https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T10:13:14.767881+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T10:13:14.825705+00:00 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/cleanstart-2026-dl82237 CLEANSTART-2026-DL82237 — Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities 2026-10-03T10:13:14.825754+00:00

Affected: CleanStart: wildfly

Security vulnerability affects the wildfly package. Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities.

 https://cve.radiocsirt.org/vuln/euvd-2026-349183 EUVD-2026-349183 2026-10-03T10:13:14.825796+00:00 EUVD-2026-349183 https://cve.radiocsirt.org/vuln/fkie_cve-2026-65432 fkie_cve-2026-65432 2026-10-03T10:13:14.825815+00:00

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

 https://cve.radiocsirt.org/vuln/ghsa-jvhw-7q2c-2r65 GHSA-jvhw-7q2c-2r65 2026-10-03T10:13:14.825852+00:00

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2682 WID-SEC-W-2026-2682 — Apache CXF: Mehrere Schwachstellen 2026-10-03T10:13:14.825879+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.