https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:08:09.529647+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1078 certfr-2026-avi-1078 — De multiples vulnérabilités ont été découvertes dans Keycloak. Elles permettent à un attaquant de provoquer un contourn… 2026-10-03T19:08:09.752351+00:00 certfr-2026-avi-1078 https://cve.radiocsirt.org/vuln/cleanstart-2026-am39668 Withdrawn: CLEANSTART-2026-AM39668 — yawkat LZ4 Java provides LZ4 compression for Java 2026-10-03T19:08:09.752412+00:00

Withdrawn by the publisher.

Affected: CleanStart: apache-nifi

Multiple security vulnerabilities affect the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-336637 EUVD-2026-336637 2026-10-03T19:08:09.752449+00:00 EUVD-2026-336637 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59888 fkie_cve-2026-59888 2026-10-03T19:08:09.752463+00:00

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.

 https://cve.radiocsirt.org/vuln/ghsa-3pjw-73gf-8qr5 GHSA-3pjw-73gf-8qr5 — jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy 2026-10-03T19:08:09.752489+00:00

Affected: Maven: com.fasterxml.jackson.core:jackson-databind, Maven: tools.jackson.core:jackson-databind

## Summary For Java Records, `POJOPropertiesCollector._removeUnwantedIgnorals()` records a `@JsonIgnore`-annotated component under its original implicit name before `_renameUsing()` applies the `PropertyNamingStrategy`. After the rename, `_ignoredPropertyNames` still holds only the pre-rename name, so `_ignorableProps` is built from the stale key. The renamed JSON key passes `IgnorePropertiesUtil.shouldIgnore()` and is assigned to the Record's constructor parameter, defeating the `@JsonIgnore`.

## Impact A Record using a naming strategy that relies on `@JsonIgnore` to keep an internal/privileged component out of deserialization can have that component set from the wire via its renamed key (e.g. a role/flag controlled by an untrusted client).

## Affected / Patched (verified via `git tag --contains`) - 2.15-2.18 line: `>= 2.15.0, < 2.18.8` -> fixed in **2.18.8** (backport `c7c6783`) - 2.19-2.21 line: `>= 2.19.0, < 2.21.4` -> fixed in **2.21.4** - 3.x line: `>= 3.0.0, < 3.1.4` -> fixed in **3.1.4** (#5974, `baa2cdf`)

## Severity / CWE Maintainer: minor. Reporter: Moderate. CWE-915; related CWE-345.

## Credits Omkhar Arasaratnam (@omkhar) - finder.

 https://cve.radiocsirt.org/vuln/ncsc-2026-0326 NCSC-2026-0326 — Kwetsbaarheden verholpen in Keycloak 2026-10-03T19:08:09.752535+00:00 NCSC-2026-0326 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11279-1 openSUSE-SU-2026:11279-1 — jackson-databind-2.18.9-2.1 on GA media 2026-10-03T19:08:09.752565+00:00

jackson-databind-2.18.9-2.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:54440 RHSA-2026:54440 — Red Hat Security Advisory: Red Hat Lightspeed (formerly Insights) for Runtimes security update 2026-10-03T19:08:09.752583+00:00

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

 https://cve.radiocsirt.org/vuln/suse-su-2026:22822-1 SUSE-SU-2026:22822-1 — Security update for jackson-annotations, jackson-core, jackson-databind 2026-10-03T19:08:09.752605+00:00

Security update for jackson-annotations, jackson-core, jackson-databind

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59888 UBUNTU-CVE-2026-59888 2026-10-03T19:08:09.752622+00:00

Affected: Ubuntu:Pro:14.04:LTS: jackson-databind, Ubuntu:Pro:16.04:LTS: jackson-databind, Ubuntu:18.04:LTS: jackson-databind, Ubuntu:20.04:LTS: jackson-databind, Ubuntu:22.04:LTS: jackson-databind, Ubuntu:24.04:LTS: jackson-databind, Ubuntu:26.04:LTS: jackson-databind

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2350 WID-SEC-W-2026-2350 — FasterXML Jackson: Mehrere Schwachstellen 2026-10-03T19:08:09.752659+00:00

Ein Angreifer kann mehrere Schwachstellen in FasterXML Jackson ausnutzen, um Daten zu manipulieren und Sicherheitsvorkehrungen zu umgehen.