https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:46:24 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:72424 <p><strong>Affected:</strong> AlmaLinux:9: pki-resteasy-client, AlmaLinux:9: pki-resteasy-core, AlmaLinux:9: pki-resteasy-jackson2-provider, AlmaLinux:9: pki-resteasy-servlet-initializer</p> <p>RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.</p> <p>Security Fix(es):</p> <p>* resteasy-core: RESTeasy SourceProvider remote unauthenticated file read (CVE-2026-17615)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: pki-resteasy-client, AlmaLinux:9: pki-resteasy-core, AlmaLinux:9: pki-resteasy-jackson2-provider, AlmaLinux:9: pki-resteasy-servlet-initializer</p> <p>RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.</p> <p>Security Fix(es):</p> <p>* resteasy-core: RESTeasy SourceProvider remote unauthenticated file read (CVE-2026-17615)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:72424 https://cve.radiocsirt.org/vuln/euvd-2026-382096 EUVD-2026-382096 https://cve.radiocsirt.org/vuln/euvd-2026-382096 https://cve.radiocsirt.org/vuln/fkie_cve-2026-17615 <p>A flaw was found in RESTEasy&#39;s SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.</p> <p>A flaw was found in RESTEasy&#39;s SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-17615 https://cve.radiocsirt.org/vuln/ghsa-h82j-45qh-f65r <p>A flaw was found in RESTEasy&#39;s SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.</p> <p>A flaw was found in RESTEasy&#39;s SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.</p> https://cve.radiocsirt.org/vuln/ghsa-h82j-45qh-f65r https://cve.radiocsirt.org/vuln/rhsa-2026:68277 <p>keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2 keycloak-services: keycloak-services: Organization invitation link exposure allows unauthorized member creation keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session keycloak-services: keycloak-services: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers keycloak-services: keycloak-services: Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins keycloak-services: keycloak-services: Missing per-role authorization on RoleContainerResource composite endpoints keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2 keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts resteasy-core: RESTeasy SourceProvider remote unauthenticated file read keycloak-services: keycloak-services: Generic identity-provider creation can bind brokers to organizations without manage-organizations keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check keycloak-serv…</p> <p>keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2 keycloak-services: keycloak-services: Organization invitation link exposure allows unauthorized member creation keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session keycloak-services: keycloak-services: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers keycloak-services: keycloak-services: Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins keycloak-services: keycloak-services: Missing per-role authorization on RoleContainerResource composite endpoints keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2 keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts resteasy-core: RESTeasy SourceProvider remote unauthenticated file read keycloak-services: keycloak-services: Generic identity-provider creation can bind brokers to organizations without manage-organizations keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check keycloak-serv…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:68277 https://cve.radiocsirt.org/vuln/rhsa-2026:72424 <p>security update for resteasy</p> <p>security update for resteasy</p> https://cve.radiocsirt.org/vuln/rhsa-2026:72424 https://cve.radiocsirt.org/vuln/rlsa-2026:72424 <p><strong>Affected:</strong> Rocky Linux:9: resteasy</p> <p>RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.</p> <p>Security Fix(es):</p> <p>* resteasy-core: RESTeasy SourceProvider remote unauthenticated file read (CVE-2026-17615)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:9: resteasy</p> <p>RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.</p> <p>Security Fix(es):</p> <p>* resteasy-core: RESTeasy SourceProvider remote unauthenticated file read (CVE-2026-17615)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:72424 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-17615 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: resteasy, Ubuntu:Pro:18.04:LTS: resteasy3.0, Ubuntu:Pro:20.04:LTS: resteasy, Ubuntu:Pro:20.04:LTS: resteasy3.0, Ubuntu:22.04:LTS: resteasy3.0, Ubuntu:Pro:22.04:LTS: resteasy, Ubuntu:24.04:LTS: resteasy3.0, Ubuntu:Pro:24.04:LTS: resteasy, Ubuntu:26.04:LTS: resteasy, Ubuntu:26.04:LTS: resteasy3.0</p> <p>A flaw was found in RESTEasy&#39;s SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: resteasy, Ubuntu:Pro:18.04:LTS: resteasy3.0, Ubuntu:Pro:20.04:LTS: resteasy, Ubuntu:Pro:20.04:LTS: resteasy3.0, Ubuntu:22.04:LTS: resteasy3.0, Ubuntu:Pro:22.04:LTS: resteasy, Ubuntu:24.04:LTS: resteasy3.0, Ubuntu:Pro:24.04:LTS: resteasy, Ubuntu:26.04:LTS: resteasy, Ubuntu:26.04:LTS: resteasy3.0</p> <p>A flaw was found in RESTEasy&#39;s SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-17615