https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T18:41:10.163323+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-25034 EUVD-2026-25034 2026-10-02T18:41:10.308791+00:00 EUVD-2026-25034 https://cve.radiocsirt.org/vuln/fkie_cve-2021-26540 fkie_cve-2021-26540 2026-10-02T18:41:10.308831+00:00

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".

 https://cve.radiocsirt.org/vuln/ghsa-mjxr-4v3x-q3m4 GHSA-mjxr-4v3x-q3m4 — Improper Input Validation in sanitize-html 2026-10-02T18:41:10.308866+00:00

Affected: npm: sanitize-html

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".

 https://cve.radiocsirt.org/vuln/gsd-2021-26540 gsd-2021-26540 2026-10-02T18:41:10.308891+00:00 gsd-2021-26540 https://cve.radiocsirt.org/vuln/rhsa-2021:2438 RHSA-2021:2438 — Red Hat Security Advisory: OpenShift Container Platform 4.8.2 bug fix and security update 2026-10-02T18:41:10.308903+00:00

SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) nodejs-y18n: prototype pollution vulnerability etcd: Large slice causes panic in decodeRecord method etcd: DoS in wal/wal.go etcd: directories created via os.MkdirAll are not checked for permissions etcd: gateway can include itself as an endpoint resulting in resource exhaustion and leads to DoS etcd: no authentication is performed against endpoints provided in the --endpoints flag jwt-go: access restriction bypass vulnerability nodejs-glob-parent: Regular expression denial of service nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag golang: crypto/elliptic: incorrect operations on the P-224 curve gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation containernetworking-cni: Arbitrary path injection via type field in CNI configuration fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise containers/storage: DoS via malicious image go.elastic.co/apm: leaks sensitive HTTP headers during panic nodejs-lodash: command injection via template nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() nodejs-postcss: Regular expression denial of service during source map parsing nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js sanitize-html: improper handling of internationali…