https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T12:07:38.594443+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-07453 bdu:2025-07453 2026-10-02T12:07:38.785909+00:00 bdu:2025-07453 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0724 certfr-2025-avi-0724 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-02T12:07:38.785952+00:00 certfr-2025-avi-0724 https://cve.radiocsirt.org/vuln/euvd-2026-245622 EUVD-2026-245622 2026-10-02T12:07:38.785971+00:00 EUVD-2026-245622 https://cve.radiocsirt.org/vuln/fkie_cve-2025-6545 fkie_cve-2025-6545 2026-10-02T12:07:38.785983+00:00

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js.

This issue affects pbkdf2: from 3.0.10 through 3.1.2.

 https://cve.radiocsirt.org/vuln/ghsa-h7cp-r72f-jxh6 GHSA-h7cp-r72f-jxh6 — pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos 2026-10-02T12:07:38.786013+00:00

Affected: npm: pbkdf2

### Summary

This affects both: 1. Unsupported algos (e.g. `sha3-256` / `sha3-512` / `sha512-256`) 2. Supported but non-normalized algos (e.g. `Sha256` / `Sha512` / `SHA1` / `sha-1` / `sha-256` / `sha-512`)

All of those work correctly in Node.js, but this polyfill silently returns highly predictable ouput

Under Node.js (only with `pbkdf2/browser` import, unlikely) / Bun (`pbkdf2` top-level import is affected), the memory is not zero-filled but is uninitialized, as `Buffer.allocUnsafe` is used

Under browsers, it just returns zero-filled buffers (Which is also critical, those are completely unacceptable as kdf output and ruin security)

### Were you affected?

The full list of arguments that were **not** affected were literal: * `'md5'` * `'sha1'` * `'sha224'` * `'sha256'` * `'sha384'` * `'sha512'` * `'rmd160'` * `'ripemd160'`

Any other arguments, e.g. representation variations of the above ones like `'SHA-1'`/`'sha-256'`/`'SHA512'` or different algos like `'sha3-512'`/`'blake2b512'`, while supported on Node.js `crypto` module, returned predictable output on `pbkdf2` (or `crypto` browser/bundlers polyfill)

---

Beware of packages re-exporting this under a different signature, like (abstract): ```js const crypto = require('crypto') module.exports.deriveKey = (algo, pass, salt) => crypto.pbkdf2Sync(pass, salt, 2048, 64, algo) ```

In this case, the resulting `deriveKey` method is also affected (to the same extent / conditions as listed here).

### Environments

T…

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15280-1 openSUSE-SU-2025:15280-1 — python311-pytest-html-4.1.1-6.1 on GA media 2026-10-02T12:07:38.786081+00:00

python311-pytest-html-4.1.1-6.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2025:10738 RHSA-2025:10738 — Red Hat Security Advisory: Kiali 2.4.7 for Red Hat OpenShift Service Mesh 3.0 2026-10-02T12:07:38.786100+00:00

pbkdf2: pbkdf2 silently returns predictable key material pbkdf2: pbkdf2 silently returns static keys

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-6545 UBUNTU-CVE-2025-6545 2026-10-02T12:07:38.786117+00:00

Affected: Ubuntu:Pro:18.04:LTS: node-pbkdf2, Ubuntu:Pro:20.04:LTS: node-pbkdf2, Ubuntu:Pro:22.04:LTS: node-pbkdf2, Ubuntu:Pro:24.04:LTS: node-pbkdf2

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1409 WID-SEC-W-2025-1409 — IBM App Connect Enterprise: Mehrere Schwachstellen ermöglichen Manipulation von Daten 2026-10-02T12:07:38.786140+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Daten zu manipulieren.