https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T09:38:28.311177+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-375225 EUVD-2026-375225 2026-10-05T09:38:28.395097+00:00 EUVD-2026-375225 https://cve.radiocsirt.org/vuln/fkie_cve-2026-95521 fkie_cve-2026-95521 2026-10-05T09:38:28.395136+00:00

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

 https://cve.radiocsirt.org/vuln/ghsa-7prr-g333-3h48 GHSA-7prr-g333-3h48 2026-10-05T09:38:28.395171+00:00

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-95521 msrc_CVE-2026-95521 — Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm 2026-10-05T09:38:28.395189+00:00 msrc_CVE-2026-95521 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-95521 UBUNTU-CVE-2026-95521 2026-10-05T09:38:28.395208+00:00

Affected: Ubuntu:Pro:14.04:LTS: rpm, Ubuntu:Pro:16.04:LTS: rpm, Ubuntu:Pro:18.04:LTS: rpm, Ubuntu:Pro:20.04:LTS: rpm, Ubuntu:22.04:LTS: rpm, Ubuntu:24.04:LTS: rpm, Ubuntu:26.04:LTS: rpm

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3567 WID-SEC-W-2026-3567 — RPM: Mehrere Schwachstellen ermöglichen Codeausführung 2026-10-05T09:38:28.395253+00:00

Ein Angreifer kann mehrere Schwachstellen in RPM ausnutzen, um beliebigen Programmcode auszuführen.