https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:56:51 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-290239 EUVD-2026-290239 https://cve.radiocsirt.org/vuln/euvd-2026-290239 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21876 <p>The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.</p> <p>The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-21876 https://cve.radiocsirt.org/vuln/oesa-2026-1103 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP2: mod_security_crs</p> <p>The base rules are provided for mod_security by this package. Security Fix(es):</p> <p>The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.(CVE-2026-21876)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP2: mod_security_crs</p> <p>The base rules are provided for mod_security by this package. Security Fix(es):</p> <p>The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.(CVE-2026-21876)</p> https://cve.radiocsirt.org/vuln/oesa-2026-1103 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-21876 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: modsecurity-crs, Ubuntu:18.04:LTS: modsecurity-crs, Ubuntu:20.04:LTS: modsecurity-crs, Ubuntu:22.04:LTS: modsecurity-crs, Ubuntu:24.04:LTS: modsecurity-crs, Ubuntu:25.10: modsecurity-crs, Ubuntu:26.04:LTS: modsecurity-crs</p> <p>The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: modsecurity-crs, Ubuntu:18.04:LTS: modsecurity-crs, Ubuntu:20.04:LTS: modsecurity-crs, Ubuntu:22.04:LTS: modsecurity-crs, Ubuntu:24.04:LTS: modsecurity-crs, Ubuntu:25.10: modsecurity-crs, Ubuntu:26.04:LTS: modsecurity-crs</p> <p>The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-21876 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1185 <p>Ein Angreifer kann mehrere Schwachstellen in Kemp LoadMaster und Progress Software MOVEit WAF ausnutzen, um beliebigen Programmcode auszuführen oder Sicherheitsmaßnahmen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Kemp LoadMaster und Progress Software MOVEit WAF ausnutzen, um beliebigen Programmcode auszuführen oder Sicherheitsmaßnahmen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1185