https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T10:06:08.774482+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 certfr-2026-avi-1094 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T10:06:09.316810+00:00 certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/cleanstart-2026-wa26037 CLEANSTART-2026-WA26037 — Security fix for CVE-2026-16221 applied in: argo-workflows 3.6.19-r8 2026-10-03T10:06:09.316887+00:00

Affected: CleanStart: argo-workflows

Security vulnerability affects the argo-workflows package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-338871 EUVD-2026-338871 2026-10-03T10:06:09.316923+00:00 EUVD-2026-338871 https://cve.radiocsirt.org/vuln/fkie_cve-2026-16221 fkie_cve-2026-16221 2026-10-03T10:06:09.316937+00:00

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts.

Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3.

Workarounds: none.

 https://cve.radiocsirt.org/vuln/ghsa-v2hh-gcrm-f6hx GHSA-v2hh-gcrm-f6hx — fast-uri vulnerable to host confusion via literal backslash authority delimiter 2026-10-03T10:06:09.316970+00:00

Affected: npm: fast-uri

### Impact

`fast-uri` v4.1.0 and earlier do not treat a literal backslash (U+005C) as an authority delimiter. Node's native WHATWG `URL` (used by `fetch()`, `undici`, and Node's `http`/`https` clients) normalizes `\` to `/` for special schemes (`http`, `https`, `ws`, `wss`, `ftp`, `file`), so the two parsers extract different hosts from the same input string.

For example, `http://evil.com\@allowed.com` is treated by `fast-uri` as host `allowed.com` with userinfo `evil.com\`, while Node's WHATWG URL parser and `fetch()` see host `evil.com` with path `/@allowed.com`.

Applications that use `fast-uri` to enforce host-based policy (allowlists, denylists, loopback/SSRF filtering, redirect validation, outbound proxy routing) before passing the same URL into Node's URL or `fetch()` consumers see a policy/use desync and can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts.

### Patches

Upgrade to `fast-uri` v4.1.1, v3.1.4, or v2.4.3.

### Workarounds

None. Upgrade to the patched version.

 https://cve.radiocsirt.org/vuln/ncsc-2026-0325 NCSC-2026-0325 — Kwetsbaarheden verholpen in Atlassian producten 2026-10-03T10:06:09.317007+00:00 NCSC-2026-0325 https://cve.radiocsirt.org/vuln/rhsa-2026:54517 RHSA-2026:54517 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-03T10:06:09.317117+00:00

fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency baseline-browser-mapping: baseline-browser-mapping: Denial of Service via improper input handling DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization. dompurify: DOMPurify: URI validation bypass leads to cross-site scripting dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode dompurify: DOMPurify: Cross-Site Scripting vulnerability allows arbitrary code execution browserslist: Browserslist: Prototype pollution leading to denial of service browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-16221 UBUNTU-CVE-2026-16221 2026-10-03T10:06:09.317148+00:00

Affected: Ubuntu:18.04:LTS: node-ajv, Ubuntu:20.04:LTS: node-ajv, Ubuntu:22.04:LTS: node-ajv, Ubuntu:24.04:LTS: node-ajv, Ubuntu:26.04:LTS: node-ajv

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2923 WID-SEC-W-2026-2923 — Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen 2026-10-03T10:06:09.317190+00:00

Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence, Atlassian Crucible, Atlassian Fisheye und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.