https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T18:00:56.755306+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349181 EUVD-2026-349181 2026-10-04T18:00:56.807187+00:00 EUVD-2026-349181 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61466 fkie_cve-2026-61466 2026-10-04T18:00:56.807245+00:00

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

 https://cve.radiocsirt.org/vuln/ghsa-pwwh-3685-58r7 GHSA-pwwh-3685-58r7 2026-10-04T18:00:56.807285+00:00

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2682 WID-SEC-W-2026-2682 — Apache CXF: Mehrere Schwachstellen 2026-10-04T18:00:56.807305+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.