https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T13:08:25.863507+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-bz49747 CLEANSTART-2026-BZ49747 — In Eclipse Vert 2026-10-03T13:08:26.108575+00:00

Affected: CleanStart: keycloak, CleanStart: wildfly

CVE-2026-15075 affects multiple packages. In Eclipse Vert. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-336256 EUVD-2026-336256 2026-10-03T13:08:26.108688+00:00 EUVD-2026-336256 https://cve.radiocsirt.org/vuln/fkie_cve-2026-15075 fkie_cve-2026-15075 2026-10-03T13:08:26.108706+00:00

In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison (scheme, host, port) is performed before copying headers to the redirect target. As a result, credential headers, including Authorization, Cookie, Proxy-Authorization, and arbitrary custom headers such as X-API-Token, are forwarded to the redirect destination without the caller's knowledge.

An attacker who can cause a Vert.x HttpClient to issue a request that is redirected to an attacker-controlled host (for example, by supplying a URL to a webhook dispatcher, image proxy, or microservice URL fetcher) can capture bearer tokens, basic-auth credentials, session cookies, and API keys attached to the original request.

 https://cve.radiocsirt.org/vuln/rhsa-2026:47172 RHSA-2026:47172 — Red Hat Security Advisory: Red Hat build of Quarkus 3.33.2.SP3 security update 2026-10-03T13:08:26.108738+00:00

vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket) io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) io.netty/netty-codec-http2: Netty: Improper header neutrali…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3062 WID-SEC-W-2026-3062 — IBM SPSS Analytic Server: Schwachstelle ermöglicht Offenlegung von Informationen 2026-10-03T13:08:26.108788+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM SPSS Analytic Server ausnutzen, um Informationen offenzulegen.