https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:40:34.593290+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-337464 EUVD-2026-337464 2026-10-02T19:40:34.642033+00:00 EUVD-2026-337464 https://cve.radiocsirt.org/vuln/fkie_cve-2026-2472 fkie_cve-2026-2472 2026-10-02T19:40:34.642067+00:00

Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.

 https://cve.radiocsirt.org/vuln/ghsa-qv8j-hgpc-vrq8 GHSA-qv8j-hgpc-vrq8 — Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS) 2026-10-02T19:40:34.642100+00:00

Affected: PyPI: google-cloud-aiplatform

Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.

 https://cve.radiocsirt.org/vuln/pysec-2026-2499 PYSEC-2026-2499 — Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS) 2026-10-02T19:40:34.642128+00:00

Affected: PyPI: google-cloud-aiplatform

Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.

 https://cve.radiocsirt.org/vuln/rhsa-2026:10184 RHSA-2026:10184 — Red Hat Security Advisory: RHOAI 2.25.5 - Red Hat OpenShift AI 2026-10-02T19:40:34.642149+00:00

vllm: Server Side request forgery (SSRF) in MediaConnector feast: Feast: Remote Code Execution via insecure YAML deserialization openshift-ai: Trusty AI Grants All Authenticated users to list pods in any namespace nltk: Zip Slip Vulnerability in nltk Leading to Code Execution golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb aiohttp: aiohttp: Denial of Service via specially crafted POST request aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request python-markdown: denial of service via malformed HTML-like sequences nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function nltk: NLTK: Arbitrary file read via path traversal vulnerability io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files google-cloud-aiplatform: google-cloud-aiplatform: Arbitrary code execution via Stored Cross-Site Scripting (XSS) tensorflow: TensorFlow: Local privilege escalation via…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0474 WID-SEC-W-2026-0474 — Google Cloud Platform: Mehrere Schwachstellen 2026-10-02T19:40:34.642232+00:00

Ein Angreifer kann mehrere Schwachstellen in Google Cloud Platform ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.