https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:01:23 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/cleanstart-2026-be61221 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-be61221 https://cve.radiocsirt.org/vuln/euvd-2026-366098 EUVD-2026-366098 https://cve.radiocsirt.org/vuln/euvd-2026-366098 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6321 <p>fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions &lt;= 3.1.0 are affected. Update to 3.1.1 or later.</p> <p>fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions &lt;= 3.1.0 are affected. Update to 3.1.1 or later.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-6321 https://cve.radiocsirt.org/vuln/ghsa-q3j6-qgpj-74h6 <p><strong>Affected:</strong> npm: fast-uri</p> <p>### Impact</p> <p>`fast-uri` v3.1.0 and earlier decodes percent-encoded path separators (`%2F`) and dot segments (`%2E`) before applying dot-segment removal in `normalize()` and `equal()`. This makes encoded path data behave like real `/` and `..`, so distinct URIs collapse onto the same normalized path.</p> <p>For example, `http://example.com/public/%2e%2e/admin` normalizes to `http://example.com/admin`, and `equal()` considers them the same URI.</p> <p>Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed. A path that looks confined under an allowed prefix can normalize to a different location.</p> <p>### Patches</p> <p>Upgrade to `fast-uri` &gt;= 3.1.1, or if you are in the v2.x release line, v2.4.1</p> <p>### Workarounds</p> <p>None. Upgrade to the patched version.</p> <p><strong>Affected:</strong> npm: fast-uri</p> <p>### Impact</p> <p>`fast-uri` v3.1.0 and earlier decodes percent-encoded path separators (`%2F`) and dot segments (`%2E`) before applying dot-segment removal in `normalize()` and `equal()`. This makes encoded path data behave like real `/` and `..`, so distinct URIs collapse onto the same normalized path.</p> <p>For example, `http://example.com/public/%2e%2e/admin` normalizes to `http://example.com/admin`, and `equal()` considers them the same URI.</p> <p>Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed. A path that looks confined under an allowed prefix can normalize to a different location.</p> <p>### Patches</p> <p>Upgrade to `fast-uri` &gt;= 3.1.1, or if you are in the v2.x release line, v2.4.1</p> <p>### Workarounds</p> <p>None. Upgrade to the patched version.</p> https://cve.radiocsirt.org/vuln/ghsa-q3j6-qgpj-74h6 https://cve.radiocsirt.org/vuln/ncsc-2026-0325 NCSC-2026-0325 https://cve.radiocsirt.org/vuln/ncsc-2026-0325 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10750-1 <p>python311-pydata-sphinx-theme-0.17.1-1.1 on GA media</p> <p>python311-pydata-sphinx-theme-0.17.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10750-1 https://cve.radiocsirt.org/vuln/rhsa-2026:19238 <p>fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies</p> <p>fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies</p> https://cve.radiocsirt.org/vuln/rhsa-2026:19238 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-6321 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: node-ajv, Ubuntu:20.04:LTS: node-ajv, Ubuntu:22.04:LTS: node-ajv, Ubuntu:24.04:LTS: node-ajv, Ubuntu:25.10: node-ajv, Ubuntu:26.04:LTS: node-ajv</p> <p>fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions &lt;= 3.1.0 are affected. Update to 3.1.1 or later.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: node-ajv, Ubuntu:20.04:LTS: node-ajv, Ubuntu:22.04:LTS: node-ajv, Ubuntu:24.04:LTS: node-ajv, Ubuntu:25.10: node-ajv, Ubuntu:26.04:LTS: node-ajv</p> <p>fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions &lt;= 3.1.0 are affected. Update to 3.1.1 or later.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-6321 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1604 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift Data Foundation ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift Data Foundation ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1604