https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T22:29:11.012751+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0746 certfr-2025-avi-0746 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-06T22:29:11.016054+00:00 certfr-2025-avi-0746 https://cve.radiocsirt.org/vuln/euvd-2026-215152 EUVD-2026-215152 2026-10-06T22:29:11.016090+00:00 EUVD-2026-215152 https://cve.radiocsirt.org/vuln/fkie_cve-2025-24789 fkie_cve-2025-24789 2026-10-06T22:29:11.016105+00:00

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. When the EXTERNALBROWSER authentication method is used on Windows, an attacker with write access to a directory in the %PATH% can escalate their privileges to the user that runs the vulnerable JDBC Driver version. This vulnerability affects versions 3.2.3 through 3.21.0 on Windows. Snowflake fixed the issue in version 3.22.0.

 https://cve.radiocsirt.org/vuln/ghsa-7hpq-3g6w-pvhf GHSA-7hpq-3g6w-pvhf — Snowflake JDBC allows an untrusted search path on Windows 2026-10-06T22:29:11.016134+00:00

Affected: Maven: net.snowflake:snowflake-jdbc

### Issue Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. When the EXTERNALBROWSER authentication method is used on Windows, an attacker with write access to a directory in the %PATH% can escalate their privileges to the user that runs the vulnerable JDBC Driver version.

This vulnerability affects versions 3.2.3 through 3.21.0 on Windows. Snowflake fixed the issue in version 3.22.0.

### Vulnerability Details When the EXTERNALBROWSER authentication method is selected, the Snowflake JDBC Driver on non-macOS operating systems tries to open the SSO URL using xdg-open. Because xdg-open is a Linux program that doesn’t exist in a default Windows installation, a sufficiently privileged attacker could place a malicious executable in one of the directories on the %PATH% and achieve local privilege escalation to the user running the JDBC Driver.

### Solution Snowflake released version 3.22.0 of the Snowflake JDBC Driver, which fixes this issue. We recommend users upgrade to version 3.22.0.

### Additional Information If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0655 WID-SEC-W-2025-0655 — IBM InfoSphere Information Server: Mehrere Schwachstellen 2026-10-06T22:29:11.016171+00:00

Ein entfernter authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen preiszugeben und Daten zu manipulieren.