https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T01:50:56.952950+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2024-avi-1051 certfr-2024-avi-1051 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T01:50:57.032748+00:00 certfr-2024-avi-1051 https://cve.radiocsirt.org/vuln/euvd-2026-203095 EUVD-2026-203095 2026-10-03T01:50:57.032798+00:00 EUVD-2026-203095 https://cve.radiocsirt.org/vuln/fkie_cve-2023-49735 fkie_cve-2023-49735 2026-10-03T01:50:57.032813+00:00

** UNSUPPORTED WHEN ASSIGNED **

The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles.

This issue affects Apache Tiles from version 2 onwards.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

 https://cve.radiocsirt.org/vuln/ghsa-qw4h-3xjj-84cc GHSA-qw4h-3xjj-84cc — Apache Tiles: Unvalidated input may lead to path traversal and XXE 2026-10-03T01:50:57.032851+00:00

Affected: Maven: org.apache.tiles:tiles-core, Maven: org.apache.struts:struts-tiles, Maven: struts:struts

The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles.

This issue affects Apache Tiles from version 2 onwards.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

 https://cve.radiocsirt.org/vuln/gsd-2023-49735 gsd-2023-49735 2026-10-03T01:50:57.032883+00:00 gsd-2023-49735 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-49735 UBUNTU-CVE-2023-49735 2026-10-03T01:50:57.032896+00:00

Affected: Ubuntu:16.04:LTS: tiles, Ubuntu:18.04:LTS: tiles, Ubuntu:20.04:LTS: tiles, Ubuntu:22.04:LTS: tiles, Ubuntu:24.04:LTS: tiles, Ubuntu:25.10: tiles, Ubuntu:26.04:LTS: tiles

** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles. This issue affects Apache Tiles from version 2 onwards. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.