https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T18:42:10.307452+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0724 certfr-2025-avi-0724 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T18:42:10.323725+00:00 certfr-2025-avi-0724 https://cve.radiocsirt.org/vuln/cleanstart-2026-bc28327 Withdrawn: CLEANSTART-2026-BC28327 — Security fixes in thingsboard-tb-web-ui 4.1-r1 2026-10-03T18:42:10.323789+00:00

Withdrawn by the publisher.

Affected: CleanStart: thingsboard-tb-web-ui

Package thingsboard-tb-web-ui version 4.1-r1 fixes 3 vulnerabilities: ghsa-r4q5-vmmm-2653, ghsa-76c9-3jph-rj3q, CVE-2025-7339

 https://cve.radiocsirt.org/vuln/euvd-2026-247815 EUVD-2026-247815 2026-10-03T18:42:10.323840+00:00 EUVD-2026-247815 https://cve.radiocsirt.org/vuln/fkie_cve-2025-7339 fkie_cve-2025-7339 2026-10-03T18:42:10.323863+00:00

on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.

 https://cve.radiocsirt.org/vuln/ghsa-76c9-3jph-rj3q GHSA-76c9-3jph-rj3q — on-headers is vulnerable to http response header manipulation 2026-10-03T18:42:10.323908+00:00

Affected: npm: on-headers

### Impact

A bug in on-headers versions `< 1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`

### Patches

Users should upgrade to `1.1.0`

### Workarounds

Uses are encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.

 https://cve.radiocsirt.org/vuln/msrc_cve-2025-7339 msrc_CVE-2025-7339 — on-headers vulnerable to http response header manipulation 2026-10-03T18:42:10.323959+00:00 msrc_CVE-2025-7339 https://cve.radiocsirt.org/vuln/opensuse-su-2026:20919-1 openSUSE-SU-2026:20919-1 — Security update for agama-web-ui 2026-10-03T18:42:10.323987+00:00

Security update for agama-web-ui

 https://cve.radiocsirt.org/vuln/rhsa-2025:21704 RHSA-2025:21704 — Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.20 security, enhancement & bug fix update 2026-10-03T18:42:10.324021+00:00

follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor follow-redirects: Exposure of Sensitive Information via Authorization Header leak golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html brace-expansion: juliangruber brace-expansion index.js expand redos on-headers: on-headers vulnerable to http response header manipulation form-data: Unsafe random function in form-data golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-7339 UBUNTU-CVE-2025-7339 2026-10-03T18:42:10.324067+00:00

Affected: Ubuntu:16.04:LTS: node-on-headers, Ubuntu:18.04:LTS: node-on-headers, Ubuntu:20.04:LTS: node-on-headers, Ubuntu:22.04:LTS: node-on-headers, Ubuntu:24.04:LTS: node-on-headers, Ubuntu:25.10: node-on-headers, Ubuntu:26.04:LTS: node-on-headers

on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1929 WID-SEC-W-2025-1929 — IBM App Connect Enterprise: Mehrere Schwachstellen 2026-10-03T18:42:10.324131+00:00

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen, um Daten zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.