https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T16:14:31.004052+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-10567 bdu:2026-10567 2026-10-02T16:14:31.236234+00:00 bdu:2026-10567 https://cve.radiocsirt.org/vuln/bit-zookeeper-2026-24281 BIT-zookeeper-2026-24281 — Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager 2026-10-02T16:14:31.236281+00:00

Affected: Bitnami: zookeeper

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0251 certfr-2026-avi-0251 — De multiples vulnérabilités ont été découvertes dans Apache Zookeeper. Elles permettent à un attaquant de provoquer une… 2026-10-02T16:14:31.236323+00:00 certfr-2026-avi-0251 https://cve.radiocsirt.org/vuln/cleanstart-2026-aj02810 Withdrawn: CLEANSTART-2026-AJ02810 — Security fixes in kserve-modelmesh 0.12.0-r0 2026-10-02T16:14:31.236341+00:00

Withdrawn by the publisher.

Affected: CleanStart: kserve-modelmesh

Package kserve-modelmesh version 0.12.0-r0 fixes 20 vulnerabilities: CVE-2026-24281, CVE-2026-24308, CVE-2026-33870, CVE-2026-33871, ghsa-7xrh-hqfc-g7qr...

 https://cve.radiocsirt.org/vuln/euvd-2026-337467 EUVD-2026-337467 2026-10-02T16:14:31.236362+00:00 EUVD-2026-337467 https://cve.radiocsirt.org/vuln/fkie_cve-2026-24281 fkie_cve-2026-24281 2026-10-02T16:14:31.236374+00:00

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

 https://cve.radiocsirt.org/vuln/ghsa-7xrh-hqfc-g7qr GHSA-7xrh-hqfc-g7qr — Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager 2026-10-02T16:14:31.236398+00:00

Affected: Maven: org.apache.zookeeper:zookeeper

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

 https://cve.radiocsirt.org/vuln/rhsa-2026:10184 RHSA-2026:10184 — Red Hat Security Advisory: RHOAI 2.25.5 - Red Hat OpenShift AI 2026-10-02T16:14:31.236422+00:00

vllm: Server Side request forgery (SSRF) in MediaConnector feast: Feast: Remote Code Execution via insecure YAML deserialization openshift-ai: Trusty AI Grants All Authenticated users to list pods in any namespace nltk: Zip Slip Vulnerability in nltk Leading to Code Execution golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb aiohttp: aiohttp: Denial of Service via specially crafted POST request aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request python-markdown: denial of service via malformed HTML-like sequences nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function nltk: NLTK: Arbitrary file read via path traversal vulnerability io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files google-cloud-aiplatform: google-cloud-aiplatform: Arbitrary code execution via Stored Cross-Site Scripting (XSS) tensorflow: TensorFlow: Local privilege escalation via…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-24281 UBUNTU-CVE-2026-24281 2026-10-02T16:14:31.236526+00:00

Affected: Ubuntu:Pro:14.04:LTS: zookeeper, Ubuntu:Pro:16.04:LTS: zookeeper, Ubuntu:Pro:18.04:LTS: zookeeper, Ubuntu:20.04:LTS: zookeeper, Ubuntu:22.04:LTS: zookeeper, Ubuntu:24.04:LTS: zookeeper, Ubuntu:25.10: zookeeper, Ubuntu:26.04:LTS: zookeeper

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1032 WID-SEC-W-2026-1032 — IBM Tivoli Network Manager: Mehrere Schwachstellen 2026-10-02T16:14:31.236560+00:00

Ein Angreifer kann mehrere Schwachstellen in IBM Tivoli Network Manager ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.