https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:05:48 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-05273 bdu:2026-05273 https://cve.radiocsirt.org/vuln/bdu:2026-05273 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0698 certfr-2026-avi-0698 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0698 https://cve.radiocsirt.org/vuln/cleanstart-2026-au09596 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: confluent-kafka</p> <p>Package confluent-kafka version 8.2.0-r0 fixes 7 vulnerabilities: CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480, CVE-2026-2332...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: confluent-kafka</p> <p>Package confluent-kafka version 8.2.0-r0 fixes 7 vulnerabilities: CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480, CVE-2026-2332...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-au09596 https://cve.radiocsirt.org/vuln/euvd-2026-290459 EUVD-2026-290459 https://cve.radiocsirt.org/vuln/euvd-2026-290459 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34479 <p>The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.</p> <p>Two groups of users are affected:</p> <p>* Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.</p> <p>Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.</p> <p>Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.</p> <p>The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.</p> <p>Two groups of users are affected:</p> <p>* Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.</p> <p>Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.</p> <p>Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34479 https://cve.radiocsirt.org/vuln/ghsa-h383-gmxw-35v2 <p><strong>Affected:</strong> Maven: org.apache.logging.log4j:log4j-1.2-api</p> <p>The `Log4j1XmlLayout` from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.</p> <p>Two groups of users are affected:</p> <p>* Those using `Log4j1XmlLayout` directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with `org.apache.log4j.xml.XMLLayout` specified as the layout class.</p> <p>Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version `2.25.4`, which corrects this issue.</p> <p>&gt; [!NOTE] &gt; The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the &gt; [Log4j 1 to Log4j 2 migration guide](https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html), and specifically the section on eliminating reliance on the bridge.</p> <p><strong>Affected:</strong> Maven: org.apache.logging.log4j:log4j-1.2-api</p> <p>The `Log4j1XmlLayout` from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.</p> <p>Two groups of users are affected:</p> <p>* Those using `Log4j1XmlLayout` directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with `org.apache.log4j.xml.XMLLayout` specified as the layout class.</p> <p>Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version `2.25.4`, which corrects this issue.</p> <p>&gt; [!NOTE] &gt; The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the &gt; [Log4j 1 to Log4j 2 migration guide](https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html), and specifically the section on eliminating reliance on the bridge.</p> https://cve.radiocsirt.org/vuln/ghsa-h383-gmxw-35v2 https://cve.radiocsirt.org/vuln/msrc_cve-2026-34479 msrc_CVE-2026-34479 https://cve.radiocsirt.org/vuln/msrc_cve-2026-34479 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10544-1 <p>log4j-2.20.0-2.1 on GA media</p> <p>log4j-2.20.0-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10544-1 https://cve.radiocsirt.org/vuln/rhsa-2026:21773 <p>org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames org.apache.logging.log4j/log4j-1.2-api: Apache Log4j 1-to-Log4j 2 bridge: Log processing denial of service due to improper XML escaping org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output</p> <p>org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames org.apache.logging.log4j/log4j-1.2-api: Apache Log4j 1-to-Log4j 2 bridge: Log processing denial of service due to improper XML escaping org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output</p> https://cve.radiocsirt.org/vuln/rhsa-2026:21773 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-34479 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: apache-log4j1.2, Ubuntu:Pro:16.04:LTS: apache-log4j2, Ubuntu:Pro:16.04:LTS: apache-log4j1.2, Ubuntu:18.04:LTS: apache-log4j1.2, Ubuntu:18.04:LTS: apache-log4j2, Ubuntu:20.04:LTS: apache-log4j1.2, Ubuntu:20.04:LTS: apache-log4j2, Ubuntu:22.04:LTS: apache-log4j1.2, Ubuntu:22.04:LTS: apache-log4j2, Ubuntu:24.04:LTS: apache-log4j1.2 and 5 more</p> <p>The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. Two groups of users are affected: * Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class. Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue. Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: apache-log4j1.2, Ubuntu:Pro:16.04:LTS: apache-log4j2, Ubuntu:Pro:16.04:LTS: apache-log4j1.2, Ubuntu:18.04:LTS: apache-log4j1.2, Ubuntu:18.04:LTS: apache-log4j2, Ubuntu:20.04:LTS: apache-log4j1.2, Ubuntu:20.04:LTS: apache-log4j2, Ubuntu:22.04:LTS: apache-log4j1.2, Ubuntu:22.04:LTS: apache-log4j2, Ubuntu:24.04:LTS: apache-log4j1.2 and 5 more</p> <p>The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. Two groups of users are affected: * Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class. Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue. Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-34479 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1067 <p>Ein Angreifer kann mehrere Schwachstellen in Apache log4j ausnutzen, um Dateien zu manipulieren.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Apache log4j ausnutzen, um Dateien zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1067