https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T20:30:54.881165+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-308757 EUVD-2026-308757 2026-10-18T20:30:54.957911+00:00 EUVD-2026-308757 https://cve.radiocsirt.org/vuln/fkie_cve-2026-7412 fkie_cve-2026-7412 2026-10-18T20:30:54.957953+00:00

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).

 https://cve.radiocsirt.org/vuln/ghsa-gx3v-wxfj-8h24 GHSA-gx3v-wxfj-8h24 — Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery 2026-10-18T20:30:54.957989+00:00

Affected: Maven: org.eclipse.basyx:basyx.sdk

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-7412 UBUNTU-CVE-2026-7412 2026-10-18T20:30:54.958016+00:00

Affected: Ubuntu:16.04:LTS: eclipse, Ubuntu:18.04:LTS: eclipse

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).