https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-14T20:58:01.041371+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-41075 CVE-2026-41075 — RT: SQL injection via entry_aggregator parameter in JSON search 2026-10-14T20:58:01.075244+00:00

Affected: bestpractical rt

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 contain an SQL injection vulnerability. An authenticated user can craft input that is incorporated into database queries without proper validation, potentially allowing them to read or modify data in the RT database. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by restricting RT account access to trusted users.

 https://cve.radiocsirt.org/vuln/usn-8506-1 USN-8506-1 — request-tracker5 vulnerabilities 2026-10-14T20:58:01.075305+00:00

Affected: Ubuntu:Pro:22.04:LTS: request-tracker5, Ubuntu:Pro:24.04:LTS: request-tracker5, Ubuntu:Pro:26.04:LTS: request-tracker5

Aleksander Iwicki discovered that Request Tracker did not properly sanitize the search "Page" URL parameter. A remote attacker could possibly use this issue to conduct a reflected cross-site scripting attack. (CVE-2026-6841)

It was discovered that Request Tracker did not properly sanitize user- controlled data written to spreadsheet exports of search results. A remote attacker could possibly use this issue to conduct a spreadsheet (CSV/formula) injection attack, causing spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. (CVE-2026-41073)

It was discovered that Request Tracker did not properly validate input incorporated into database queries via the entry_aggregator parameter in JSON search. An authenticated user could possibly use this issue to perform SQL injection attacks and read or modify data in the RT database. (CVE-2026-41075)

It was discovered that Request Tracker contained an authentication bypass when configured to authenticate users against an LDAP or Active Directory server. Under certain LDAP server configurations, a remote attacker could possibly use this issue to authenticate as any LDAP-backed RT user without supplying valid credentials. (CVE-2026-41076)

It was discovered that Request Tracker served certain uploaded content inline rather than as an attachment. A remote attacker could possibly use this issue to conduct a cross-site scripting attack. (CVE-2026-44229)

It was discovered that Request Tracker di…