https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T10:22:07.135493+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-09110 bdu:2026-09110 2026-10-04T10:22:07.161733+00:00 bdu:2026-09110 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 certfr-2026-avi-0901 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-04T10:22:07.161793+00:00 certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/cleanstart-2026-so65050 CLEANSTART-2026-SO65050 — Security fix for CVE-2026-44580 applied in: jitsucom-jitsu 2.14.0-r1 2026-10-04T10:22:07.161824+00:00

Affected: CleanStart: jitsucom-jitsu

Security vulnerability affects the jitsucom-jitsu package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-318174 EUVD-2026-318174 2026-10-04T10:22:07.161872+00:00 EUVD-2026-318174 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44580 fkie_cve-2026-44580 2026-10-04T10:22:07.161893+00:00

Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vulnerability is fixed in 15.5.16 and 16.2.5.

 https://cve.radiocsirt.org/vuln/ghsa-gx5p-jg67-6x7h GHSA-gx5p-jg67-6x7h — Next.js has cross-site scripting in beforeInteractive scripts with untrusted input 2026-10-04T10:22:07.161932+00:00

Affected: npm: next

### Impact

Applications that use `beforeInteractive` scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser.

### Fix

We now HTML-escape serialized `beforeInteractive` script content before embedding it into the page, preventing attacker-controlled content from breaking out of the inline script boundary.

### Workarounds

If you cannot upgrade immediately, do not pass untrusted data into `beforeInteractive` scripts. If that pattern is unavoidable, sanitize or escape the content before embedding it.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1401 WID-SEC-W-2026-1401 — Vercel Next.js: Mehrere Schwachstellen 2026-10-04T10:22:07.161979+00:00

Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.