https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T13:39:33.292635+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-02T13:39:34.404108+00:00 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/cleanstart-2026-bg21634 Withdrawn: CLEANSTART-2026-BG21634 — Security fixes in langfuse-worker 3.216.0-r1 2026-10-02T13:39:34.404193+00:00

Withdrawn by the publisher.

Affected: CleanStart: langfuse-worker

Package langfuse-worker version 3.216.0-r1 fixes 29 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, ghsa-55q2-fjhq-7xh7, ghsa-c2j3-45gr-mqc4, CVE-2026-69192...

 https://cve.radiocsirt.org/vuln/euvd-2026-343847 EUVD-2026-343847 2026-10-02T13:39:34.404231+00:00 EUVD-2026-343847 https://cve.radiocsirt.org/vuln/fkie_cve-2026-69153 fkie_cve-2026-69153 2026-10-02T13:39:34.404245+00:00

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.

 https://cve.radiocsirt.org/vuln/ghsa-fxqj-rqcc-2cmp GHSA-fxqj-rqcc-2cmp — PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `… 2026-10-02T13:39:34.404272+00:00

Affected: npm: postcss

## Summary

The fix for GHSA-6g55-p6wh-862q added a guard in `lib/previous-map.js` `PreviousMap.loadFile()` that restricts an attacker-controlled `sourceMappingURL` (from a CSS comment) to a `.map` extension and, for untrusted maps, rejects `..` traversal and absolute paths. The traversal/absolute rejection is nested inside `if (cssFile) { ... }`. When PostCSS is invoked without the `from` option, `cssFile` is falsy and that branch is skipped, leaving only the `.map` extension check.

`PreviousMap` is constructed by `lib/input.js` whenever `pathAvailable && sourceMapAvailable` (under Node with source-map available), independent of `opts.from`/`opts.map` (the constructor returns early only for `opts.map === false`). So `postcss([]).process(css)` on attacker CSS reaches `loadFile` with `cssFile` undefined, and an attacker `/*# sourceMappingURL=/abs/path/x.map */` (or `../`-traversing path) is read via `readFileSync`. When the file is valid JSON, its `sources` (filesystem paths) and `sourcesContent` (source contents) are disclosed in the generated source map.

## Affected code (v8.5.22 — the release carrying the GHSA-6g55 fix)

```js // lib/previous-map.js loadFile(path, cssFile, trusted) { if (!trusted && !this.unsafeMap) { if (!/\.map$/i.test(path)) { return undefined } if (cssFile) { // guard runs ONLY when `from` is set let relativePath = relative(dirname(cssFile), path) if (relativePath === '..' || relativePat…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-69153 msrc_CVE-2026-69153 — PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from`… 2026-10-02T13:39:34.404332+00:00 msrc_CVE-2026-69153 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11680-1 openSUSE-SU-2026:11680-1 — agama-web-ui-24+0.a836cced5-52.1 on GA media 2026-10-02T13:39:34.404351+00:00

agama-web-ui-24+0.a836cced5-52.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:50070 RHSA-2026:50070 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-02T13:39:34.404376+00:00

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-69153 UBUNTU-CVE-2026-69153 2026-10-02T13:39:34.404391+00:00

Affected: Ubuntu:20.04:LTS: node-postcss, Ubuntu:22.04:LTS: node-postcss, Ubuntu:24.04:LTS: node-postcss, Ubuntu:26.04:LTS: node-postcss

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.