https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:39:48.868413+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-09481 bdu:2024-09481 2026-10-02T22:39:49.041173+00:00 bdu:2024-09481 https://cve.radiocsirt.org/vuln/euvd-2026-162530 EUVD-2026-162530 2026-10-02T22:39:49.041224+00:00 EUVD-2026-162530 https://cve.radiocsirt.org/vuln/fkie_cve-2024-8642 fkie_cve-2024-8642 2026-10-02T22:39:49.041246+00:00

In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module "transfer-data-plane". The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed.

 https://cve.radiocsirt.org/vuln/ghsa-8259-2x72-2gvc GHSA-8259-2x72-2gvc — Eclipse Dataspace Components's ConsumerPullTransferTokenValidationApiController doesn't check for token validit 2026-10-02T22:39:49.041295+00:00

Affected: Maven: org.eclipse.edc:transfer-data-plane

In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module "transfer-data-plane". The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed.