https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:59:50.945725+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2024-avi-0958 certfr-2024-avi-0958 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T11:59:51.376730+00:00 certfr-2024-avi-0958 https://cve.radiocsirt.org/vuln/euvd-2026-257735 EUVD-2026-257735 2026-10-03T11:59:51.376808+00:00 EUVD-2026-257735 https://cve.radiocsirt.org/vuln/fkie_cve-2024-43799 fkie_cve-2024-43799 2026-10-03T11:59:51.376824+00:00

Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.

 https://cve.radiocsirt.org/vuln/ghsa-m6fv-jmcg-4jfg GHSA-m6fv-jmcg-4jfg — send vulnerable to template injection that can lead to XSS 2026-10-03T11:59:51.376855+00:00

Affected: npm: send

### Impact

passing untrusted user input - even after sanitizing it - to `SendStream.redirect()` may execute untrusted code

### Patches

this issue is patched in send 0.19.0

### Workarounds

users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist

### Details

successful exploitation of this vector requires the following:

1. The attacker MUST control the input to response.redirect() 1. express MUST NOT redirect before the template appears 1. the browser MUST NOT complete redirection before: 1. the user MUST click on the link in the template

 https://cve.radiocsirt.org/vuln/msrc_cve-2024-43799 msrc_CVE-2024-43799 — send vulnerable to template injection that can lead to XSS 2026-10-03T11:59:51.376888+00:00 msrc_CVE-2024-43799 https://cve.radiocsirt.org/vuln/rhba-2024:10184 RHBA-2024:10184 — Red Hat Bug Fix Advisory: Red Hat Developer Hub 1.2.5 bugfix release 2026-10-03T11:59:51.376906+00:00

browserify-sign: upper bound check issue in dsaVerify leads to a signature forgery attack send: Code Execution Vulnerability in Send Library

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-43799 UBUNTU-CVE-2024-43799 2026-10-03T11:59:51.376923+00:00

Affected: Ubuntu:16.04:LTS: node-send, Ubuntu:18.04:LTS: node-send, Ubuntu:20.04:LTS: node-send, Ubuntu:22.04:LTS: node-send, Ubuntu:24.04:LTS: node-send

Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2197 WID-SEC-W-2024-2197 — IBM App Connect Enterprise: Mehrere Schwachstellen ermöglichen Cross-Site Scripting und Server-Side Request Forgery 2026-10-03T11:59:51.376949+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Cross-Site Scripting und Server-Side Request Forgery-Angriff durchzuführen.