https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T00:24:18.692885+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-04T00:24:18.700169+00:00 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/cleanstart-2026-de16221 Withdrawn: CLEANSTART-2026-DE16221 — Security fixes for CVE-2026-54171, CVE-2026-54297, CVE-2026-54522, CVE-2026-54904, CVE-2026-54905, CVE-2026-54906, ghsa… 2026-10-04T00:24:18.700209+00:00

Withdrawn by the publisher.

Affected: CleanStart: ruby-fluentd-1.18

Multiple security vulnerabilities affect the ruby-fluentd-1.18 package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-338882 EUVD-2026-338882 2026-10-04T00:24:18.700242+00:00 EUVD-2026-338882 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54171 fkie_cve-2026-54171 2026-10-04T00:24:18.700255+00:00

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

 https://cve.radiocsirt.org/vuln/ghsa-48rx-c7pg-q66r GHSA-48rx-c7pg-q66r — Excon does not redact additional sensitive/risky headers when following redirects 2026-10-04T00:24:18.700278+00:00

Affected: RubyGems: excon

### Impact The redirect follower middleware previously failed to strip a number of headers that are known to be sensitive and did not provide a way to provide a custom list of headers to strip.

_What kind of vulnerability is it? Who is impacted?_ This could cause inadvertent leakage of sensitive data for users of the RedirectFollower middleware in cases where the initial request includes header information that is not intended for the new target.

### Patches Patch exists and is released in v1.5.0

### Workarounds Users can backport the [fix](https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3) to a custom redirect follower middleware.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-54171 msrc_CVE-2026-54171 — Excon: redact additional sensitive/risky headers when following redirects 2026-10-04T00:24:18.700303+00:00 msrc_CVE-2026-54171 https://cve.radiocsirt.org/vuln/oesa-2026-3100 OESA-2026-3100 — rubygem-excon security update 2026-10-04T00:24:18.700319+00:00

Affected: openEuler:20.03-LTS-SP4: rubygem-excon, openEuler:22.03-LTS-SP4: rubygem-excon, openEuler:24.03-LTS-SP1: rubygem-excon, openEuler:24.03-LTS-SP3: rubygem-excon, openEuler:24.03-LTS-SP4: rubygem-excon

EXtended http(s) CONnections. Security Fix(es):

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.(CVE-2026-54171)

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54171 UBUNTU-CVE-2026-54171 2026-10-04T00:24:18.700348+00:00

Affected: Ubuntu:16.04:LTS: ruby-excon, Ubuntu:18.04:LTS: ruby-excon, Ubuntu:20.04:LTS: ruby-excon, Ubuntu:22.04:LTS: ruby-excon, Ubuntu:24.04:LTS: ruby-excon, Ubuntu:26.04:LTS: ruby-excon

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.