https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T21:50:05.724380+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-04T21:50:07.037915+00:00 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/euvd-2026-341385 EUVD-2026-341385 2026-10-04T21:50:07.037994+00:00 EUVD-2026-341385 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45623 fkie_cve-2026-45623 2026-10-04T21:50:07.038017+00:00

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.

 https://cve.radiocsirt.org/vuln/ghsa-6g55-p6wh-862q GHSA-6g55-p6wh-862q — PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments 2026-10-04T21:50:07.038059+00:00

Affected: npm: postcss

## Summary

PostCSS's `PreviousMap` parses the `/*# sourceMappingURL=PATH */` comment from any CSS string passed to `process()` and dereferences `PATH` against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting `JSON.parse` `SyntaxError` message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no `from`, no `map`, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.).

## Details

The dangerous chain lives in `lib/previous-map.js` and is wired into every `Input` construction at `lib/input.js:70-77`.

`Input` constructor (`lib/input.js:70-77`):

```js if (pathAvailable && sourceMapAvailable) { let map = new PreviousMap(this.css, opts) if (map.text) { this.map = map let file = map.consumer().file if (!this.file && file) this.file = this.mapResolve(file) } } ```

`PreviousMap` constructor (`lib/previous-map.js:17-29`):

```js constructor(css, opts) { if (opts.map === false) return this.loadAnnotation(css) this.inline = this.start…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-45623 msrc_CVE-2026-45623 — PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments 2026-10-04T21:50:07.038145+00:00 msrc_CVE-2026-45623 https://cve.radiocsirt.org/vuln/ncsc-2026-0325 NCSC-2026-0325 — Kwetsbaarheden verholpen in Atlassian producten 2026-10-04T21:50:07.038164+00:00 NCSC-2026-0325 https://cve.radiocsirt.org/vuln/rhsa-2026:54427 RHSA-2026:54427 — Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.15.5 security update 2026-10-04T21:50:07.038274+00:00

github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation postcss: PostCSS: Information disclosure and denial of service via crafted CSS input console: Stored DOM XSS via unescaped pod logs in document.write

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45623 UBUNTU-CVE-2026-45623 2026-10-04T21:50:07.038305+00:00

Affected: Ubuntu:20.04:LTS: node-postcss, Ubuntu:22.04:LTS: node-postcss, Ubuntu:24.04:LTS: node-postcss, Ubuntu:26.04:LTS: node-postcss

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2923 WID-SEC-W-2026-2923 — Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen 2026-10-04T21:50:07.038339+00:00

Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence, Atlassian Crucible, Atlassian Fisheye und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.