https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T17:31:45.303709+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0914 certfr-2026-avi-0914 — De multiples vulnérabilités ont été découvertes dans Oracle Database Server. Elles permettent à un attaquant de provoqu… 2026-10-02T17:31:45.623483+00:00 certfr-2026-avi-0914 https://cve.radiocsirt.org/vuln/cleanstart-2026-am39668 Withdrawn: CLEANSTART-2026-AM39668 — yawkat LZ4 Java provides LZ4 compression for Java 2026-10-02T17:31:45.623564+00:00

Withdrawn by the publisher.

Affected: CleanStart: apache-nifi

Multiple security vulnerabilities affect the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-329763 EUVD-2026-329763 2026-10-02T17:31:45.623615+00:00 EUVD-2026-329763 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54515 fkie_cve-2026-54515 2026-10-02T17:31:45.623639+00:00

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.

 https://cve.radiocsirt.org/vuln/ghsa-5jmj-h7xm-6q6v GHSA-5jmj-h7xm-6q6v — jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties 2026-10-02T17:31:45.623695+00:00

Affected: Maven: com.fasterxml.jackson.core:jackson-databind, Maven: tools.jackson.core:jackson-databind

## Summary In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a `contextual` deserializer whose `BeanPropertyMap` has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by `@JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)`) rebuilds from `this._beanProperties` (the original, unfiltered map) instead of `contextual._beanProperties`, then overwrites the filtered map — restoring every property `_handleByNameInclusion` had just removed. The ignored property becomes writable again.

## Impact An application that both enables case-insensitive matching and relies on per-property `@JsonIgnoreProperties` to keep a field unwritable can have that field set from untrusted JSON (mass-assignment-style write).

## Affected / Patched Will be fixed in 2.18.9, 2.21.5, 2.22.1 and 3.1.4.

## Severity / CWE Maintainer: minor. Reporter: Moderate. CWE-915.

## Upstream fix FasterXML/jackson-databind#5962 (PR #5964, `0e1b0b2`), milestone 3.1.4. Released 2026-06-04.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11118-1 openSUSE-SU-2026:11118-1 — jackson-databind-2.18.8-1.1 on GA media 2026-10-02T17:31:45.623763+00:00

jackson-databind-2.18.8-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:67604 RHSA-2026:67604 — Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 security update 2026-10-02T17:31:45.623795+00:00

artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified artemis-server: Apache Artemis — session hijack via missing authentication com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties

 https://cve.radiocsirt.org/vuln/suse-su-2026:22504-1 SUSE-SU-2026:22504-1 — Security update for jackson-annotations, jackson-core, jackson-databind 2026-10-02T17:31:45.623839+00:00

Security update for jackson-annotations, jackson-core, jackson-databind

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54515 UBUNTU-CVE-2026-54515 2026-10-02T17:31:45.623867+00:00

Affected: Ubuntu:Pro:14.04:LTS: jackson-databind, Ubuntu:Pro:16.04:LTS: jackson-databind, Ubuntu:18.04:LTS: jackson-databind, Ubuntu:20.04:LTS: jackson-databind, Ubuntu:22.04:LTS: jackson-databind, Ubuntu:24.04:LTS: jackson-databind, Ubuntu:25.10: jackson-databind, Ubuntu:26.04:LTS: jackson-databind

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2058 WID-SEC-W-2026-2058 — FasterXML Jackson: Mehrere Schwachstellen 2026-10-02T17:31:45.623928+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in FasterXML Jackson ausnutzen, um Schutzmechanismen und Autorisierungsregeln zu umgehen, Daten zu manipulieren, Informationen offenzulegen oder einen Denial-of-Service zu verursachen.