https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-23T18:29:32.729902+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2020-01708 bdu:2020-01708 2026-10-23T18:29:32.834229+00:00 bdu:2020-01708 https://cve.radiocsirt.org/vuln/certfr-2019-avi-199 certfr-2019-avi-199 — Une vulnérabilité a été découverte dans Drupal . Elle permet à un attaquant de provoquer un contournement de la politiq… 2026-10-23T18:29:32.834297+00:00 certfr-2019-avi-199 https://cve.radiocsirt.org/vuln/cnvd-2019-14071 cnvd-2019-14071 2026-10-23T18:29:32.834319+00:00 cnvd-2019-14071 https://cve.radiocsirt.org/vuln/euvd-2026-54627 EUVD-2026-54627 2026-10-23T18:29:32.834333+00:00 EUVD-2026-54627 https://cve.radiocsirt.org/vuln/fkie_cve-2019-11831 fkie_cve-2019-11831 2026-10-23T18:29:32.834346+00:00

The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.

 https://cve.radiocsirt.org/vuln/ghsa-xv7v-rf6g-xwrc GHSA-xv7v-rf6g-xwrc — Directory Traversal in typo3/phar-stream-wrapper 2026-10-23T18:29:32.834378+00:00

Affected: Packagist: typo3/phar-stream-wrapper, Packagist: drupal/core, Packagist: drupal/drupal

The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.

 https://cve.radiocsirt.org/vuln/gsd-2019-11831 gsd-2019-11831 2026-10-23T18:29:32.834412+00:00 gsd-2019-11831 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-11831 UBUNTU-CVE-2019-11831 2026-10-23T18:29:32.834424+00:00

Affected: Ubuntu:Pro:14.04:LTS: drupal7, Ubuntu:Pro:16.04:LTS: drupal7

The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.