https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-10T06:44:08.657917+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2014-9720 CVE-2014-9720 2026-10-10T06:44:08.661304+00:00

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

 https://vulnerability.circl.lu/vuln/ghsa-8vpw-mgpf-mpvv GHSA-8vpw-mgpf-mpvv — Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack) 2026-10-10T06:44:08.661434+00:00

Affected: PyPI: tornado

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

 https://vulnerability.circl.lu/vuln/pysec-2020-213 PYSEC-2020-213 2026-10-10T06:44:08.661508+00:00

Affected: PyPI: tornado

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.