https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T14:41:39.062714+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1256 certfr-2026-avi-1256 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-05T14:41:41.036550+00:00 certfr-2026-avi-1256 https://cve.radiocsirt.org/vuln/cleanstart-2026-hr55516 CLEANSTART-2026-HR55516 — nanoid is a secure, URL-friendly, unique string ID generator for JavaScript 2026-10-05T14:41:41.036657+00:00

Affected: CleanStart: qdrant

Security vulnerability affects the qdrant package. nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

 https://cve.radiocsirt.org/vuln/euvd-2026-351488 EUVD-2026-351488 2026-10-05T14:41:41.036696+00:00 EUVD-2026-351488 https://cve.radiocsirt.org/vuln/fkie_cve-2026-73086 fkie_cve-2026-73086 2026-10-05T14:41:41.036712+00:00

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.

 https://cve.radiocsirt.org/vuln/ghsa-xwg4-73v4-xw9w GHSA-xwg4-73v4-xw9w — nanoid: Integer Overflow or Wraparound 2026-10-05T14:41:41.036739+00:00

Affected: npm: nanoid

### Summary

An integer overflow in `nanoid(size)` permanently corrupts the process-wide CSPRNG pool, causing all subsequent ID generation to return the deterministic string `"uuuuuuuuuuuuuuuuuuuuu"`. Any application that passes user-influenced values to the `size` parameter loses all randomness guarantees for session tokens, CSRF tokens, and unique identifiers until process restart.

### Details

`nanoid()` at [`index.js:101`](https://github.com/ai/nanoid/blob/main/index.js#L101) coerces the `size` parameter with `size |= 0`, which converts it to a signed 32-bit integer. When `size >= 2^31` (e.g., `2147483648`), this wraps to `-2147483648`.

The negative value is passed to `fillPool()` ([`index.js:15`](https://github.com/ai/nanoid/blob/main/index.js#L15)):

```javascript function fillPool(bytes) { if (!pool || pool.length < bytes) { // false: pool exists, -2B < pool.length pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER) crypto.getRandomValues(pool) poolOffset = 0 } else if (poolOffset + bytes > pool.length) { // false: poolOffset + (-2B) < pool.length crypto.getRandomValues(pool) poolOffset = 0 } poolOffset += bytes // poolOffset += -2147483648 → deeply negative } ```

Neither branch triggers, so the pool is never refreshed. `poolOffset` becomes ~-2.1 billion.

Subsequent `nanoid()` calls execute: ```javascript for (let i = poolOffset - size; i < poolOffset; i++) { id += scopedUrlAlphabet[pool[i] & 63] } ```

`pool[negative_inde…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11680-1 openSUSE-SU-2026:11680-1 — agama-web-ui-24+0.a836cced5-52.1 on GA media 2026-10-05T14:41:41.036795+00:00

agama-web-ui-24+0.a836cced5-52.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:48085 RHSA-2026:48085 — Red Hat Security Advisory: Red Hat Quay 3.18.0 2026-10-05T14:41:41.036824+00:00

pyOpenSSL: DTLS cookie callback buffer overflow authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution svgo: SVGO: Denial of Service via XML entity expansion mirror-registry: remote code execution using pickle deserialization mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens nanoid: nanoid: Predictable ID generation due to integer overflow

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-73086 UBUNTU-CVE-2026-73086 2026-10-05T14:41:41.036857+00:00

Affected: Ubuntu:16.04:LTS: node-mocha, Ubuntu:18.04:LTS: node-mocha, Ubuntu:20.04:LTS: node-mocha, Ubuntu:20.04:LTS: node-postcss, Ubuntu:22.04:LTS: node-postcss, Ubuntu:24.04:LTS: node-postcss, Ubuntu:26.04:LTS: node-postcss

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3376 WID-SEC-W-2026-3376 — Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere Schwachst… 2026-10-05T14:41:41.036890+00:00

Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, serverseitige Request-Forgery-Angriffe (SSRF) durchzuführen, Cross-Site-Scripting-Angriffe zu starten, sensible Informationen offenzulegen, Daten zu manipulieren oder Denial-of-Service-Zustände herbeizuführen.