https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T02:15:57.898683+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-09096 bdu:2026-09096 2026-10-03T02:15:57.995361+00:00 bdu:2026-09096 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 certfr-2026-avi-0901 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T02:15:57.995402+00:00 certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/cleanstart-2026-wq90566 CLEANSTART-2026-WQ90566 — Security fix for CVE-2026-44579 applied in: jitsucom-jitsu 2.14.0-r1 2026-10-03T02:15:57.995421+00:00

Affected: CleanStart: jitsucom-jitsu

Security vulnerability affects the jitsucom-jitsu package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-351883 EUVD-2026-351883 2026-10-03T02:15:57.995450+00:00 EUVD-2026-351883 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44579 fkie_cve-2026-44579 2026-10-03T02:15:57.995462+00:00

Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.

 https://cve.radiocsirt.org/vuln/ghsa-mg66-mrh9-m8jx GHSA-mg66-mrh9-m8jx — Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components 2026-10-03T02:15:57.995487+00:00

Affected: npm: next

### Impact

Applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service.

### Fix

We now treat the header used for resuming Partial Prerendered requests as an internal-only header and strip it from untrusted incoming requests. This header should never be accepted directly from external clients.

### Workarounds

If you cannot upgrade immediately, block requests that would be handled by Next.js if they contain the `Next-Resume` header at the edge.

 https://cve.radiocsirt.org/vuln/rhsa-2026:34608 RHSA-2026:34608 — Red Hat Security Advisory: Streams for Apache Kafka 2.9.4 release and security update 2026-10-03T02:15:57.995515+00:00

jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression lodash: prototype pollution in _.unset and _.omit functions netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files lodash: lodash: Arbitrary code execution via untrusted input in template imports eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name react-server-dom-webpack: react-server-dom-parcel: reactreact-server-dom-turbopack: React Server Components: Denial of Service via specially crafted HTTP requests Apache ZooKeeper: Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization ax…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1401 WID-SEC-W-2026-1401 — Vercel Next.js: Mehrere Schwachstellen 2026-10-03T02:15:57.995590+00:00

Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.