https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T22:29:30.269292+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-338143 EUVD-2026-338143 2026-10-16T22:29:30.375806+00:00 EUVD-2026-338143 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26032 fkie_cve-2026-26032 2026-10-16T22:29:30.375855+00:00

The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version.

If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten.

In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences.

Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.

 https://cve.radiocsirt.org/vuln/ghsa-j482-hm6j-v5jj GHSA-j482-hm6j-v5jj 2026-10-16T22:29:30.375897+00:00

The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version.

If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten.

In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences.

Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11326-1 openSUSE-SU-2026:11326-1 — apache-ivy-2.6.0-1.1 on GA media 2026-10-16T22:29:30.375922+00:00

apache-ivy-2.6.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2026:22858-1 SUSE-SU-2026:22858-1 — Security update for apache-ivy 2026-10-16T22:29:30.375941+00:00

Security update for apache-ivy

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-26032 UBUNTU-CVE-2026-26032 2026-10-16T22:29:30.375970+00:00

Affected: Ubuntu:14.04:LTS: ivy, Ubuntu:16.04:LTS: ivy, Ubuntu:18.04:LTS: ivy, Ubuntu:20.04:LTS: ivy, Ubuntu:22.04:LTS: ivy, Ubuntu:24.04:LTS: ivy, Ubuntu:26.04:LTS: ivy

The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version. If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten. In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences. Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2373 WID-SEC-W-2026-2373 — Apache Ivy: Schwachstelle ermöglicht Manipulation von Dateien 2026-10-16T22:29:30.376005+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Apache Ivy ausnutzen, um Dateien zu manipulieren.