https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:01:44.539985+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-15590 bdu:2025-15590 2026-10-02T23:01:45.300512+00:00 bdu:2025-15590 https://cve.radiocsirt.org/vuln/brew-aider-cve-2025-53643 BREW-aider-CVE-2025-53643 — AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections 2026-10-02T23:01:45.300559+00:00

Affected: Homebrew: aider

### Summary The Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request.

### Impact If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.

----

Patch: https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0969 certfr-2025-avi-0969 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-02T23:01:45.300598+00:00 certfr-2025-avi-0969 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 Withdrawn: CLEANSTART-2026-AN24336 — Security fixes for CVE-2024-12797, CVE-2024-52303, CVE-2024-52304, CVE-2024-56201, CVE-2024-56326, CVE-2025-24023, CVE-… 2026-10-02T23:01:45.300616+00:00

Withdrawn by the publisher.

Affected: CleanStart: airflow-2

Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-247633 EUVD-2026-247633 2026-10-02T23:01:45.300646+00:00 EUVD-2026-247633 https://cve.radiocsirt.org/vuln/fkie_cve-2025-53643 fkie_cve-2025-53643 2026-10-02T23:01:45.300658+00:00

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

 https://cve.radiocsirt.org/vuln/ghsa-9548-qrrj-x5pj GHSA-9548-qrrj-x5pj — AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections 2026-10-02T23:01:45.300681+00:00

Affected: PyPI: aiohttp

### Summary The Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request.

### Impact If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.

----

Patch: https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:20204-1 openSUSE-SU-2026:20204-1 — Security update for python-aiohttp, python-Brotli 2026-10-02T23:01:45.300704+00:00

Security update for python-aiohttp, python-Brotli

 https://cve.radiocsirt.org/vuln/pysec-2026-1104 PYSEC-2026-1104 — AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections 2026-10-02T23:01:45.300724+00:00

Affected: PyPI: aiohttp

### Summary The Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request.

### Impact If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.

----

Patch: https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a

 https://cve.radiocsirt.org/vuln/rhsa-2025:22759 RHSA-2025:22759 — Red Hat Security Advisory: RHOAI 2.22.3 - Red Hat OpenShift AI 2026-10-02T23:01:45.300752+00:00

keras: Arbitary Code execution in Keras load_model() keras: Keras Path Traversal Vulnerability database/sql: Postgres Scan Race Condition aiohttp: AIOHTTP HTTP Request/Response Smuggling golang: archive/tar: Unbounded allocation when parsing GNU sparse map axios: Axios DoS via lack of data size check github.com/argoproj/argo-workflows: Argo Workflows Zip Slip starlette: Starlette DoS via Range header merging

 https://cve.radiocsirt.org/vuln/suse-su-2026:20425-1 SUSE-SU-2026:20425-1 — Security update for python-aiohttp, python-Brotli 2026-10-02T23:01:45.300779+00:00

Security update for python-aiohttp, python-Brotli

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-53643 UBUNTU-CVE-2025-53643 2026-10-02T23:01:45.300797+00:00

Affected: Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp, Ubuntu:Pro:26.04:LTS: python-aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2361 WID-SEC-W-2025-2361 — Oracle Communications: Mehrere Schwachstellen 2026-10-02T23:01:45.300828+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.