https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:30:39.011136+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2023:2487 ALSA-2023:2487 — Moderate: fwupd security and bug fix update 2026-10-02T19:30:39.023005+00:00

Affected: AlmaLinux:9: fwupd, AlmaLinux:9: fwupd-devel, AlmaLinux:9: fwupd-plugin-flashrom

The fwupd packages provide a service that allows session software to update device firmware.

Security Fix(es):

* fwupd: world readable password in /etc/fwupd/redfish.conf (CVE-2022-3287) * shim: 3rd party shim allow secure boot bypass (CVE-2022-34301) * shim: 3rd party shim allow secure boot bypass (CVE-2022-34302) * shim: 3rd party shim allow secure boot bypass (CVE-2022-34303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/bdu:2024-06519 bdu:2024-06519 2026-10-02T19:30:39.023089+00:00 bdu:2024-06519 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0579 certfr-2024-avi-0579 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-02T19:30:39.023112+00:00 certfr-2024-avi-0579 https://cve.radiocsirt.org/vuln/euvd-2026-240525 EUVD-2026-240525 2026-10-02T19:30:39.023138+00:00 EUVD-2026-240525 https://cve.radiocsirt.org/vuln/fkie_cve-2022-3287 fkie_cve-2022-3287 2026-10-02T19:30:39.023156+00:00

When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.

 https://cve.radiocsirt.org/vuln/ghsa-7qqr-wwjq-98v6 GHSA-7qqr-wwjq-98v6 2026-10-02T19:30:39.023189+00:00

When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.

 https://cve.radiocsirt.org/vuln/gsd-2022-3287 gsd-2022-3287 2026-10-02T19:30:39.023231+00:00 gsd-2022-3287 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12438-1 openSUSE-SU-2024:12438-1 — dfu-tool-1.8.6-1.1 on GA media 2026-10-02T19:30:39.023249+00:00

dfu-tool-1.8.6-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2024:1106 RHSA-2024:1106 — Red Hat Security Advisory: fwupd security update 2026-10-02T19:30:39.023268+00:00

fwupd: world readable password in /etc/fwupd/redfish.conf

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-3287 UBUNTU-CVE-2022-3287 2026-10-02T19:30:39.023284+00:00

Affected: Ubuntu:20.04:LTS: fwupd, Ubuntu:22.04:LTS: fwupd

When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1185 WID-SEC-W-2023-1185 — Red Hat Enterprise Linux: Mehrere Schwachstellen 2026-10-02T19:30:39.023304+00:00

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, seine Privilegien zu erweitern und Daten zu manipulieren.