https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:07:40.422674+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-15307 bdu:2026-15307 2026-10-03T04:07:40.559746+00:00 bdu:2026-15307 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0731 certfr-2026-avi-0731 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un at… 2026-10-03T04:07:40.559802+00:00 certfr-2026-avi-0731 https://cve.radiocsirt.org/vuln/euvd-2026-377665 EUVD-2026-377665 2026-10-03T04:07:40.559822+00:00 EUVD-2026-377665 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42789 fkie_cve-2026-42789 2026-10-03T04:07:40.559834+00:00

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery.

In lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement.

Any party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.21, OTP 27.3.4.12, OTP 28.5.0.1, and OTP 29.0.1, corresponding to public_key from 0.22 before 1.15.1.7, 1.17.1.3, 1.20.3.1, and 1.…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-42789 msrc_CVE-2026-42789 — Non-CA certificate accepted as intermediate issuer in public_key path validation 2026-10-03T04:07:40.559879+00:00 msrc_CVE-2026-42789 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10947-1 openSUSE-SU-2026:10947-1 — erlang27-27.1.3-2.1 on GA media 2026-10-03T04:07:40.559906+00:00

erlang27-27.1.3-2.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:39809 RHSA-2026:39809 — Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (erlang) security update 2026-10-03T04:07:40.559932+00:00

erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing

 https://cve.radiocsirt.org/vuln/suse-su-2026:22082-1 SUSE-SU-2026:22082-1 — Security update for erlang 2026-10-03T04:07:40.559951+00:00

Security update for erlang

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42789 UBUNTU-CVE-2026-42789 2026-10-03T04:07:40.559968+00:00

Affected: Ubuntu:Pro:14.04:LTS: erlang, Ubuntu:Pro:16.04:LTS: erlang, Ubuntu:Pro:18.04:LTS: erlang, Ubuntu:Pro:20.04:LTS: erlang, Ubuntu:22.04:LTS: erlang, Ubuntu:24.04:LTS: erlang, Ubuntu:25.10: erlang, Ubuntu:26.04:LTS: erlang

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement. Any party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers. This issue affects OTP from OTP 17.0 before OTP 26.2.5.21, OTP 27.3.4.12, OTP 28.5.0.1, and OTP 29.0.1, corresponding to public_key from 0.22 before 1.15.1.7, 1.17.1.3, 1.20.3.1, and 1.21.…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1719 WID-SEC-W-2026-1719 — Erlang/OTP: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen 2026-10-03T04:07:40.560012+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Erlang/OTP ausnutzen, um Sicherheitsvorkehrungen zu umgehen.