https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:54:20.499925+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07337 bdu:2026-07337 2026-10-02T19:54:20.930744+00:00 bdu:2026-07337 https://cve.radiocsirt.org/vuln/brew-aider-cve-2025-69223 BREW-aider-CVE-2025-69223 — AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb 2026-10-02T19:54:20.930813+00:00

Affected: Homebrew: aider

### Summary A zip bomb can be used to execute a DoS against the aiohttp server.

### Impact An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.

------

Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0224 certfr-2026-avi-0224 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-02T19:54:20.930857+00:00 certfr-2026-avi-0224 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 Withdrawn: CLEANSTART-2026-AN24336 — Security fixes for CVE-2024-12797, CVE-2024-52303, CVE-2024-52304, CVE-2024-56201, CVE-2024-56326, CVE-2025-24023, CVE-… 2026-10-02T19:54:20.930876+00:00

Withdrawn by the publisher.

Affected: CleanStart: airflow-2

Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-371787 EUVD-2026-371787 2026-10-02T19:54:20.930906+00:00 EUVD-2026-371787 https://cve.radiocsirt.org/vuln/fkie_cve-2025-69223 fkie_cve-2025-69223 2026-10-02T19:54:20.930918+00:00

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

 https://cve.radiocsirt.org/vuln/ghsa-6mq8-rvhq-8wgg GHSA-6mq8-rvhq-8wgg — AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb 2026-10-02T19:54:20.930941+00:00

Affected: PyPI: aiohttp

### Summary A zip bomb can be used to execute a DoS against the aiohttp server.

### Impact An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.

------

Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10025-1 openSUSE-SU-2026:10025-1 — python311-aiohttp-3.13.3-1.1 on GA media 2026-10-02T19:54:20.930965+00:00

python311-aiohttp-3.13.3-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-1101 PYSEC-2026-1101 — AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb 2026-10-02T19:54:20.930989+00:00

Affected: PyPI: aiohttp

### Summary A zip bomb can be used to execute a DoS against the aiohttp server.

### Impact An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.

------

Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a

 https://cve.radiocsirt.org/vuln/rhsa-2026:10184 RHSA-2026:10184 — Red Hat Security Advisory: RHOAI 2.25.5 - Red Hat OpenShift AI 2026-10-02T19:54:20.931010+00:00

vllm: Server Side request forgery (SSRF) in MediaConnector feast: Feast: Remote Code Execution via insecure YAML deserialization openshift-ai: Trusty AI Grants All Authenticated users to list pods in any namespace nltk: Zip Slip Vulnerability in nltk Leading to Code Execution golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb aiohttp: aiohttp: Denial of Service via specially crafted POST request aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request python-markdown: denial of service via malformed HTML-like sequences nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function nltk: NLTK: Arbitrary file read via path traversal vulnerability io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files google-cloud-aiplatform: google-cloud-aiplatform: Arbitrary code execution via Stored Cross-Site Scripting (XSS) tensorflow: TensorFlow: Local privilege escalation via…

 https://cve.radiocsirt.org/vuln/suse-su-2026:20425-1 SUSE-SU-2026:20425-1 — Security update for python-aiohttp, python-Brotli 2026-10-02T19:54:20.931116+00:00

Security update for python-aiohttp, python-Brotli

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-69223 UBUNTU-CVE-2025-69223 2026-10-02T19:54:20.931137+00:00

Affected: Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0935 WID-SEC-W-2026-0935 — Red Hat Ansible Automation Platform: Mehrere Schwachstellen 2026-10-02T19:54:20.931167+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.