https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:51:23 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0914 certfr-2026-avi-0914 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0914 https://cve.radiocsirt.org/vuln/cleanstart-2026-al85661 <p><strong>Affected:</strong> CleanStart: activemq, CleanStart: apache-nifi, CleanStart: apache-nifi-registry, CleanStart: confluent-kafka, CleanStart: elasticsearch, CleanStart: hazelcast, CleanStart: kafka, CleanStart: keycloak, CleanStart: logstash-fips, CleanStart: rundeck and 3 more</p> <p>CVE-2026-54517 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: activemq, CleanStart: apache-nifi, CleanStart: apache-nifi-registry, CleanStart: confluent-kafka, CleanStart: elasticsearch, CleanStart: hazelcast, CleanStart: kafka, CleanStart: keycloak, CleanStart: logstash-fips, CleanStart: rundeck and 3 more</p> <p>CVE-2026-54517 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-al85661 https://cve.radiocsirt.org/vuln/euvd-2026-330029 EUVD-2026-330029 https://cve.radiocsirt.org/vuln/euvd-2026-330029 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54517 <p>jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.</p> <p>jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54517 https://cve.radiocsirt.org/vuln/ghsa-5hh8-q8hv-fr38 <p><strong>Affected:</strong> Maven: com.fasterxml.jackson.core:jackson-databind, Maven: tools.jackson.core:jackson-databind</p> <p>## Summary In `BeanDeserializer._deserializeUsingPropertyBased`, the active-view (`@JsonView`) filter was applied only to creator properties; the regular property-buffering branch performed no `prop.visibleInView(activeView)` check. A change making `SetterlessProperty.isMerging()` return `true` routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted `@JsonView` is populated from attacker JSON even when the active view excludes it.</p> <p>## Impact View-restricted (e.g. admin-only) setterless collection/map properties can be written from untrusted JSON despite `@JsonView` gating — an access-control / mass-assignment bypass. No RCE or DoS.</p> <p>## Affected / Patched (verified via `git tag --contains`) - 2.21 line: `&gt;= 2.21.0, &lt; 2.21.4` -&gt; fixed in **2.21.4** (backport `94c5d21`, #5970) - 3.x line: `&gt;= 3.0.0, &lt; 3.1.4` -&gt; fixed in **3.1.4** (#5969, `5bf23ed`)</p> <p>## Severity / CWE Maintainer: minor. Reporter: HIGH. CWE-863 (Incorrect Authorization); related CWE-1220.</p> <p>## Credits Omkhar Arasaratnam (@omkhar) - finder.</p> <p><strong>Affected:</strong> Maven: com.fasterxml.jackson.core:jackson-databind, Maven: tools.jackson.core:jackson-databind</p> <p>## Summary In `BeanDeserializer._deserializeUsingPropertyBased`, the active-view (`@JsonView`) filter was applied only to creator properties; the regular property-buffering branch performed no `prop.visibleInView(activeView)` check. A change making `SetterlessProperty.isMerging()` return `true` routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted `@JsonView` is populated from attacker JSON even when the active view excludes it.</p> <p>## Impact View-restricted (e.g. admin-only) setterless collection/map properties can be written from untrusted JSON despite `@JsonView` gating — an access-control / mass-assignment bypass. No RCE or DoS.</p> <p>## Affected / Patched (verified via `git tag --contains`) - 2.21 line: `&gt;= 2.21.0, &lt; 2.21.4` -&gt; fixed in **2.21.4** (backport `94c5d21`, #5970) - 3.x line: `&gt;= 3.0.0, &lt; 3.1.4` -&gt; fixed in **3.1.4** (#5969, `5bf23ed`)</p> <p>## Severity / CWE Maintainer: minor. Reporter: HIGH. CWE-863 (Incorrect Authorization); related CWE-1220.</p> <p>## Credits Omkhar Arasaratnam (@omkhar) - finder.</p> https://cve.radiocsirt.org/vuln/ghsa-5hh8-q8hv-fr38 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54517 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jackson-databind, Ubuntu:Pro:16.04:LTS: jackson-databind, Ubuntu:18.04:LTS: jackson-databind, Ubuntu:20.04:LTS: jackson-databind, Ubuntu:22.04:LTS: jackson-databind, Ubuntu:24.04:LTS: jackson-databind, Ubuntu:25.10: jackson-databind, Ubuntu:26.04:LTS: jackson-databind</p> <p>jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jackson-databind, Ubuntu:Pro:16.04:LTS: jackson-databind, Ubuntu:18.04:LTS: jackson-databind, Ubuntu:20.04:LTS: jackson-databind, Ubuntu:22.04:LTS: jackson-databind, Ubuntu:24.04:LTS: jackson-databind, Ubuntu:25.10: jackson-databind, Ubuntu:26.04:LTS: jackson-databind</p> <p>jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54517 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2058 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in FasterXML Jackson ausnutzen, um Schutzmechanismen und Autorisierungsregeln zu umgehen, Daten zu manipulieren, Informationen offenzulegen oder einen Denial-of-Service zu verursachen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in FasterXML Jackson ausnutzen, um Schutzmechanismen und Autorisierungsregeln zu umgehen, Daten zu manipulieren, Informationen offenzulegen oder einen Denial-of-Service zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2058