https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T02:50:15.095927+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-330445 EUVD-2026-330445 2026-10-04T02:50:15.099599+00:00 EUVD-2026-330445 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39948 fkie_cve-2026-39948 2026-10-04T02:50:15.099631+00:00

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv() (rather than gfrv() with FILTER_VALIDATE_IS_REGEX validation) and concatenated directly into RLIKE SQL clauses in lib/html_graph.php and lib/html_tree.php, which are reachable pre-authentication through graph_view.php on installations with guest graph viewing enabled. Because the unbalanced-quote payload bypasses the regex validation that would otherwise reject it, an unauthenticated attacker can inject arbitrary SQL to compromise the confidentiality, integrity, and availability of the database. This advisory is similar to GHSA-69gg-mjfm-jjpc. This issue has been fixed in version 1.2.31.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-39948 UBUNTU-CVE-2026-39948 2026-10-04T02:50:15.099665+00:00

Affected: Ubuntu:Pro:14.04:LTS: cacti, Ubuntu:Pro:16.04:LTS: cacti, Ubuntu:Pro:18.04:LTS: cacti, Ubuntu:Pro:20.04:LTS: cacti, Ubuntu:Pro:22.04:LTS: cacti, Ubuntu:24.04:LTS: cacti, Ubuntu:25.10: cacti, Ubuntu:26.04:LTS: cacti

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv() (rather than gfrv() with FILTER_VALIDATE_IS_REGEX validation) and concatenated directly into RLIKE SQL clauses in lib/html_graph.php and lib/html_tree.php, which are reachable pre-authentication through graph_view.php on installations with guest graph viewing enabled. Because the unbalanced-quote payload bypasses the regex validation that would otherwise reject it, an unauthenticated attacker can inject arbitrary SQL to compromise the confidentiality, integrity, and availability of the database. This advisory is similar to GHSA-69gg-mjfm-jjpc. This issue has been fixed in version 1.2.31.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1931 WID-SEC-W-2026-1931 — Cacti: Mehrere Schwachstellen 2026-10-04T02:50:15.099700+00:00

Ein Angreifer kann mehrere Schwachstellen in Cacti ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, um Dateien zu manipulieren, und um Informationen offenzulegen.