https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T20:33:39.792485+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0372 certfr-2026-avi-0372 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-02T20:33:41.208273+00:00 certfr-2026-avi-0372 https://cve.radiocsirt.org/vuln/cleanstart-2026-yp71485 CLEANSTART-2026-YP71485 — Immutable 2026-10-02T20:33:41.208368+00:00

Affected: CleanStart: argo-workflows

Security vulnerability affects the argo-workflows package. Immutable.

 https://cve.radiocsirt.org/vuln/euvd-2026-366106 EUVD-2026-366106 2026-10-02T20:33:41.208407+00:00 EUVD-2026-366106 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29063 fkie_cve-2026-29063 2026-10-02T20:33:41.208423+00:00

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

 https://cve.radiocsirt.org/vuln/ghsa-wf6x-7x77-mvgw GHSA-wf6x-7x77-mvgw — Immutable is vulnerable to Prototype Pollution 2026-10-02T20:33:41.208501+00:00

Affected: npm: immutable

## Impact _What kind of vulnerability is it? Who is impacted?_

A Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs.

## Affected APIs

| API | Notes | | --------------------------------------- | ----------------------------------------------------------- | | `mergeDeep(target, source)` | Iterates source keys via `ObjectSeq`, assigns `merged[key]` | | `mergeDeepWith(merger, target, source)` | Same code path | | `merge(target, source)` | Shallow variant, same assignment logic | | `Map.toJS()` | `object[k] = v` in `toObject()` with no `__proto__` guard | | `Map.toObject()` | Same `toObject()` implementation | | `Map.mergeDeep(source)` | When source is converted to plain object |

## Patches _Has the problem been patched? What versions should users upgrade to?_

| major version | patched version | | --- | --- | | 3.x | 3.8.3 | | 4.x | 4.3.7 | | 5.x | 5.1.5 |

## Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_

- [Validate user input](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution#validate_user_input) - [Node.js fl…

 https://cve.radiocsirt.org/vuln/rhsa-2026:11070 RHSA-2026:11070 — Red Hat Security Advisory: RHACS 4.8.11 security and bug fix update 2026-10-02T20:33:41.208596+00:00

immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-29063 UBUNTU-CVE-2026-29063 2026-10-02T20:33:41.208632+00:00

Affected: Ubuntu:20.04:LTS: node-immutable, Ubuntu:22.04:LTS: node-immutable, Ubuntu:24.04:LTS: node-immutable, Ubuntu:25.10: node-immutable, Ubuntu:26.04:LTS: node-immutable

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0845 WID-SEC-W-2026-0845 — IBM WebSphere Application Server Liberty: Mehrere Schwachstellen 2026-10-02T20:33:41.208661+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server Liberty ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen und Informationen offenzulegen.