https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T23:12:05.010185+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-12071 bdu:2026-12071 2026-10-03T23:12:05.025964+00:00 bdu:2026-12071 https://cve.radiocsirt.org/vuln/euvd-2026-373390 EUVD-2026-373390 2026-10-03T23:12:05.026009+00:00 EUVD-2026-373390 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28808 fkie_cve-2026-28808 2026-10-03T23:12:05.026023+00:00

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-28808 msrc_CVE-2026-28808 — ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch) 2026-10-03T23:12:05.026061+00:00 msrc_CVE-2026-28808 https://cve.radiocsirt.org/vuln/oesa-2026-2572 OESA-2026-2572 — erlang security update 2026-10-03T23:12:05.026080+00:00

Affected: openEuler:24.03-LTS-SP1: erlang

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fix(es):

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 until OTP 28.4.2, 27.3.4.10 and 26.2.5.19 corresponding to inets from 5.10 until 9.6.2, 9.3.2.4 and 9.1.0.6.(CVE-2026-28808)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10947-1 openSUSE-SU-2026:10947-1 — erlang27-27.1.3-2.1 on GA media 2026-10-03T23:12:05.026110+00:00

erlang27-27.1.3-2.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2026:21374-1 SUSE-SU-2026:21374-1 — Security update for erlang 2026-10-03T23:12:05.026133+00:00

Security update for erlang

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-28808 UBUNTU-CVE-2026-28808 2026-10-03T23:12:05.026151+00:00

Affected: Ubuntu:Pro:14.04:LTS: erlang, Ubuntu:Pro:16.04:LTS: erlang, Ubuntu:Pro:18.04:LTS: erlang, Ubuntu:Pro:20.04:LTS: erlang, Ubuntu:22.04:LTS: erlang, Ubuntu:24.04:LTS: erlang, Ubuntu:25.10: erlang, Ubuntu:26.04:LTS: erlang

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0998 WID-SEC-W-2026-0998 — Erlang/OTP: Mehrere Schwachstellen 2026-10-03T23:12:05.026187+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Erlang/OTP ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Daten zu manipulieren.