https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T05:56:41.536180+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0473 certfr-2026-avi-0473 — De multiples vulnérabilités ont été découvertes dans Oracle Weblogic. Certaines d'entre elles permettent à un attaquant… 2026-10-04T05:56:41.546533+00:00 certfr-2026-avi-0473 https://cve.radiocsirt.org/vuln/euvd-2026-243209 EUVD-2026-243209 2026-10-04T05:56:41.546577+00:00 EUVD-2026-243209 https://cve.radiocsirt.org/vuln/fkie_cve-2025-35036 fkie_cve-2025-35036 2026-10-04T05:56:41.546592+00:00

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.

 https://cve.radiocsirt.org/vuln/ghsa-7v6m-28jr-rg84 GHSA-7v6m-28jr-rg84 — Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language 2026-10-04T05:56:41.546622+00:00

Affected: Maven: org.hibernate.validator:hibernate-validator, Maven: org.hibernate:hibernate-validator

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.

 https://cve.radiocsirt.org/vuln/rhsa-2025:10924 RHSA-2025:10924 — Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update 2026-10-04T05:56:41.546651+00:00

wildfly: Wildfly vulnerable to Cross-Site Scripting (XSS) org.jboss.eap:wildfly-ejb3: Improper Deserialization in JBoss Marshalling Allows Remote Code Execution org.jboss.hal-hal-parent: Stored Cross-Site Scripting (XSS) in JBoss EAP Management Console org.apache.cxf: Apache CXF: Denial of Service vulnerability with temporary files org.jboss.hal:hal-console: Wildfly HAL Console Cross-Site Scripting hibernate-validator: Hibernate Validator Expression Language Injection commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-35036 UBUNTU-CVE-2025-35036 2026-10-04T05:56:41.546680+00:00

Affected: Ubuntu:16.04:LTS: libhibernate-validator-java, Ubuntu:18.04:LTS: libhibernate-validator-java, Ubuntu:20.04:LTS: libhibernate-validator-java, Ubuntu:20.04:LTS: libhibernate-validator4-java, Ubuntu:22.04:LTS: libhibernate-validator-java, Ubuntu:22.04:LTS: libhibernate-validator4-java, Ubuntu:24.04:LTS: libhibernate-validator-java, Ubuntu:24.04:LTS: libhibernate-validator4-java, Ubuntu:25.10: libhibernate-validator-java, Ubuntu:25.10: libhibernate-validator4-java and 2 more

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1203 WID-SEC-W-2026-1203 — Oracle Fusion Middleware: Mehrere Schwachstellen 2026-10-04T05:56:41.546715+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.