https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:54:45.594034+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-aider-cve-2026-34993 BREW-aider-CVE-2026-34993 — AIOHTTP is Vulnerable to Deserialization of Untrusted Data 2026-10-02T23:54:47.035244+00:00

Affected: Homebrew: aider

### Summary

Using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution.

### Impact

Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.

### Workaround

If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitise the files before loading.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0933 certfr-2026-avi-0933 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-02T23:54:47.035346+00:00 certfr-2026-avi-0933 https://cve.radiocsirt.org/vuln/cleanstart-2026-hl56908 CLEANSTART-2026-HL56908 — Security fix for CVE-2026-34993 applied in: kserve-storage-controller 0.19.0-r0 2026-10-02T23:54:47.035369+00:00

Affected: CleanStart: kserve-storage-controller

Security vulnerability affects the kserve-storage-controller package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-370212 EUVD-2026-370212 2026-10-02T23:54:47.035393+00:00 EUVD-2026-370212 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34993 fkie_cve-2026-34993 2026-10-02T23:54:47.035406+00:00

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

 https://cve.radiocsirt.org/vuln/ghsa-jg22-mg44-37j8 GHSA-jg22-mg44-37j8 — AIOHTTP is Vulnerable to Deserialization of Untrusted Data 2026-10-02T23:54:47.035431+00:00

Affected: PyPI: aiohttp

### Summary

Using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution.

### Impact

Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.

### Workaround

If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitise the files before loading.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00

 https://cve.radiocsirt.org/vuln/oesa-2026-2562 OESA-2026-2562 — python-aiohttp security update 2026-10-02T23:54:47.035457+00:00

Affected: openEuler:24.03-LTS-SP1: python-aiohttp

Async http client/server framework (asyncio). Security Fix(es):

Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.(CVE-2026-34993)

If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.(CVE-2026-47265)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10963-1 openSUSE-SU-2026:10963-1 — python311-aiohttp-3.14.0-1.1 on GA media 2026-10-02T23:54:47.035479+00:00

python311-aiohttp-3.14.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-2104 PYSEC-2026-2104 2026-10-02T23:54:47.035496+00:00

Affected: PyPI: aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

 https://cve.radiocsirt.org/vuln/rhsa-2026:24977 RHSA-2026:24977 — Red Hat Security Advisory: RHOAI 2.25.7 - Red Hat OpenShift AI 2026-10-02T23:54:47.035517+00:00

bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests golang: net/url: Memory exhaustion in query parameter parsing in net/url axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization aiohttp: aiohttp: Denial of Service via specially crafted POST request aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request keras: Keras: Arbitrary Code Execution Vulnerability Bypassing Safe Mode lodash: lodash: Arbitrary code execution via untrusted input in template imports fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID pytorch: PyTorch: Arbitrary code execution via malicious checkpoint file loading xgrammar: xgrammar: Denial of Service via multi-level nested syntax vLLM: vLLM: Server-Side Request Forgery bypass via inconsistent URL parsing onnx: ONNX: Information Disclosure via Path Traversal Vulnerability vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting onnx: ONNX: Untrusted Model Repository Warnings Suppressed python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution svgo: SVGO: Denial of Service via XML entity expansion tornado-pyth…

 https://cve.radiocsirt.org/vuln/suse-su-2026:22173-1 SUSE-SU-2026:22173-1 — Security update for python-aiohttp 2026-10-02T23:54:47.035596+00:00

Security update for python-aiohttp

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-34993 UBUNTU-CVE-2026-34993 2026-10-02T23:54:47.035618+00:00

Affected: Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp, Ubuntu:Pro:26.04:LTS: python-aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.