https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:06:51 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-08941 bdu:2026-08941 https://cve.radiocsirt.org/vuln/bdu:2026-08941 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0986 certfr-2026-avi-0986 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0986 https://cve.radiocsirt.org/vuln/cleanstart-2026-cq01177 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: activemq</p> <p>Multiple security vulnerabilities affect the activemq package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: activemq</p> <p>Multiple security vulnerabilities affect the activemq package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-cq01177 https://cve.radiocsirt.org/vuln/cnvd-2026-26205 cnvd-2026-26205 https://cve.radiocsirt.org/vuln/cnvd-2026-26205 https://cve.radiocsirt.org/vuln/euvd-2026-328271 EUVD-2026-328271 https://cve.radiocsirt.org/vuln/euvd-2026-328271 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49268 <p>A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.</p> <p>This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.</p> <p>A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.</p> <p>This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49268 https://cve.radiocsirt.org/vuln/ghsa-x96m-rh44-vgv8 <p><strong>Affected:</strong> Maven: org.apache.shiro:shiro-core</p> <p>A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.</p> <p>This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.</p> <p><strong>Affected:</strong> Maven: org.apache.shiro:shiro-core</p> <p>A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.</p> <p>This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/ghsa-x96m-rh44-vgv8 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-49268 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: shiro, Ubuntu:Pro:18.04:LTS: shiro, Ubuntu:20.04:LTS: shiro, Ubuntu:22.04:LTS: shiro, Ubuntu:Pro:24.04:LTS: shiro, Ubuntu:25.10: shiro, Ubuntu:26.04:LTS: shiro</p> <p>A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users. This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: shiro, Ubuntu:Pro:18.04:LTS: shiro, Ubuntu:20.04:LTS: shiro, Ubuntu:22.04:LTS: shiro, Ubuntu:Pro:24.04:LTS: shiro, Ubuntu:25.10: shiro, Ubuntu:26.04:LTS: shiro</p> <p>A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users. This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-49268