https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T13:38:06.984126+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-05273 bdu:2026-05273 2026-10-03T13:38:07.297765+00:00 bdu:2026-05273 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0698 certfr-2026-avi-0698 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T13:38:07.297810+00:00 certfr-2026-avi-0698 https://cve.radiocsirt.org/vuln/cleanstart-2026-au09596 Withdrawn: CLEANSTART-2026-AU09596 — Security fixes in confluent-kafka 8.2.0-r0 2026-10-03T13:38:07.297839+00:00

Withdrawn by the publisher.

Affected: CleanStart: confluent-kafka

Package confluent-kafka version 8.2.0-r0 fixes 7 vulnerabilities: CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480, CVE-2026-2332...

 https://cve.radiocsirt.org/vuln/euvd-2026-290459 EUVD-2026-290459 2026-10-03T13:38:07.297882+00:00 EUVD-2026-290459 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34479 fkie_cve-2026-34479 2026-10-03T13:38:07.297902+00:00

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

Two groups of users are affected:

* Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.

Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.

Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.

 https://cve.radiocsirt.org/vuln/ghsa-h383-gmxw-35v2 GHSA-h383-gmxw-35v2 — Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters 2026-10-03T13:38:07.297960+00:00

Affected: Maven: org.apache.logging.log4j:log4j-1.2-api

The `Log4j1XmlLayout` from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

Two groups of users are affected:

* Those using `Log4j1XmlLayout` directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with `org.apache.log4j.xml.XMLLayout` specified as the layout class.

Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version `2.25.4`, which corrects this issue.

> [!NOTE] > The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the > [Log4j 1 to Log4j 2 migration guide](https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html), and specifically the section on eliminating reliance on the bridge.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-34479 msrc_CVE-2026-34479 — Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters 2026-10-03T13:38:07.298022+00:00 msrc_CVE-2026-34479 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10544-1 openSUSE-SU-2026:10544-1 — log4j-2.20.0-2.1 on GA media 2026-10-03T13:38:07.298049+00:00

log4j-2.20.0-2.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:21773 RHSA-2026:21773 — Red Hat Security Advisory: Red Hat Offline Knowledge Portal security and content update 2026-10-03T13:38:07.298077+00:00

org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames org.apache.logging.log4j/log4j-1.2-api: Apache Log4j 1-to-Log4j 2 bridge: Log processing denial of service due to improper XML escaping org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-34479 UBUNTU-CVE-2026-34479 2026-10-03T13:38:07.298132+00:00

Affected: Ubuntu:Pro:14.04:LTS: apache-log4j1.2, Ubuntu:Pro:16.04:LTS: apache-log4j2, Ubuntu:Pro:16.04:LTS: apache-log4j1.2, Ubuntu:18.04:LTS: apache-log4j1.2, Ubuntu:18.04:LTS: apache-log4j2, Ubuntu:20.04:LTS: apache-log4j1.2, Ubuntu:20.04:LTS: apache-log4j2, Ubuntu:22.04:LTS: apache-log4j1.2, Ubuntu:22.04:LTS: apache-log4j2, Ubuntu:24.04:LTS: apache-log4j1.2 and 5 more

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. Two groups of users are affected: * Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class. Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue. Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1067 WID-SEC-W-2026-1067 — Apache log4j: Mehrere Schwachstellen ermöglichen Manipulation von Dateien 2026-10-03T13:38:07.298208+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache log4j ausnutzen, um Dateien zu manipulieren.