https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T12:28:00.769145+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-0636 CVE-2026-0636 — LDAP Injection Vulnerability in LDAPStoreHelper.java 2026-10-02T12:28:00.794489+00:00

Affected: Legion of the Bouncy Castle Inc. BC-JAVA, Red Hat AMQ Broker 7.12.7, Red Hat AMQ Broker 7.13.5, Red Hat AMQ Broker 7.14.1, Red Hat Build of Apache Camel 4.14 for Quarkus 3.27, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Red Hat build of Quarkus 3.20.6.SP1, Red Hat build of Quarkus 3.27.3.SP1, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 and 35 more

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).

This vulnerability is associated with program files LDAPStoreHelper.

This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

 https://cve.radiocsirt.org/vuln/ghsa-287c-fxr7-3w6c GHSA-287c-fxr7-3w6c — Apache Neethi doesn't impose any restrictions on URIs when manually fetching remote policy references through the Polic… 2026-10-02T12:28:00.794643+00:00

Affected: Maven: org.apache.neethi:neethi

Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden.

Users are recommended to upgrade to version 3.2.2, which fixes this issue.