https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:48:57.912399+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0477 certfr-2026-avi-0477 — De multiples vulnérabilités ont été découvertes dans les produits Spring. Certaines d'entre elles permettent à un attaq… 2026-10-03T07:48:57.974422+00:00 certfr-2026-avi-0477 https://cve.radiocsirt.org/vuln/euvd-2026-337497 EUVD-2026-337497 2026-10-03T07:48:57.974462+00:00 EUVD-2026-337497 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22754 fkie_cve-2026-22754 2026-10-03T07:48:57.974477+00:00

Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.

 https://cve.radiocsirt.org/vuln/ghsa-4vrc-j85c-598c GHSA-4vrc-j85c-598c — Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules 2026-10-03T07:48:57.974508+00:00

Affected: Maven: org.springframework.security:spring-security-config

Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass. This issue affects Spring Security: from 7.0.0 through 7.0.4.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1221 WID-SEC-W-2026-1221 — VMware Tanzu Spring Security: Mehrere Schwachstellen 2026-10-03T07:48:57.974534+00:00

Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Security ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, sich als Benutzer auszugeben oder Daten zu manipulieren – was möglicherweise eine Privilegieneskalation, SSRF- oder Cross-Site-Scripting-Angriffe ermöglicht.