https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:06:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349241 EUVD-2026-349241 https://cve.radiocsirt.org/vuln/euvd-2026-349241 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50630 <p>A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the &#39;realm&#39; parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.</p> <p>A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the &#39;realm&#39; parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-50630 https://cve.radiocsirt.org/vuln/ghsa-xf62-wr5p-5p95 <p><strong>Affected:</strong> Maven: org.apache.cxf:cxf-rt-rs-security-oauth2</p> <p>A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the &#39;realm&#39; parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.</p> <p><strong>Affected:</strong> Maven: org.apache.cxf:cxf-rt-rs-security-oauth2</p> <p>A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the &#39;realm&#39; parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.</p> https://cve.radiocsirt.org/vuln/ghsa-xf62-wr5p-5p95 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1895 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um Sicherheitsvorkehrungen zu umgehen, XML-External-Entity-Angriffe durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um Sicherheitsvorkehrungen zu umgehen, XML-External-Entity-Angriffe durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1895