https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:10:54.985443+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0477 certfr-2026-avi-0477 — De multiples vulnérabilités ont été découvertes dans les produits Spring. Certaines d'entre elles permettent à un attaq… 2026-10-02T14:10:55.011202+00:00 certfr-2026-avi-0477 https://cve.radiocsirt.org/vuln/cleanstart-2026-go18294 CLEANSTART-2026-GO18294 — Security fix for CVE-2026-22746 applied in: apache-nifi 2.7.2-r7, cloud-config-server 4.1.7-r2, cloud-config-server 4.2… 2026-10-02T14:10:55.011257+00:00

Affected: CleanStart: apache-nifi, CleanStart: cloud-config-server, CleanStart: kafka-ui, CleanStart: rundeck

CVE-2026-22746 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-292419 EUVD-2026-292419 2026-10-02T14:10:55.011295+00:00 EUVD-2026-292419 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22746 fkie_cve-2026-22746 2026-10-02T14:10:55.011308+00:00

Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

 https://cve.radiocsirt.org/vuln/ghsa-vxf7-qj7q-83fh GHSA-vxf7-qj7q-83fh — Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider 2026-10-02T14:10:55.011334+00:00

Affected: Maven: org.springframework.security:spring-security-core

Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1221 WID-SEC-W-2026-1221 — VMware Tanzu Spring Security: Mehrere Schwachstellen 2026-10-02T14:10:55.011358+00:00

Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Security ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, sich als Benutzer auszugeben oder Daten zu manipulieren – was möglicherweise eine Privilegieneskalation, SSRF- oder Cross-Site-Scripting-Angriffe ermöglicht.