https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:19:26.536884+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-06998 bdu:2026-06998 2026-10-03T04:19:26.637812+00:00 bdu:2026-06998 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 certfr-2026-avi-0901 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T04:19:26.637858+00:00 certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/cleanstart-2026-cn04690 CLEANSTART-2026-CN04690 — Security fix for CVE-2026-44573 applied in: jitsucom-jitsu 2.14.0-r1 2026-10-03T04:19:26.637877+00:00

Affected: CleanStart: jitsucom-jitsu

Security vulnerability affects the jitsucom-jitsu package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-351880 EUVD-2026-351880 2026-10-03T04:19:26.637910+00:00 EUVD-2026-351880 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44573 fkie_cve-2026-44573 2026-10-03T04:19:26.637952+00:00

Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.

 https://cve.radiocsirt.org/vuln/ghsa-36qx-fr4f-26g5 GHSA-36qx-fr4f-26g5 — Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n 2026-10-03T04:19:26.637994+00:00

Affected: npm: next

### Impact

Applications using the Pages Router with `i18n` configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less `/_next/data/<buildId>/<page>.json` requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks.

### Fix The matcher logic was updated to perform the same match as it would on a non-i18n data route.

### Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.

 https://cve.radiocsirt.org/vuln/rhsa-2026:34608 RHSA-2026:34608 — Red Hat Security Advisory: Streams for Apache Kafka 2.9.4 release and security update 2026-10-03T04:19:26.638023+00:00

jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression lodash: prototype pollution in _.unset and _.omit functions netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files lodash: lodash: Arbitrary code execution via untrusted input in template imports eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name react-server-dom-webpack: react-server-dom-parcel: reactreact-server-dom-turbopack: React Server Components: Denial of Service via specially crafted HTTP requests Apache ZooKeeper: Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization ax…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1401 WID-SEC-W-2026-1401 — Vercel Next.js: Mehrere Schwachstellen 2026-10-03T04:19:26.638109+00:00

Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.