https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T22:28:58.358600+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2021-avi-395 certfr-2021-avi-395 — De multiples vulnérabilités ont été découvertes dans IBM Spectrum Control. Certaines d'entre elles permettent à un atta… 2026-10-05T22:28:58.362662+00:00 certfr-2021-avi-395 https://cve.radiocsirt.org/vuln/cnvd-2021-13225 cnvd-2021-13225 2026-10-05T22:28:58.362698+00:00 cnvd-2021-13225 https://cve.radiocsirt.org/vuln/euvd-2026-215956 EUVD-2026-215956 2026-10-05T22:28:58.362713+00:00 EUVD-2026-215956 https://cve.radiocsirt.org/vuln/fkie_cve-2021-26296 fkie_cve-2021-26296 2026-10-05T22:28:58.362724+00:00

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.

 https://cve.radiocsirt.org/vuln/ghsa-gq67-pp9w-43gp GHSA-gq67-pp9w-43gp — Cryptographically weak CSRF tokens in Apache MyFaces 2026-10-05T22:28:58.362751+00:00

Affected: Maven: org.apache.myfaces.core:myfaces-core-module

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.

Mitigation: Existing web.xml configuration parameters can be used to direct MyFaces to use SecureRandom for CSRF token generation:

org.apache.myfaces.RANDOM_KEY_IN_VIEW_STATE_SESSION_TOKEN=secureRandom org.apache.myfaces.RANDOM_KEY_IN_CSRF_SESSION_TOKEN=secureRandom org.apache.myfaces.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN=secureRandom

 https://cve.radiocsirt.org/vuln/gsd-2021-26296 gsd-2021-26296 2026-10-05T22:28:58.362781+00:00 gsd-2021-26296