https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T13:43:12.212344+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2024:9413 ALSA-2024:9413 — Moderate: bluez security update 2026-10-03T13:43:12.327549+00:00

Affected: AlmaLinux:9: bluez, AlmaLinux:9: bluez-cups, AlmaLinux:9: bluez-libs, AlmaLinux:9: bluez-libs-devel, AlmaLinux:9: bluez-obexd

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files.

Security Fix(es):

* bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866) * BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596) * bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594) * bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592) * bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589) * bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580) * bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information,…

 https://cve.radiocsirt.org/vuln/bdu:2024-01454 bdu:2024-01454 2026-10-03T13:43:12.327624+00:00 bdu:2024-01454 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0855 certfr-2025-avi-0855 — De multiples vulnérabilités ont été découvertes dans les produits Juniper Networks. Certaines d'entre elles permettent… 2026-10-03T13:43:12.327642+00:00 certfr-2025-avi-0855 https://cve.radiocsirt.org/vuln/euvd-2026-258818 EUVD-2026-258818 2026-10-03T13:43:12.327658+00:00 EUVD-2026-258818 https://cve.radiocsirt.org/vuln/fkie_cve-2023-27349 fkie_cve-2023-27349 2026-10-03T13:43:12.327668+00:00

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

 https://cve.radiocsirt.org/vuln/ghsa-r3vg-5hjq-528v GHSA-r3vg-5hjq-528v 2026-10-03T13:43:12.327693+00:00

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

 https://cve.radiocsirt.org/vuln/gsd-2023-27349 gsd-2023-27349 2026-10-03T13:43:12.327710+00:00 gsd-2023-27349 https://cve.radiocsirt.org/vuln/oesa-2023-1249 OESA-2023-1249 — bluez security update 2026-10-03T13:43:12.327720+00:00

Affected: openEuler:20.03-LTS-SP1: bluez, openEuler:20.03-LTS-SP3: bluez, openEuler:22.03-LTS: bluez, openEuler:22.03-LTS-SP1: bluez

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fix(es): (CVE-2023-27349)

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13128-1 openSUSE-SU-2024:13128-1 — bluez-5.68-2.1 on GA media 2026-10-03T13:43:12.327743+00:00

bluez-5.68-2.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2023:2533-1 SUSE-SU-2023:2533-1 — Security update for bluez 2026-10-03T13:43:12.327760+00:00

Security update for bluez

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-27349 UBUNTU-CVE-2023-27349 2026-10-03T13:43:12.327781+00:00

Affected: Ubuntu:Pro:16.04:LTS: bluez, Ubuntu:Pro:18.04:LTS: bluez, Ubuntu:20.04:LTS: bluez, Ubuntu:22.04:LTS: bluez

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1020 WID-SEC-W-2024-1020 — bluez: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes 2026-10-03T13:43:12.327805+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in bluez ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.