https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T23:20:25.369544+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0719 certfr-2026-avi-0719 — De multiples vulnérabilités ont été découvertes dans les produits Spring. Certaines d'entre elles permettent à un attaq… 2026-10-03T23:20:25.437438+00:00 certfr-2026-avi-0719 https://cve.radiocsirt.org/vuln/cleanstart-2026-am39668 Withdrawn: CLEANSTART-2026-AM39668 — yawkat LZ4 Java provides LZ4 compression for Java 2026-10-03T23:20:25.437488+00:00

Withdrawn by the publisher.

Affected: CleanStart: apache-nifi

Multiple security vulnerabilities affect the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-330902 EUVD-2026-330902 2026-10-03T23:20:25.437522+00:00 EUVD-2026-330902 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41694 fkie_cve-2026-41694 2026-10-03T23:20:25.437536+00:00

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.

Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

 https://cve.radiocsirt.org/vuln/ghsa-ww38-37g9-m3q3 GHSA-ww38-37g9-m3q3 — Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads 2026-10-03T23:20:25.437561+00:00

Affected: Maven: org.springframework.security:spring-security-saml2-service-provider

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.

Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1869 WID-SEC-W-2026-1869 — VMware Tanzu Spring Security: Mehrere Schwachstellen 2026-10-03T23:20:25.437597+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Security ausnutzen, um einen Denial of Service zu verursachen, beliebigen Code auszuführen, Benutzer auf beliebige Websites umzuleiten, Informationen offenzulegen und die Identität eines anderen Benutzers anzunehmen.