https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T09:42:16.407800+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2024-avi-0958 certfr-2024-avi-0958 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T09:42:16.635821+00:00 certfr-2024-avi-0958 https://cve.radiocsirt.org/vuln/euvd-2026-162415 EUVD-2026-162415 2026-10-03T09:42:16.635885+00:00 EUVD-2026-162415 https://cve.radiocsirt.org/vuln/fkie_cve-2024-43796 fkie_cve-2024-43796 2026-10-03T09:42:16.635901+00:00

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

 https://cve.radiocsirt.org/vuln/ghsa-qw6h-vgh9-j6wx GHSA-qw6h-vgh9-j6wx — express vulnerable to XSS via response.redirect() 2026-10-03T09:42:16.635931+00:00

Affected: npm: express

### Impact

In express <4.20.0, passing untrusted user input - even after sanitizing it - to `response.redirect()` may execute untrusted code

### Patches

this issue is patched in express 4.20.0

### Workarounds

users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist

### Details

successful exploitation of this vector requires the following:

1. The attacker MUST control the input to response.redirect() 1. express MUST NOT redirect before the template appears 1. the browser MUST NOT complete redirection before: 1. the user MUST click on the link in the template

 https://cve.radiocsirt.org/vuln/msrc_cve-2024-43796 msrc_CVE-2024-43796 — express vulnerable to XSS via response.redirect() 2026-10-03T09:42:16.635966+00:00 msrc_CVE-2024-43796 https://cve.radiocsirt.org/vuln/ncsc-2026-0031 NCSC-2026-0031 — Kwetsbaarheden verholpen in Oracle JD Edwards 2026-10-03T09:42:16.635984+00:00 NCSC-2026-0031 https://cve.radiocsirt.org/vuln/rhba-2024:7523 RHBA-2024:7523 — Red Hat Bug Fix Advisory: Red Hat Developer Hub 1.3.0 release 2026-10-03T09:42:16.636007+00:00

micromatch: vulnerable to Regular Expression Denial of Service braces: fails to limit the number of characters it can handle dset: Prototype Pollution golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses net/http: Denial of service due to improper 100-continue handling in net/http azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity urllib3: proxy-authorization request header is not stripped during cross-origin redirects fast-loops: prototype pollution via objectMergeDeep nodejs-async: Regular expression denial of service while parsing function in autoinject express: Improper Input Handling in Express Redirects serve-static: Improper Sanitization in serve-static

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-43796 UBUNTU-CVE-2024-43796 2026-10-03T09:42:16.636038+00:00

Affected: Ubuntu:Pro:16.04:LTS: node-express, Ubuntu:Pro:18.04:LTS: node-express, Ubuntu:Pro:20.04:LTS: node-express, Ubuntu:Pro:22.04:LTS: node-express, Ubuntu:Pro:24.04:LTS: node-express

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2197 WID-SEC-W-2024-2197 — IBM App Connect Enterprise: Mehrere Schwachstellen ermöglichen Cross-Site Scripting und Server-Side Request Forgery 2026-10-03T09:42:16.636065+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Cross-Site Scripting und Server-Side Request Forgery-Angriff durchzuführen.