https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T05:10:17.423144+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2022-05511 bdu:2022-05511 2026-10-04T05:10:17.734778+00:00 bdu:2022-05511 https://cve.radiocsirt.org/vuln/bit-solr-2021-28163 BIT-solr-2021-28163 2026-10-04T05:10:17.734830+00:00

Affected: Bitnami: solr

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

 https://cve.radiocsirt.org/vuln/certfr-2021-avi-912 certfr-2021-avi-912 — De multiples vulnérabilités ont été découvertes dans IBM Qradar. Certaines d'entre elles permettent à un attaquant de p… 2026-10-04T05:10:17.734871+00:00 certfr-2021-avi-912 https://cve.radiocsirt.org/vuln/cnvd-2021-27376 cnvd-2021-27376 2026-10-04T05:10:17.734890+00:00 cnvd-2021-27376 https://cve.radiocsirt.org/vuln/euvd-2026-25879 EUVD-2026-25879 2026-10-04T05:10:17.734902+00:00 EUVD-2026-25879 https://cve.radiocsirt.org/vuln/fkie_cve-2021-28163 fkie_cve-2021-28163 2026-10-04T05:10:17.734913+00:00

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

 https://cve.radiocsirt.org/vuln/ghsa-j6qj-j888-vvgq GHSA-j6qj-j888-vvgq — Directory exposure in jetty 2026-10-04T05:10:17.734935+00:00

Affected: Maven: org.eclipse.jetty:jetty-deploy

### Impact If the `${jetty.base}` directory or the `${jetty.base}/webapps` directory is a symlink (soft link in Linux), the contents of the `${jetty.base}/webapps` directory may be deployed as a static web application, exposing the content of the directory for download.

For example, the problem manifests in the following `${jetty.base}`: ```$ tree demo-base/ demo-base/ ├── etc ├── lib ├── resources ├── start.d ├── deploy │   └── async-rest.war └── webapps -> deploy

```

### Workarounds Do not use a symlink

 https://cve.radiocsirt.org/vuln/gsd-2021-28163 gsd-2021-28163 2026-10-04T05:10:17.734967+00:00 gsd-2021-28163 https://cve.radiocsirt.org/vuln/opensuse-su-2021:2005-1 openSUSE-SU-2021:2005-1 — Security update for jetty-minimal 2026-10-04T05:10:17.734979+00:00

Security update for jetty-minimal

 https://cve.radiocsirt.org/vuln/rhsa-2021:1509 RHSA-2021:1509 — Red Hat Security Advisory: rh-eclipse-jetty security update 2026-10-04T05:10:17.734999+00:00

jetty: Symlink directory exposes webapp directory contents jetty: Ambiguous paths can access WEB-INF jetty: Resource exhaustion when receiving an invalid large TLS frame

 https://cve.radiocsirt.org/vuln/suse-su-2021:2005-1 SUSE-SU-2021:2005-1 — Security update for jetty-minimal 2026-10-04T05:10:17.735020+00:00

Security update for jetty-minimal

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-28163 UBUNTU-CVE-2021-28163 2026-10-04T05:10:17.735037+00:00

Affected: Ubuntu:18.04:LTS: equinox-bundles, Ubuntu:20.04:LTS: equinox-bundles, Ubuntu:22.04:LTS: equinox-bundles

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1365 WID-SEC-W-2022-1365 — Eclipse Jetty: Mehrere Schwachstellen 2026-10-04T05:10:17.735060+00:00

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um Informationen offenzulegen und einen Denial of Service Zustand auszulösen.