https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:05:32 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1256 certfr-2026-avi-1256 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1256 https://cve.radiocsirt.org/vuln/cleanstart-2026-gh89210 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cassandra-reaper-fips</p> <p>Multiple security vulnerabilities affect the cassandra-reaper-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cassandra-reaper-fips</p> <p>Multiple security vulnerabilities affect the cassandra-reaper-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-gh89210 https://cve.radiocsirt.org/vuln/euvd-2026-267749 EUVD-2026-267749 https://cve.radiocsirt.org/vuln/euvd-2026-267749 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23901 <p>Observable Timing Discrepancy vulnerability in Apache Shiro.</p> <p>This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7.</p> <p>Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.</p> <p>Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password.</p> <p>The most likely attack vector is a local attack only. Shiro security model  https://shiro.apache.org/security-model.html#username_enumeration  discusses this as well.</p> <p>Typically, brute force attack can be mitigated at the infrastructure level.</p> <p>Observable Timing Discrepancy vulnerability in Apache Shiro.</p> <p>This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7.</p> <p>Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.</p> <p>Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password.</p> <p>The most likely attack vector is a local attack only. Shiro security model  https://shiro.apache.org/security-model.html#username_enumeration  discusses this as well.</p> <p>Typically, brute force attack can be mitigated at the infrastructure level.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23901 https://cve.radiocsirt.org/vuln/ghsa-c4qc-4q9p-m9q9 <p><strong>Affected:</strong> Maven: org.apache.shiro:shiro-core</p> <p>Observable Timing Discrepancy vulnerability in Apache Shiro.</p> <p>This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7.</p> <p>Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.</p> <p>Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password.</p> <p>The most likely attack vector is a local attack only. Shiro security model  https://shiro.apache.org/security-model.html#username_enumeration  discusses this as well.</p> <p>Typically, brute force attack can be mitigated at the infrastructure level.</p> <p><strong>Affected:</strong> Maven: org.apache.shiro:shiro-core</p> <p>Observable Timing Discrepancy vulnerability in Apache Shiro.</p> <p>This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7.</p> <p>Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.</p> <p>Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password.</p> <p>The most likely attack vector is a local attack only. Shiro security model  https://shiro.apache.org/security-model.html#username_enumeration  discusses this as well.</p> <p>Typically, brute force attack can be mitigated at the infrastructure level.</p> https://cve.radiocsirt.org/vuln/ghsa-c4qc-4q9p-m9q9 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-23901 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: shiro, Ubuntu:Pro:18.04:LTS: shiro, Ubuntu:20.04:LTS: shiro, Ubuntu:22.04:LTS: shiro, Ubuntu:Pro:24.04:LTS: shiro, Ubuntu:25.10: shiro, Ubuntu:26.04:LTS: shiro</p> <p>Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue. Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password. The most likely attack vector is a local attack only. Shiro security model https://shiro.apache.org/security-model.html#username_enumeration  discusses this as well. Typically, brute force attack can be mitigated at the infrastructure level.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: shiro, Ubuntu:Pro:18.04:LTS: shiro, Ubuntu:20.04:LTS: shiro, Ubuntu:22.04:LTS: shiro, Ubuntu:Pro:24.04:LTS: shiro, Ubuntu:25.10: shiro, Ubuntu:26.04:LTS: shiro</p> <p>Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue. Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password. The most likely attack vector is a local attack only. Shiro security model https://shiro.apache.org/security-model.html#username_enumeration  discusses this as well. Typically, brute force attack can be mitigated at the infrastructure level.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-23901