https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T15:29:13.277199+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0934 certfr-2026-avi-0934 — De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un at… 2026-10-02T15:29:13.356346+00:00 certfr-2026-avi-0934 https://cve.radiocsirt.org/vuln/cleanstart-2026-af22825 CLEANSTART-2026-AF22825 — Security fix for CVE-2026-47838 applied in: apache-nifi 2.6.0-r3, rundeck 6.0.0-r0 2026-10-02T15:29:13.356392+00:00

Affected: CleanStart: apache-nifi, CleanStart: rundeck

CVE-2026-47838 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-331450 EUVD-2026-331450 2026-10-02T15:29:13.356427+00:00 EUVD-2026-331450 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47838 fkie_cve-2026-47838 2026-10-02T15:29:13.356441+00:00

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.

Affected versions: Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.

 https://cve.radiocsirt.org/vuln/ghsa-293q-567p-wmwq GHSA-293q-567p-wmwq — Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates 2026-10-02T15:29:13.356465+00:00

Affected: Maven: org.springframework.security:spring-security-web

In Spring Security Web, `SubjectDnX509PrincipalExtractor` does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.

`SubjectDnX509PrincipalExtractor` is deprecated by this CVE and replaced with `SubjectX500PrincipalExtractor`. As part of updating, you should also migrate to `SubjectX500PrincipalExtractor`.

Affected versions: Spring Security Enterprise 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10. OSS 6.5.0 through 6.5.10.

 https://cve.radiocsirt.org/vuln/ncsc-2026-0325 NCSC-2026-0325 — Kwetsbaarheden verholpen in Atlassian producten 2026-10-02T15:29:13.356494+00:00 NCSC-2026-0325 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1869 WID-SEC-W-2026-1869 — VMware Tanzu Spring Security: Mehrere Schwachstellen 2026-10-02T15:29:13.356591+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Security ausnutzen, um einen Denial of Service zu verursachen, beliebigen Code auszuführen, Benutzer auf beliebige Websites umzuleiten, Informationen offenzulegen und die Identität eines anderen Benutzers anzunehmen.