https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T15:37:05.700137+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:72424 ALSA-2026:72424 — Important: resteasy security update 2026-10-02T15:37:05.854142+00:00

Affected: AlmaLinux:9: pki-resteasy-client, AlmaLinux:9: pki-resteasy-core, AlmaLinux:9: pki-resteasy-jackson2-provider, AlmaLinux:9: pki-resteasy-servlet-initializer

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.

Security Fix(es):

* resteasy-core: RESTeasy SourceProvider remote unauthenticated file read (CVE-2026-17615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/euvd-2026-382096 EUVD-2026-382096 2026-10-02T15:37:05.854207+00:00 EUVD-2026-382096 https://cve.radiocsirt.org/vuln/fkie_cve-2026-17615 fkie_cve-2026-17615 2026-10-02T15:37:05.854224+00:00

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-h82j-45qh-f65r GHSA-h82j-45qh-f65r 2026-10-02T15:37:05.854262+00:00

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

 https://cve.radiocsirt.org/vuln/rhsa-2026:68277 RHSA-2026:68277 — Red Hat Security Advisory: Red Hat build of Keycloak 26.6.7 Images Security Update 2026-10-02T15:37:05.854308+00:00

keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2 keycloak-services: keycloak-services: Organization invitation link exposure allows unauthorized member creation keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session keycloak-services: keycloak-services: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers keycloak-services: keycloak-services: Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins keycloak-services: keycloak-services: Missing per-role authorization on RoleContainerResource composite endpoints keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2 keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts resteasy-core: RESTeasy SourceProvider remote unauthenticated file read keycloak-services: keycloak-services: Generic identity-provider creation can bind brokers to organizations without manage-organizations keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check keycloak-serv…

 https://cve.radiocsirt.org/vuln/rlsa-2026:72424 RLSA-2026:72424 — Important: resteasy security update 2026-10-02T15:37:05.854395+00:00

Affected: Rocky Linux:9: resteasy

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.

Security Fix(es):

* resteasy-core: RESTeasy SourceProvider remote unauthenticated file read (CVE-2026-17615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-17615 UBUNTU-CVE-2026-17615 2026-10-02T15:37:05.854419+00:00

Affected: Ubuntu:Pro:16.04:LTS: resteasy, Ubuntu:Pro:18.04:LTS: resteasy3.0, Ubuntu:Pro:20.04:LTS: resteasy, Ubuntu:Pro:20.04:LTS: resteasy3.0, Ubuntu:22.04:LTS: resteasy3.0, Ubuntu:Pro:22.04:LTS: resteasy, Ubuntu:24.04:LTS: resteasy3.0, Ubuntu:Pro:24.04:LTS: resteasy, Ubuntu:26.04:LTS: resteasy, Ubuntu:26.04:LTS: resteasy3.0

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.