https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 14:57:45 +0000 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0585 certfr-2025-avi-0585 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0585 https://cve.radiocsirt.org/vuln/euvd-2026-245584 EUVD-2026-245584 https://cve.radiocsirt.org/vuln/euvd-2026-245584 https://cve.radiocsirt.org/vuln/fkie_cve-2025-52968 <p>xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.</p> <p>xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-52968 https://cve.radiocsirt.org/vuln/ghsa-r9jv-cv83-m4v4 <p>xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.</p> <p>xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.</p> https://cve.radiocsirt.org/vuln/ghsa-r9jv-cv83-m4v4 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-52968 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: xdg-utils, Ubuntu:18.04:LTS: xdg-utils, Ubuntu:20.04:LTS: xdg-utils, Ubuntu:22.04:LTS: xdg-utils, Ubuntu:24.04:LTS: xdg-utils, Ubuntu:25.10: xdg-utils, Ubuntu:26.04:LTS: xdg-utils</p> <p>xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: xdg-utils, Ubuntu:18.04:LTS: xdg-utils, Ubuntu:20.04:LTS: xdg-utils, Ubuntu:22.04:LTS: xdg-utils, Ubuntu:24.04:LTS: xdg-utils, Ubuntu:25.10: xdg-utils, Ubuntu:26.04:LTS: xdg-utils</p> <p>xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-52968