https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T12:42:08.638666+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07193 bdu:2026-07193 2026-10-06T12:42:09.469376+00:00 bdu:2026-07193 https://cve.radiocsirt.org/vuln/brew-aider-cve-2025-69226 BREW-aider-CVE-2025-69226 — AIOHTTP vulnerable to brute-force leak of internal static file path components 2026-10-06T12:42:09.469418+00:00

Affected: Homebrew: aider

### Summary Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components.

### Impact If an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.

------

Patch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0224 certfr-2026-avi-0224 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-06T12:42:09.469460+00:00 certfr-2026-avi-0224 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 Withdrawn: CLEANSTART-2026-AN24336 — Security fixes for CVE-2024-12797, CVE-2024-52303, CVE-2024-52304, CVE-2024-56201, CVE-2024-56326, CVE-2025-24023, CVE-… 2026-10-06T12:42:09.469486+00:00

Withdrawn by the publisher.

Affected: CleanStart: airflow-2

Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-264984 EUVD-2026-264984 2026-10-06T12:42:09.469520+00:00 EUVD-2026-264984 https://cve.radiocsirt.org/vuln/fkie_cve-2025-69226 fkie_cve-2025-69226 2026-10-06T12:42:09.469544+00:00

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.

 https://cve.radiocsirt.org/vuln/ghsa-54jq-c3m8-4m76 GHSA-54jq-c3m8-4m76 — AIOHTTP vulnerable to brute-force leak of internal static file path components 2026-10-06T12:42:09.469583+00:00

Affected: PyPI: aiohttp

### Summary Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components.

### Impact If an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.

------

Patch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10025-1 openSUSE-SU-2026:10025-1 — python311-aiohttp-3.13.3-1.1 on GA media 2026-10-06T12:42:09.469623+00:00

python311-aiohttp-3.13.3-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-1097 PYSEC-2026-1097 — AIOHTTP vulnerable to brute-force leak of internal static file path components 2026-10-06T12:42:09.469658+00:00

Affected: PyPI: aiohttp

### Summary Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components.

### Impact If an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.

------

Patch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e

 https://cve.radiocsirt.org/vuln/suse-su-2026:20425-1 SUSE-SU-2026:20425-1 — Security update for python-aiohttp, python-Brotli 2026-10-06T12:42:09.469696+00:00

Security update for python-aiohttp, python-Brotli

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-69226 UBUNTU-CVE-2025-69226 2026-10-06T12:42:09.469727+00:00

Affected: Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.