02T13:05:17.893451+00:00

FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications.

FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities.

At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.

 https://cve.radiocsirt.org/vuln/ghsa-7r9p-c88x-w357 GHSA-7r9p-c88x-w357 2026-10-02T13:05:17.893561+00:00

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

 https://cve.radiocsirt.org/vuln/gsd-2021-22931 gsd-2021-22931 2026-10-02T13:05:17.893576+00:00 gsd-2021-22931 https://cve.radiocsirt.org/vuln/icsa-22-069-09 ICSA-22-069-09 — Siemens SINEC INS 2026-10-02T13:05:17.893587+00:00

SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c. Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage. lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact. SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements. pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled. flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results). SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling. zipfileUpdate in ext/misc/zipfile.c in SQLite…

 https://cve.radiocsirt.org/vuln/msrc_cve-2021-22931 msrc_CVE-2021-22931 — Node.js before 16.6.0 14.17.4 and 12.22.4 is vulnerable to Remote Code Execution XSS Application crashes due to missing… 2026-10-02T13:05:17.893847+00:00 msrc_CVE-2021-22931 https://cve.radiocsirt.org/vuln/opensuse-su-2021:1214-1 openSUSE-SU-2021:1214-1 — Security update for nodejs12 2026-10-02T13:05:17.893865+00:00

Security update for nodejs12

 https://cve.radiocsirt.org/vuln/rhsa-2021:3280 RHSA-2021:3280 — Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update 2026-10-02T13:05:17.893881+00:00

nodejs-ini: Prototype pollution via malicious INI file nodejs-glob-parent: Regular expression denial of service c-ares: Missing input validation of host names may lead to domain hijacking nodejs: Use-after-free on close http2 on stream canceling nodejs: Improper handling of untypical characters in domain names nodejs: Incomplete validation of tls rejectUnauthorized parameter nodejs: Use-after-free on close http2 on stream canceling nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite

 https://cve.radiocsirt.org/vuln/suse-su-2021:2823-1 SUSE-SU-2021:2823-1 — Security update for nodejs10 2026-10-02T13:05:17.893911+00:00

Security update for nodejs10

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-22931 Withdrawn: UBUNTU-CVE-2021-22931 2026-10-02T13:05:17.893926+00:00

Withdrawn by the publisher.

Affected: Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs, Ubuntu:20.04:LTS: nodejs, Ubuntu:22.04:LTS: nodejs

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0029 WID-SEC-W-2022-0029 — Elasticsearch und Kibana: Mehrere Schwachstellen 2026-10-02T13:05:17.893952+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Elasticsearch und Kibana ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen und um Administratorrechte zu erlangen.