https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:16:33.088000+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-15736 bdu:2025-15736 2026-10-03T03:16:33.251105+00:00 bdu:2025-15736 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1100 certfr-2025-avi-1100 — De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un at… 2026-10-03T03:16:33.251146+00:00 certfr-2025-avi-1100 https://cve.radiocsirt.org/vuln/cleanstart-2026-hf44570 CLEANSTART-2026-HF44570 — Critical XXE in Apache Tika tika-core (1 2026-10-03T03:16:33.251165+00:00

Affected: CleanStart: apache-nifi

Security vulnerability affects the apache-nifi package. Critical XXE in Apache Tika tika-core (1.

 https://cve.radiocsirt.org/vuln/euvd-2026-271547 EUVD-2026-271547 2026-10-03T03:16:33.251194+00:00 EUVD-2026-271547 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66516 fkie_cve-2025-66516 2026-10-03T03:16:33.251206+00:00

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF.

This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways.

First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.

Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.

 https://cve.radiocsirt.org/vuln/ghsa-f58c-gq56-vjjf GHSA-f58c-gq56-vjjf — Apache Tika has XXE vulnerability 2026-10-03T03:16:33.251250+00:00

Affected: Maven: org.apache.tika:tika-core, Maven: org.apache.tika:tika-parsers, Maven: org.apache.tika:tika-parser-pdf-module

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF.

This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways.

First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.

Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.

 https://cve.radiocsirt.org/vuln/ncsc-2026-0020 NCSC-2026-0020 — Kwetsbaarheden verholpen in Oracle Commerce 2026-10-03T03:16:33.251282+00:00 NCSC-2026-0020 https://cve.radiocsirt.org/vuln/rhsa-2025:23143 RHSA-2025:23143 — Red Hat Security Advisory: Red Hat Build of Apache Camel 4.14.2 for Spring Boot release. 2026-10-03T03:16:33.251308+00:00

undertow: Undertow MadeYouReset HTTP/2 DDoS Vulnerability commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang tika-core: tika-parsers: tika-parser-pdf-module: Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-66516 UBUNTU-CVE-2025-66516 2026-10-03T03:16:33.251328+00:00

Affected: Ubuntu:18.04:LTS: tika, Ubuntu:Pro:20.04:LTS: tika, Ubuntu:22.04:LTS: tika, Ubuntu:24.04:LTS: tika, Ubuntu:25.10: tika, Ubuntu:26.04:LTS: tika

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1883 WID-SEC-W-2025-1883 — Apache Tika: Schwachstelle ermöglicht Infogewinn oder Manipulation 2026-10-03T03:16:33.251359+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Tika ausnutzen, um sensible Daten auszulesen oder bösartige Anfragen an interne Ressourcen oder Server von Drittanbietern auszulösen.