https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T02:45:30.869647+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2022-05510 bdu:2022-05510 2026-10-04T02:45:31.076954+00:00 bdu:2022-05510 https://cve.radiocsirt.org/vuln/certfr-2021-avi-951 certfr-2021-avi-951 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de RedHat. Certaines d'entre elles permettent à un… 2026-10-04T02:45:31.077005+00:00 certfr-2021-avi-951 https://cve.radiocsirt.org/vuln/cnvd-2021-27374 cnvd-2021-27374 2026-10-04T02:45:31.077024+00:00 cnvd-2021-27374 https://cve.radiocsirt.org/vuln/euvd-2026-25867 EUVD-2026-25867 2026-10-04T02:45:31.077036+00:00 EUVD-2026-25867 https://cve.radiocsirt.org/vuln/fkie_cve-2021-28164 fkie_cve-2021-28164 2026-10-04T02:45:31.077047+00:00

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

 https://cve.radiocsirt.org/vuln/ghsa-v7ff-8wcx-gmc5 GHSA-v7ff-8wcx-gmc5 — Authorization Before Parsing and Canonicalization in jetty 2026-10-04T02:45:31.077075+00:00

Affected: Maven: org.eclipse.jetty:jetty-webapp

Release 9.4.37 introduced a more precise implementation of [RFC3986](https://tools.ietf.org/html/rfc3986#section-3.3) with regards to URI decoding, together with some new compliance modes to optionally allow support of some URI that may have ambiguous interpretation within the Servlet specified API methods behaviours. The default mode allowed % encoded . characters to be excluded for URI normalisation, which is correct by the RFC, but is not assumed by common Servlet implementations. The default compliance mode allows requests with URIs that contain `%2e` or `%2e%2e` segments to access protected resources within the `WEB-INF` directory. For example a request to `/context/%2e/WEB-INF/web.xml` can retrieve the `web.xml` file. This can reveal sensitive information regarding the implementation of a web application. Workarounds found by HttpCompliance mode RFC7230_NO_AMBIGUOUS_URIS can be enabled by updating `start.d/http.ini` to include: jetty.http.compliance=RFC7230_NO_AMBIGUOUS_URIS.

 https://cve.radiocsirt.org/vuln/gsd-2021-28164 gsd-2021-28164 2026-10-04T02:45:31.077103+00:00 gsd-2021-28164 https://cve.radiocsirt.org/vuln/opensuse-su-2021:2005-1 openSUSE-SU-2021:2005-1 — Security update for jetty-minimal 2026-10-04T02:45:31.077115+00:00

Security update for jetty-minimal

 https://cve.radiocsirt.org/vuln/rhsa-2021:1509 RHSA-2021:1509 — Red Hat Security Advisory: rh-eclipse-jetty security update 2026-10-04T02:45:31.077134+00:00

jetty: Symlink directory exposes webapp directory contents jetty: Ambiguous paths can access WEB-INF jetty: Resource exhaustion when receiving an invalid large TLS frame

 https://cve.radiocsirt.org/vuln/suse-su-2021:2005-1 SUSE-SU-2021:2005-1 — Security update for jetty-minimal 2026-10-04T02:45:31.077152+00:00

Security update for jetty-minimal

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-28164 UBUNTU-CVE-2021-28164 2026-10-04T02:45:31.077168+00:00

Affected: Ubuntu:18.04:LTS: equinox-bundles, Ubuntu:20.04:LTS: equinox-bundles, Ubuntu:22.04:LTS: equinox-bundles

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1365 WID-SEC-W-2022-1365 — Eclipse Jetty: Mehrere Schwachstellen 2026-10-04T02:45:31.077191+00:00

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um Informationen offenzulegen und einen Denial of Service Zustand auszulösen.