https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T13:34:04.593135+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-wa78729 CLEANSTART-2026-WA78729 — In Eclipse Mojarra versions 2 2026-10-04T13:34:05.002292+00:00

Affected: CleanStart: wildfly

Security vulnerability affects the wildfly package. In Eclipse Mojarra versions 2.

 https://cve.radiocsirt.org/vuln/euvd-2026-348598 EUVD-2026-348598 2026-10-04T13:34:05.002408+00:00 EUVD-2026-348598 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46581 fkie_cve-2026-46581 2026-10-04T13:34:05.002440+00:00

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

 https://cve.radiocsirt.org/vuln/ghsa-wrxx-w58g-3gqp GHSA-wrxx-w58g-3gqp 2026-10-04T13:34:05.002495+00:00

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

 https://cve.radiocsirt.org/vuln/rhsa-2026:53644 RHSA-2026:53644 — Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 security pdate 2026-10-04T13:34:05.002538+00:00

bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons picketlink-federation: auth bypass in Picketlink SAML unsolicited-response undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller picketlink-federation: picketlink SAML 2.0 auth bypass via missing assertions openjdk-orb: unauthed class loading via IIOP in EAP undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method wildfly: wildfly-iiop: wildfly-jacorb: Wildfly: Pre-auth denial of service on the IIOP listener org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration du…