https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:54:26.246425+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-fv05780 Withdrawn: CLEANSTART-2026-FV05780 — Security fixes in langfuse 3.213.0-r1 2026-10-02T14:54:26.252657+00:00

Withdrawn by the publisher.

Affected: CleanStart: langfuse

Package langfuse version 3.213.0-r1 fixes 24 vulnerabilities: CVE-2026-59895, CVE-2026-59896, CVE-2026-59897, CVE-2026-69207, CVE-2026-71848...

 https://cve.radiocsirt.org/vuln/euvd-2026-341423 EUVD-2026-341423 2026-10-02T14:54:26.252705+00:00 EUVD-2026-341423 https://cve.radiocsirt.org/vuln/fkie_cve-2026-64641 fkie_cve-2026-64641 2026-10-02T14:54:26.252721+00:00

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.

 https://cve.radiocsirt.org/vuln/ghsa-m99w-x7hq-7vfj GHSA-m99w-x7hq-7vfj — Next.js: Denial of Service in App Router using Server Actions 2026-10-02T14:54:26.252745+00:00

Affected: npm: next

## Impact

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

## Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

 https://cve.radiocsirt.org/vuln/rhsa-2026:54435 RHSA-2026:54435 — Red Hat Security Advisory: Streams for Apache Kafka 3.2.1 release and security update 2026-10-02T14:54:26.252768+00:00

eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2468 WID-SEC-W-2026-2468 — Vercel Next.js: Mehrere Schwachstellen 2026-10-02T14:54:26.252850+00:00

Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Daten zu manipulieren, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.