https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T14:33:38.698617+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-be61221 Withdrawn: CLEANSTART-2026-BE61221 — Security fixes for CVE-2025-62718, CVE-2025-69873, CVE-2026-29045, CVE-2026-29085, CVE-2026-29086, CVE-2026-29087, CVE-… 2026-10-04T14:33:38.759555+00:00

Withdrawn by the publisher.

Affected: CleanStart: opensearch-dashboards-fips

Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-281275 EUVD-2026-281275 2026-10-04T14:33:38.759615+00:00 EUVD-2026-281275 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39409 fkie_cve-2026-39409 2026-10-04T14:33:38.759632+00:00

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior. This vulnerability is fixed in 4.12.12.

 https://cve.radiocsirt.org/vuln/ghsa-xpcf-pg52-r92g GHSA-xpcf-pg52-r92g — Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses 2026-10-04T14:33:38.759657+00:00

Affected: npm: hono

## Summary

`ipRestriction()` does not canonicalize IPv4-mapped IPv6 client addresses (e.g. `::ffff:127.0.0.1`) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior.

## Details

The middleware classifies client addresses based on their textual form. Addresses containing "`:`" are treated as IPv6, including IPv4-mapped IPv6 addresses such as `::ffff:127.0.0.1`. These addresses are not normalized to IPv4 before matching.

As a result:

* IPv4 static rules (e.g. `127.0.0.1`) do not match because the raw string differs * IPv4 CIDR rules (e.g. `127.0.0.0/8`, `10.0.0.0/8`) are skipped because the address is treated as IPv6

For example, with:

`denyList: ['127.0.0.1']`

a request from `127.0.0.1` may be represented as `::ffff:127.0.0.1` and bypass the deny rule.

This behavior commonly occurs in Node.js environments where IPv4 clients are exposed as IPv4-mapped IPv6 addresses.

## Impact

Applications that rely on IPv4-based `ipRestriction()` rules may incorrectly allow or deny requests.

In affected deployments, a denied IPv4 client may bypass access restrictions. Conversely, legitimate clients may be rejected when using IPv4 allow lists.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1407 WID-SEC-W-2026-1407 — IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen 2026-10-04T14:33:38.759695+00:00

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise Certified Container ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.