https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 01:00:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-344099 EUVD-2026-344099 https://cve.radiocsirt.org/vuln/euvd-2026-344099 https://cve.radiocsirt.org/vuln/fkie_cve-2026-60007 <p>In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim&#39;s `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim&#39;s password, and authenticate with the recovered credentials.</p> <p>In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim&#39;s `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim&#39;s password, and authenticate with the recovered credentials.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-60007 https://cve.radiocsirt.org/vuln/ghsa-jrjq-9cmf-3h6f <p>In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim&#39;s `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim&#39;s password, and authenticate with the recovered credentials.</p> <p>In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim&#39;s `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim&#39;s password, and authenticate with the recovered credentials.</p> https://cve.radiocsirt.org/vuln/ghsa-jrjq-9cmf-3h6f