https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:09:54.303839+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-175557 EUVD-2026-175557 2026-10-03T19:09:54.376130+00:00 EUVD-2026-175557 https://cve.radiocsirt.org/vuln/fkie_cve-2012-5055 fkie_cve-2012-5055 2026-10-03T19:09:54.376167+00:00

DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.

 https://cve.radiocsirt.org/vuln/ghsa-3533-rvpc-6x56 GHSA-3533-rvpc-6x56 — Exposure of Sensitive Information to an Unauthorized Actor in Spring Security 2026-10-03T19:09:54.376200+00:00

Affected: Maven: org.springframework.security:spring-security-core

DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.

 https://cve.radiocsirt.org/vuln/gsd-2012-5055 gsd-2012-5055 2026-10-03T19:09:54.376227+00:00 gsd-2012-5055 https://cve.radiocsirt.org/vuln/rhsa-2013:0649 RHSA-2013:0649 — Red Hat Security Advisory: Fuse ESB Enterprise 7.1.0 update 2026-10-03T19:09:54.376240+00:00

Security: Ability to determine if username is valid via DaoAuthenticationProvider apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate