https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T10:34:36.817058+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07875 bdu:2026-07875 2026-10-03T10:34:36.895908+00:00 bdu:2026-07875 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 certfr-2026-avi-0901 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T10:34:36.895955+00:00 certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/cleanstart-2026-rv40501 CLEANSTART-2026-RV40501 — Security fix for CVE-2026-45109 applied in: jitsucom-jitsu 2.14.0-r1 2026-10-03T10:34:36.895976+00:00

Affected: CleanStart: jitsucom-jitsu

Security vulnerability affects the jitsucom-jitsu package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-351885 EUVD-2026-351885 2026-10-03T10:34:36.896009+00:00 EUVD-2026-351885 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45109 fkie_cve-2026-45109 2026-10-03T10:34:36.896022+00:00

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.

 https://cve.radiocsirt.org/vuln/ghsa-26hh-7cqf-hhc6 GHSA-26hh-7cqf-hhc6 — Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-… 2026-10-03T10:34:36.896046+00:00

Affected: npm: next

### Impact

It was found that the fix addressing [CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) did not apply to `middleware.ts` with Turbopack. Refer to [CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) for further details.

### References

- [CVE CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f)

 https://cve.radiocsirt.org/vuln/rhsa-2026:34608 RHSA-2026:34608 — Red Hat Security Advisory: Streams for Apache Kafka 2.9.4 release and security update 2026-10-03T10:34:36.896072+00:00

jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression lodash: prototype pollution in _.unset and _.omit functions netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files lodash: lodash: Arbitrary code execution via untrusted input in template imports eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name react-server-dom-webpack: react-server-dom-parcel: reactreact-server-dom-turbopack: React Server Components: Denial of Service via specially crafted HTTP requests Apache ZooKeeper: Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization ax…