https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 19:30:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-366306 EUVD-2026-366306 https://cve.radiocsirt.org/vuln/euvd-2026-366306 https://cve.radiocsirt.org/vuln/fkie_cve-2026-19625 <p>When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as &#34;/oidc-provider1&#34; that is secured by the OIDC Provider 1 and &#34;/oidc-provider2&#34; that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access &#34;/oidc-provider1&#34; can also be used to access &#34;/oidc-provider2&#34; that is secured by another OIDC Provider 2.</p> <p>When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as &#34;/oidc-provider1&#34; that is secured by the OIDC Provider 1 and &#34;/oidc-provider2&#34; that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access &#34;/oidc-provider1&#34; can also be used to access &#34;/oidc-provider2&#34; that is secured by another OIDC Provider 2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-19625 https://cve.radiocsirt.org/vuln/rhsa-2026:62515 <p>io.quarkus:quarkus-qute: quarkus-qute:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine resteasy-core: RESTeasy SourceProvider remote unauthenticated file read org.mongodb/mongodb-driver: MongoDB Driver: Credential disclosure via cleartext logging during client initialization quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification</p> <p>io.quarkus:quarkus-qute: quarkus-qute:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine resteasy-core: RESTeasy SourceProvider remote unauthenticated file read org.mongodb/mongodb-driver: MongoDB Driver: Credential disclosure via cleartext logging during client initialization quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification</p> https://cve.radiocsirt.org/vuln/rhsa-2026:62515