https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:30:43 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:8327 <p><strong>Affected:</strong> AlmaLinux:8: grafana, AlmaLinux:8: grafana-selinux</p> <p>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB.</p> <p>Security Fix(es):</p> <p>* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355) * dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: grafana, AlmaLinux:8: grafana-selinux</p> <p>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB.</p> <p>Security Fix(es):</p> <p>* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355) * dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:8327 https://cve.radiocsirt.org/vuln/bdu:2024-08024 bdu:2024-08024 https://cve.radiocsirt.org/vuln/bdu:2024-08024 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0958 certfr-2024-avi-0958 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0958 https://cve.radiocsirt.org/vuln/euvd-2026-258185 EUVD-2026-258185 https://cve.radiocsirt.org/vuln/euvd-2026-258185 https://cve.radiocsirt.org/vuln/fkie_cve-2024-47875 <p>DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.</p> <p>DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-47875 https://cve.radiocsirt.org/vuln/ghsa-gx9m-whjm-85jf <p><strong>Affected:</strong> npm: dompurify</p> <p>DOMpurify was vulnerable to nesting-based mXSS</p> <p>fixed by [0ef5e537](https://github.com/cure53/DOMPurify/tree/0ef5e537a514f904b6aa1d7ad9e749e365d7185f) (2.x) and [merge 943](https://github.com/cure53/DOMPurify/pull/943)</p> <p>Backporter should be aware of GHSA-mmhx-hmjr-r674 (CVE-2024-45801) when cherry-picking</p> <p>POC is avaible under [test](https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098)</p> <p><strong>Affected:</strong> npm: dompurify</p> <p>DOMpurify was vulnerable to nesting-based mXSS</p> <p>fixed by [0ef5e537](https://github.com/cure53/DOMPurify/tree/0ef5e537a514f904b6aa1d7ad9e749e365d7185f) (2.x) and [merge 943](https://github.com/cure53/DOMPurify/pull/943)</p> <p>Backporter should be aware of GHSA-mmhx-hmjr-r674 (CVE-2024-45801) when cherry-picking</p> <p>POC is avaible under [test](https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098)</p> https://cve.radiocsirt.org/vuln/ghsa-gx9m-whjm-85jf https://cve.radiocsirt.org/vuln/icsa-26-043-03 <p>When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3. Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. curl&#39;s websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.</p> <p>A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy. The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-mid…</p> <p>When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3. Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. curl&#39;s websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.</p> <p>A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy. The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-mid…</p> https://cve.radiocsirt.org/vuln/icsa-26-043-03 https://cve.radiocsirt.org/vuln/opensuse-su-2025:14663-1 <p>velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media</p> <p>velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14663-1 https://cve.radiocsirt.org/vuln/oxas-adv-2025-0001 OXAS-ADV-2025-0001 https://cve.radiocsirt.org/vuln/oxas-adv-2025-0001 https://cve.radiocsirt.org/vuln/rhsa-2024:10236 <p>nodejs-ip: arbitrary code execution via the isPublic() function jsonpath-plus: Remote Code Execution in jsonpath-plus via Improper Input Sanitization node-ip: Incomplete fix for CVE-2023-42282 go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion path-to-regexp: Backtracking regular expressions cause ReDoS find-my-way: ReDoS vulnerability in multiparametric routes dompurify: nesting-based mutation XSS vulnerability elliptic: Missing Validation in Elliptic&#39;s EDDSA Signature Verification</p> <p>nodejs-ip: arbitrary code execution via the isPublic() function jsonpath-plus: Remote Code Execution in jsonpath-plus via Improper Input Sanitization node-ip: Incomplete fix for CVE-2023-42282 go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion path-to-regexp: Backtracking regular expressions cause ReDoS find-my-way: ReDoS vulnerability in multiparametric routes dompurify: nesting-based mutation XSS vulnerability elliptic: Missing Validation in Elliptic&#39;s EDDSA Signature Verification</p> https://cve.radiocsirt.org/vuln/rhsa-2024:10236 https://cve.radiocsirt.org/vuln/ssa-212953 <p>When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3. Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. curl&#39;s websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.</p> <p>A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy. The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-mid…</p> <p>When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3. Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. curl&#39;s websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.</p> <p>A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy. The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-mid…</p> https://cve.radiocsirt.org/vuln/ssa-212953 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-47875 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-dompurify, Ubuntu:24.04:LTS: node-dompurify, Ubuntu:25.10: node-dompurify, Ubuntu:26.04:LTS: node-dompurify</p> <p>DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-dompurify, Ubuntu:24.04:LTS: node-dompurify, Ubuntu:25.10: node-dompurify, Ubuntu:26.04:LTS: node-dompurify</p> <p>DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-47875 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3338 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstelle in Red Hat OpenShift ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und beliebigen Code auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstelle in Red Hat OpenShift ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und beliebigen Code auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3338