https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T12:02:28.563661+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-27199 Withdrawn: BELL-CVE-2026-27199 — CVE-2026-27199 does not affect BellSoft software 2026-10-03T12:02:29.045230+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/brew-aws-sam-cli-cve-2026-27199 BREW-aws-sam-cli-CVE-2026-27199 — Werkzeug safe_join() allows Windows special device names 2026-10-03T12:02:29.045276+00:00

Affected: Homebrew: aws-sam-cli

Werkzeug's `safe_join` function allows Windows device names as filenames if when preceded by other path segments.

This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that `safe_join` accepts paths with multiple segments, such as `example/NUL`.

`send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0395 certfr-2026-avi-0395 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T12:02:29.045313+00:00 certfr-2026-avi-0395 https://cve.radiocsirt.org/vuln/cleanstart-2026-az09261 Withdrawn: CLEANSTART-2026-AZ09261 — Security fixes for CVE-2023-46136, CVE-2024-12797, CVE-2024-34069, CVE-2024-49766, CVE-2024-49767, CVE-2025-62727, CVE-… 2026-10-03T12:02:29.045331+00:00

Withdrawn by the publisher.

Affected: CleanStart: airflow-3

Multiple security vulnerabilities affect the airflow-3 package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-270469 EUVD-2026-270469 2026-10-03T12:02:29.045359+00:00 EUVD-2026-270469 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27199 fkie_cve-2026-27199 2026-10-03T12:02:29.045371+00:00

Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been fixed in version 3.1.6.

 https://cve.radiocsirt.org/vuln/ghsa-29vq-49wr-vm6x GHSA-29vq-49wr-vm6x — Werkzeug safe_join() allows Windows special device names 2026-10-03T12:02:29.045394+00:00

Affected: PyPI: werkzeug

Werkzeug's `safe_join` function allows Windows device names as filenames if when preceded by other path segments.

This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that `safe_join` accepts paths with multiple segments, such as `example/NUL`.

`send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-27199 msrc_CVE-2026-27199 — Werkzeug safe_join() allows Windows special device names 2026-10-03T12:02:29.045418+00:00 msrc_CVE-2026-27199 https://cve.radiocsirt.org/vuln/pysec-2026-2320 PYSEC-2026-2320 2026-10-03T12:02:29.045434+00:00

Affected: PyPI: werkzeug

Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been fixed in version 3.1.6.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2933 WID-SEC-W-2026-2933 — Splunk SOAR: Mehrere Schwachstellen 2026-10-03T12:02:29.045455+00:00

Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.