https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:55:17.704690+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-07454 bdu:2025-07454 2026-10-02T14:55:17.954588+00:00 bdu:2025-07454 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0724 certfr-2025-avi-0724 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-02T14:55:17.954626+00:00 certfr-2025-avi-0724 https://cve.radiocsirt.org/vuln/euvd-2026-268151 EUVD-2026-268151 2026-10-02T14:55:17.954645+00:00 EUVD-2026-268151 https://cve.radiocsirt.org/vuln/fkie_cve-2025-6547 fkie_cve-2025-6547 2026-10-02T14:55:17.954657+00:00

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.

 https://cve.radiocsirt.org/vuln/ghsa-v62p-rq8g-8h59 GHSA-v62p-rq8g-8h59 — pbkdf2 silently disregards Uint8Array input, returning static keys 2026-10-02T14:55:17.954685+00:00

Affected: npm: pbkdf2

### Summary

On historic but declared as supported Node.js versions (0.12-2.x), pbkdf2 silently disregards Uint8Array input

This only affects Node.js <3.0.0, but `pbkdf2` claims to: * Support Node.js [>= 0.12](https://github.com/browserify/pbkdf2/blob/v3.1.2/package.json#L62) (and there seems to be ongoing effort in this repo to maintain that) * Support `Uint8Array` input (input is typechecked against Uint8Array, and the error message includes e.g. "Password must be a string, a Buffer, a typed array or a DataView"

### Details

The error is in `toBuffer` method

This vulnerability somehow even made it to tests: https://github.com/browserify/pbkdf2/commit/eb9f97a66ed83836bebc4ff563a1588248708501 There, `resultsOld` (where mismatch `results`) are just invalid output generated from empty password/salt instead of the supplied one

### PoC

On Node.js/io.js < 3.0.0

```console > require('pbkdf2').pbkdf2Sync(new Uint8Array([1,2,3]), new Uint8Array([1,3,4]), 1024, 32, 'sha256') <Buffer 21 53 cd 5b a5 f0 15 39 2f 68 e2 40 8b 21 ba ca 0e dc 7b 20 d5 45 a4 8a ea b5 95 9f f0 be bf 66>

// But that's just a hash of empty data with empty password: > require('pbkdf2').pbkdf2Sync('', '', 1024, 32, 'sha256') <Buffer 21 53 cd 5b a5 f0 15 39 2f 68 e2 40 8b 21 ba ca 0e dc 7b 20 d5 45 a4 8a ea b5 95 9f f0 be bf 66>

// Node.js crypto is fine even on that version: > require('crypto').pbkdf2Sync(new Uint8Array([1,2,3]), new Uint8Array([1,3,4]), 1024, 32, 'sha256') <Buffer 78 10 cc 84 b7 bb 85…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11126-1 openSUSE-SU-2026:11126-1 — velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media 2026-10-02T14:55:17.954736+00:00

velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2025:10738 RHSA-2025:10738 — Red Hat Security Advisory: Kiali 2.4.7 for Red Hat OpenShift Service Mesh 3.0 2026-10-02T14:55:17.954782+00:00

pbkdf2: pbkdf2 silently returns predictable key material pbkdf2: pbkdf2 silently returns static keys

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-6547 Withdrawn: UBUNTU-CVE-2025-6547 2026-10-02T14:55:17.954798+00:00

Withdrawn by the publisher.

Affected: Ubuntu:18.04:LTS: node-pbkdf2, Ubuntu:20.04:LTS: node-pbkdf2, Ubuntu:22.04:LTS: node-pbkdf2, Ubuntu:24.04:LTS: node-pbkdf2, Ubuntu:25.10: node-pbkdf2, Ubuntu:26.04:LTS: node-pbkdf2

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1409 WID-SEC-W-2025-1409 — IBM App Connect Enterprise: Mehrere Schwachstellen ermöglichen Manipulation von Daten 2026-10-02T14:55:17.954826+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Daten zu manipulieren.