https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:01:03 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-06805 bdu:2025-06805 https://cve.radiocsirt.org/vuln/bdu:2025-06805 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0514 certfr-2025-avi-0514 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0514 https://cve.radiocsirt.org/vuln/cleanstart-2026-vy88502 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: kogito-apps</p> <p>Package kogito-apps version 10.1.0-r0 fixes 26 vulnerabilities: CVE-2025-55163, ghsa-prj3-ccx8-p6x4, CVE-2025-67735, ghsa-84h7-rjj3-6jx4, CVE-2025-58057...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: kogito-apps</p> <p>Package kogito-apps version 10.1.0-r0 fixes 26 vulnerabilities: CVE-2025-55163, ghsa-prj3-ccx8-p6x4, CVE-2025-67735, ghsa-84h7-rjj3-6jx4, CVE-2025-58057...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-vy88502 https://cve.radiocsirt.org/vuln/euvd-2026-243898 EUVD-2026-243898 https://cve.radiocsirt.org/vuln/euvd-2026-243898 https://cve.radiocsirt.org/vuln/fkie_cve-2025-49146 <p>pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.</p> <p>pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-49146 https://cve.radiocsirt.org/vuln/ghsa-hq9p-pm7w-8p54 <p><strong>Affected:</strong> Maven: org.postgresql:postgresql</p> <p>### Impact When the PostgreSQL JDBC driver is configured with channel binding set to `required` (default value is `prefer`), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements.</p> <p>### Patches TBD</p> <p>### Workarounds</p> <p>Configure `sslMode=verify-full` to prevent MITM attacks.</p> <p>### References</p> <p>* https://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256 * https://datatracker.ietf.org/doc/html/rfc7677 * https://datatracker.ietf.org/doc/html/rfc5802</p> <p><strong>Affected:</strong> Maven: org.postgresql:postgresql</p> <p>### Impact When the PostgreSQL JDBC driver is configured with channel binding set to `required` (default value is `prefer`), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements.</p> <p>### Patches TBD</p> <p>### Workarounds</p> <p>Configure `sslMode=verify-full` to prevent MITM attacks.</p> <p>### References</p> <p>* https://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256 * https://datatracker.ietf.org/doc/html/rfc7677 * https://datatracker.ietf.org/doc/html/rfc5802</p> https://cve.radiocsirt.org/vuln/ghsa-hq9p-pm7w-8p54 https://cve.radiocsirt.org/vuln/ncsc-2026-0034 NCSC-2026-0034 https://cve.radiocsirt.org/vuln/ncsc-2026-0034 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15264-1 <p>postgresql-jdbc-42.7.7-1.1 on GA media</p> <p>postgresql-jdbc-42.7.7-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15264-1 https://cve.radiocsirt.org/vuln/rhsa-2025:10323 <p>net/http: Request smuggling due to acceptance of invalid chunked data in net/http pgjdbc: pgjdbc insecure authentication in channel binding</p> <p>net/http: Request smuggling due to acceptance of invalid chunked data in net/http pgjdbc: pgjdbc insecure authentication in channel binding</p> https://cve.radiocsirt.org/vuln/rhsa-2025:10323 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-49146 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: libpgjava, Ubuntu:16.04:LTS: libpgjava, Ubuntu:Pro:18.04:LTS: libpgjava, Ubuntu:Pro:20.04:LTS: libpgjava, Ubuntu:22.04:LTS: libpgjava, Ubuntu:24.04:LTS: libpgjava, Ubuntu:25.10: libpgjava, Ubuntu:26.04:LTS: libpgjava</p> <p>pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: libpgjava, Ubuntu:16.04:LTS: libpgjava, Ubuntu:Pro:18.04:LTS: libpgjava, Ubuntu:Pro:20.04:LTS: libpgjava, Ubuntu:22.04:LTS: libpgjava, Ubuntu:24.04:LTS: libpgjava, Ubuntu:25.10: libpgjava, Ubuntu:26.04:LTS: libpgjava</p> <p>pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-49146 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1328 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle im PostgreSQL JDBC Treiber ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle im PostgreSQL JDBC Treiber ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1328