https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T12:44:12.905554+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-09088 bdu:2026-09088 2026-10-03T12:44:13.310108+00:00 bdu:2026-09088 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0788 certfr-2026-avi-0788 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T12:44:13.310176+00:00 certfr-2026-avi-0788 https://cve.radiocsirt.org/vuln/cleanstart-2026-ed10498 CLEANSTART-2026-ED10498 — Security fix for CVE-2026-44290 applied in: azure-functions-node 4.1052.200-r0, jitsucom-jitsu 2.14.0-r1 2026-10-03T12:44:13.310199+00:00

Affected: CleanStart: azure-functions-node, CleanStart: jitsucom-jitsu

CVE-2026-44290 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-318499 EUVD-2026-318499 2026-10-03T12:44:13.310234+00:00 EUVD-2026-318499 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44290 fkie_cve-2026-44290 2026-10-03T12:44:13.310247+00:00

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.

 https://cve.radiocsirt.org/vuln/ghsa-jvwf-75h9-cwgg GHSA-jvwf-75h9-cwgg — protobuf.js: Process-wide denial of service through unsafe option paths 2026-10-03T12:44:13.310270+00:00

Affected: npm: protobufjs

## Summary

protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality.

## Impact

An attacker who can provide or influence protobuf schemas or JSON descriptors may be able to corrupt built-in process state in a way that causes subsequent application code or protobufjs code to fail. This can result in a persistent denial of service for the lifetime of the affected process.

This issue affects applications that parse or load protobuf schemas or descriptors from untrusted sources. Applications that use bundled, generated, or otherwise trusted schemas to decode untrusted protobuf message payloads are not directly affected.

The issue is not known to allow code execution by itself.

## Preconditions

- The application must allow an attacker to control or influence a protobuf schema or JSON descriptor. - The application must parse or load that schema through protobufjs reflection APIs such as `parse`, `Root.load`, `Root.loadSync`, or `Root.fromJSON`. - The crafted input must contain option paths that reach unsafe inherited properties during option processing.

## Workarounds

Do not parse or load protobuf schemas or JSON descriptors from untrusted sources with affected versions. If untrusted schemas must be accepted, validate or reject option na…

 https://cve.radiocsirt.org/vuln/rhsa-2026:42815 RHSA-2026:42815 — Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update 2026-10-03T12:44:13.310310+00:00

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding protobufjs: protobufjs: Denial of Service via crafted schema protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution protobufjs: protobufjs: Data integrity impact due to prototype pollution protobufjs: protobufjs: Denial of Service via crafted JSON descriptors linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution tar: node-tar: Denial of Service via crafted gzip bomb tar: Node-tar: Denial of Service via malformed tar archive header

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2452 WID-SEC-W-2026-2452 — Red Hat Ansible Automation Platform (node-tar, linkify-it, protobufjs, brace-expansion, fast-uri, DOMPurify): Mehrere S… 2026-10-03T12:44:13.310347+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder beliebigen Code auszuführen.