https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T13:30:57.767303+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-03883 bdu:2025-03883 2026-10-03T13:30:57.836837+00:00 bdu:2025-03883 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0896 certfr-2025-avi-0896 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T13:30:57.836874+00:00 certfr-2025-avi-0896 https://cve.radiocsirt.org/vuln/cleanstart-2026-hk16178 CLEANSTART-2026-HK16178 — Security fix for CVE-2025-30218 applied in: jitsucom-jitsu 2.11.0-r0 2026-10-03T13:30:57.836892+00:00

Affected: CleanStart: jitsucom-jitsu

Security vulnerability affects the jitsucom-jitsu package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-254704 EUVD-2026-254704 2026-10-03T13:30:57.836921+00:00 EUVD-2026-254704 https://cve.radiocsirt.org/vuln/fkie_cve-2025-30218 fkie_cve-2025-30218 2026-10-03T13:30:57.836933+00:00

Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a third-party within Middleware will send the x-middleware-subrequest-id to that third party. This vulnerability is fixed in 12.3.6, 13.5.10, 14.2.26, and 15.2.4.

 https://cve.radiocsirt.org/vuln/ghsa-223j-4rm8-mrmf GHSA-223j-4rm8-mrmf — Next.js may leak x-middleware-subrequest-id to external hosts 2026-10-03T13:30:57.836956+00:00

Affected: npm: next

## Summary In the process of remediating [CVE-2025-29927](https://github.com/advisories/GHSA-f82v-jwr5-mffw), we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers.

Learn more [here](https://vercel.com/changelog/cve-2025-30218-5DREmEH765PoeAsrNNQj3O).

## Credit

Thank you to Jinseo Kim [kjsman](https://hackerone.com/kjsman?type=user) and [RyotaK](https://hackerone.com/ryotak?type=user) (GMO Flatt Security Inc.) with [takumi-san.ai](https://takumi-san.ai) for the responsible disclosure. These researchers were awarded as part of our bug bounty program.