https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:41:04.354540+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2025:23732 ALSA-2025:23732 — Important: httpd:2.4 security update 2026-10-02T11:41:05.392536+00:00

Affected: AlmaLinux:8: httpd, AlmaLinux:8: httpd-devel, AlmaLinux:8: httpd-filesystem, AlmaLinux:8: httpd-manual, AlmaLinux:8: httpd-tools, AlmaLinux:8: mod_http2, AlmaLinux:8: mod_ldap, AlmaLinux:8: mod_md, AlmaLinux:8: mod_proxy_html, AlmaLinux:8: mod_session and 1 more

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082) * mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753) * httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200) * httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2025-15635 bdu:2025-15635 2026-10-02T11:41:05.392641+00:00 bdu:2025-15635 https://cve.radiocsirt.org/vuln/bell-cve-2025-58098 BELL-CVE-2025-58098 2026-10-02T11:41:05.392662+00:00

Affected: Alpaquita:23: apache2, Alpaquita:25: apache2, Alpaquita:stream: apache2

 https://cve.radiocsirt.org/vuln/bit-apache-2025-58098 BIT-apache-2025-58098 — Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... 2026-10-02T11:41:05.392685+00:00

Affected: Bitnami: apache

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

This issue affects Apache HTTP Server before 2.4.66.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1071 certfr-2025-avi-1071 — De multiples vulnérabilités ont été découvertes dans Apache HTTP Server. Certaines d'entre elles permettent à un attaqu… 2026-10-02T11:41:05.392709+00:00 certfr-2025-avi-1071 https://cve.radiocsirt.org/vuln/cnvd-2025-30564 cnvd-2025-30564 2026-10-02T11:41:05.392725+00:00 cnvd-2025-30564 https://cve.radiocsirt.org/vuln/essa-2026:0017 ESSA-2026:0017 — Important: httpd security update 2026-10-02T11:41:05.392737+00:00

Important: httpd security update

 https://cve.radiocsirt.org/vuln/euvd-2026-271532 EUVD-2026-271532 2026-10-02T11:41:05.392755+00:00 EUVD-2026-271532 https://cve.radiocsirt.org/vuln/fkie_cve-2025-58098 fkie_cve-2025-58098 2026-10-02T11:41:05.392766+00:00

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

This issue affects Apache HTTP Server before 2.4.66.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-4m29-g52g-c6qc GHSA-4m29-g52g-c6qc 2026-10-02T11:41:05.392790+00:00

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

This issue affects Apache HTTP Server before 2.4.66.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.

 https://cve.radiocsirt.org/vuln/msrc_cve-2025-58098 msrc_CVE-2025-58098 — Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... 2026-10-02T11:41:05.392806+00:00 msrc_CVE-2025-58098 https://cve.radiocsirt.org/vuln/ncsc-2026-0022 NCSC-2026-0022 — Kwetsbaarheden verholpen in Oracle Communications producten 2026-10-02T11:41:05.392821+00:00 NCSC-2026-0022 https://cve.radiocsirt.org/vuln/oesa-2026-1527 OESA-2026-1527 — httpd security update 2026-10-02T11:41:05.392878+00:00

Affected: openEuler:24.03-LTS: httpd

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es):

An integer overflow vulnerability was found in Apache HTTP Server versions 2.4.30 to 2.4.66. In case of failed ACME certificate renewal, after a number of failures (~30 days in default configurations), the backoff timer becomes 0. Certificate renewal attempts are then repeated without delays until successful. This issue affects confidentiality, integrity, and availability.(CVE-2025-55753)

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

This issue affects Apache HTTP Server before 2.4.66.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.

This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.

This issue affects Apache HTTP Server: from 2.4.7 through…

 https://cve.radiocsirt.org/vuln/rhsa-2026:0009 RHSA-2026:0009 — Red Hat Security Advisory: httpd:2.4 security update 2026-10-02T11:41:05.392920+00:00

mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...

 https://cve.radiocsirt.org/vuln/suse-su-2025:4488-1 SUSE-SU-2025:4488-1 — Security update for apache2 2026-10-02T11:41:05.392940+00:00

Security update for apache2

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-58098 UBUNTU-CVE-2025-58098 2026-10-02T11:41:05.392957+00:00

Affected: Ubuntu:Pro:14.04:LTS: apache2, Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:Pro:18.04:LTS: apache2, Ubuntu:Pro:20.04:LTS: apache2, Ubuntu:22.04:LTS: apache2, Ubuntu:24.04:LTS: apache2, Ubuntu:25.10: apache2, Ubuntu:26.04:LTS: apache2

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2750 WID-SEC-W-2025-2750 — Apache HTTP Server: Mehrere Schwachstellen 2026-10-02T11:41:05.392989+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.