https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 05:55:19 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0473 certfr-2026-avi-0473 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0473 https://cve.radiocsirt.org/vuln/euvd-2026-243209 EUVD-2026-243209 https://cve.radiocsirt.org/vuln/euvd-2026-243209 https://cve.radiocsirt.org/vuln/fkie_cve-2025-35036 <p>Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.</p> <p>Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-35036 https://cve.radiocsirt.org/vuln/ghsa-7v6m-28jr-rg84 <p><strong>Affected:</strong> Maven: org.hibernate.validator:hibernate-validator, Maven: org.hibernate:hibernate-validator</p> <p>Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.</p> <p><strong>Affected:</strong> Maven: org.hibernate.validator:hibernate-validator, Maven: org.hibernate:hibernate-validator</p> <p>Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.</p> https://cve.radiocsirt.org/vuln/ghsa-7v6m-28jr-rg84 https://cve.radiocsirt.org/vuln/rhsa-2025:10924 <p>wildfly: Wildfly vulnerable to Cross-Site Scripting (XSS) org.jboss.eap:wildfly-ejb3: Improper Deserialization in JBoss Marshalling Allows Remote Code Execution org.jboss.hal-hal-parent: Stored Cross-Site Scripting (XSS) in JBoss EAP Management Console org.apache.cxf: Apache CXF: Denial of Service vulnerability with temporary files org.jboss.hal:hal-console: Wildfly HAL Console Cross-Site Scripting hibernate-validator: Hibernate Validator Expression Language Injection commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum&#39;s declaredClass property by default</p> <p>wildfly: Wildfly vulnerable to Cross-Site Scripting (XSS) org.jboss.eap:wildfly-ejb3: Improper Deserialization in JBoss Marshalling Allows Remote Code Execution org.jboss.hal-hal-parent: Stored Cross-Site Scripting (XSS) in JBoss EAP Management Console org.apache.cxf: Apache CXF: Denial of Service vulnerability with temporary files org.jboss.hal:hal-console: Wildfly HAL Console Cross-Site Scripting hibernate-validator: Hibernate Validator Expression Language Injection commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum&#39;s declaredClass property by default</p> https://cve.radiocsirt.org/vuln/rhsa-2025:10924 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-35036 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libhibernate-validator-java, Ubuntu:18.04:LTS: libhibernate-validator-java, Ubuntu:20.04:LTS: libhibernate-validator-java, Ubuntu:20.04:LTS: libhibernate-validator4-java, Ubuntu:22.04:LTS: libhibernate-validator-java, Ubuntu:22.04:LTS: libhibernate-validator4-java, Ubuntu:24.04:LTS: libhibernate-validator-java, Ubuntu:24.04:LTS: libhibernate-validator4-java, Ubuntu:25.10: libhibernate-validator-java, Ubuntu:25.10: libhibernate-validator4-java and 2 more</p> <p>Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libhibernate-validator-java, Ubuntu:18.04:LTS: libhibernate-validator-java, Ubuntu:20.04:LTS: libhibernate-validator-java, Ubuntu:20.04:LTS: libhibernate-validator4-java, Ubuntu:22.04:LTS: libhibernate-validator-java, Ubuntu:22.04:LTS: libhibernate-validator4-java, Ubuntu:24.04:LTS: libhibernate-validator-java, Ubuntu:24.04:LTS: libhibernate-validator4-java, Ubuntu:25.10: libhibernate-validator-java, Ubuntu:25.10: libhibernate-validator4-java and 2 more</p> <p>Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-35036 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1203 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1203