https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T16:15:01.938502+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-06805 bdu:2025-06805 2026-10-03T16:15:02.118781+00:00 bdu:2025-06805 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0514 certfr-2025-avi-0514 — Une vulnérabilité a été découverte dans PostgreSQL JDBC. Elle permet à un attaquant de provoquer un contournement de la… 2026-10-03T16:15:02.118824+00:00 certfr-2025-avi-0514 https://cve.radiocsirt.org/vuln/cleanstart-2026-vy88502 Withdrawn: CLEANSTART-2026-VY88502 — Security fixes in kogito-apps 10.1.0-r0 2026-10-03T16:15:02.118843+00:00

Withdrawn by the publisher.

Affected: CleanStart: kogito-apps

Package kogito-apps version 10.1.0-r0 fixes 26 vulnerabilities: CVE-2025-55163, ghsa-prj3-ccx8-p6x4, CVE-2025-67735, ghsa-84h7-rjj3-6jx4, CVE-2025-58057...

 https://cve.radiocsirt.org/vuln/euvd-2026-243898 EUVD-2026-243898 2026-10-03T16:15:02.118876+00:00 EUVD-2026-243898 https://cve.radiocsirt.org/vuln/fkie_cve-2025-49146 fkie_cve-2025-49146 2026-10-03T16:15:02.118889+00:00

pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.

 https://cve.radiocsirt.org/vuln/ghsa-hq9p-pm7w-8p54 GHSA-hq9p-pm7w-8p54 — pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration 2026-10-03T16:15:02.118913+00:00

Affected: Maven: org.postgresql:postgresql

### Impact When the PostgreSQL JDBC driver is configured with channel binding set to `required` (default value is `prefer`), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements.

### Patches TBD

### Workarounds

Configure `sslMode=verify-full` to prevent MITM attacks.

### References

* https://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256 * https://datatracker.ietf.org/doc/html/rfc7677 * https://datatracker.ietf.org/doc/html/rfc5802

 https://cve.radiocsirt.org/vuln/ncsc-2026-0034 NCSC-2026-0034 — Kwetsbaarheden verholpen in Atlassian producten 2026-10-03T16:15:02.118940+00:00 NCSC-2026-0034 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15264-1 openSUSE-SU-2025:15264-1 — postgresql-jdbc-42.7.7-1.1 on GA media 2026-10-03T16:15:02.118992+00:00

postgresql-jdbc-42.7.7-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2025:10323 RHSA-2025:10323 — Red Hat Security Advisory: Red Hat build of Cryostat security update 2026-10-03T16:15:02.119008+00:00

net/http: Request smuggling due to acceptance of invalid chunked data in net/http pgjdbc: pgjdbc insecure authentication in channel binding

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-49146 UBUNTU-CVE-2025-49146 2026-10-03T16:15:02.119026+00:00

Affected: Ubuntu:14.04:LTS: libpgjava, Ubuntu:16.04:LTS: libpgjava, Ubuntu:Pro:18.04:LTS: libpgjava, Ubuntu:Pro:20.04:LTS: libpgjava, Ubuntu:22.04:LTS: libpgjava, Ubuntu:24.04:LTS: libpgjava, Ubuntu:25.10: libpgjava, Ubuntu:26.04:LTS: libpgjava

pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1328 WID-SEC-W-2025-1328 — PostgreSQL JDBC Treiber: Schwachstelle ermöglicht Offenlegung von Informationen 2026-10-03T16:15:02.119058+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle im PostgreSQL JDBC Treiber ausnutzen, um Informationen offenzulegen.