https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T06:11:37.640676+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-02278 bdu:2024-02278 2026-10-03T06:11:37.755209+00:00 bdu:2024-02278 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0337 certfr-2023-avi-0337 — De multiples vulnérabilités ont été découvertes dans les produits <span class="textit">IBM</span>. Elles permettent à u… 2026-10-03T06:11:37.755255+00:00 certfr-2023-avi-0337 https://cve.radiocsirt.org/vuln/euvd-2026-236647 EUVD-2026-236647 2026-10-03T06:11:37.755275+00:00 EUVD-2026-236647 https://cve.radiocsirt.org/vuln/fkie_cve-2022-37865 fkie_cve-2022-37865 2026-10-03T06:11:37.755287+00:00

With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on the local fie system that the user executing Ivy has write access to. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1.

 https://cve.radiocsirt.org/vuln/ghsa-94rr-4jr5-9h2p GHSA-94rr-4jr5-9h2p — Apache Ivy does not verify target path when extracting the archive 2026-10-03T06:11:37.755317+00:00

Affected: Maven: org.apache.ivy:ivy

With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging.

For artifacts using the "zip", "jar" or "war" packaging Ivy prior to version 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on the local fie system that the user executing Ivy has write access to.

Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy version 2.5.1.

 https://cve.radiocsirt.org/vuln/gsd-2022-37865 gsd-2022-37865 2026-10-03T06:11:37.755344+00:00 gsd-2022-37865 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12506-1 openSUSE-SU-2024:12506-1 — apache-ivy-2.5.1-1.1 on GA media 2026-10-03T06:11:37.755356+00:00

apache-ivy-2.5.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2023:2100 RHSA-2023:2100 — Red Hat Security Advisory: Red Hat Integration Camel for Spring Boot 3.20.1 security update 2026-10-03T06:11:37.755372+00:00

apache-commons-net: FTP client trusts the host from PASV response by default undertow: Server identity in https connection is not checked by the undertow client snakeyaml: Denial of Service due to missing nested depth limitation for collections apache-spark: XSS vulnerability in log viewer UI Javascript Pulsar: Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM apache-ivy: Directory Traversal Ivy: Ivy Path traversal batik: Server-Side Request Forgery batik: Server-Side Request Forgery snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode scandium: Failing DTLS handshakes may cause throttling to block processing of records batik: Server-Side Request Forgery (SSRF) vulnerability jettison: memory exhaustion via user-supplied XML or JSON data xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks batik: Apache XML Graphics Batik vulnerable to code execution via SVG JXPath: untrusted XPath expressions may lead to RCE attack hsqldb: Untrusted input may lead to RC…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1021 WID-SEC-W-2023-1021 — Oracle Communications: Mehrere Schwachstellen 2026-10-03T06:11:37.755425+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.