A Cross-Site Scripting (XSS) vulnerability exists in the Repasat application affecting the 'nomTipoCli' parameter at the endpoint '/es/clientypes/update/109441'. This vulnerability could allow attackers to trick users into executing arbitrary code in their browsers. No patch or remediation information is currently available.
A Cross-Site Scripting (XSS) vulnerability exists in the Repasat application affecting the 'nomMotivo' parameter at the '/es/lostmotives/store' endpoint. This vulnerability could allow an attacker to execute arbitrary code in a victim's browser by tricking the user. No affected versions or patch information are provided. The vulnerability is rated medium severity.
CVE-2026-61373 is a medium-severity vulnerability in Apache Thrift's Java TSaslNonblockingServer prior to version 0.25.0. It allows allocation of resources without limits or throttling, potentially leading to resource exhaustion. The issue is fixed in version 0.25.0. Users should upgrade to this version to mitigate the risk.
Apache Thrift C++ WebSocket server versions before 0.25.0 contain a vulnerability involving the use of uninitialized resources and returning incorrect status codes. This flaw can cause improper server behavior. The issue has been fixed in version 0.25.0.
CVE-2026-94637 is a medium-severity vulnerability in Apache Thrift Go bindings prior to version 0.25.0. It involves improper handling of highly compressed data, which can lead to data amplification causing resource exhaustion or denial of service. The issue is fixed in version 0.25.0. Users should upgrade to this version to mitigate the risk.
CVE-2026-94648 is a medium-severity vulnerability in Apache Thrift's Dart bindings that allows allocation of resources without limits or throttling. This flaw affects all versions prior to 0.25.0. The vulnerability has been fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
CVE-2026-94638 is a medium severity vulnerability in Apache Thrift PHP bindings prior to version 0.25.0. It involves allocation of resources without limits or throttling, which can lead to resource exhaustion. The vulnerability is fixed in version 0.25.0. Users are advised to upgrade to this version to mitigate the risk.
CVE-2026-94652 is a medium severity memory management vulnerability in Apache Thrift C++ bindings prior to version 0.25.0. The vulnerability involves failure to release memory after its effective lifetime, leading to resource leaks. This issue has been fixed in version 0.25.0.
CVE-2026-94653 is an Inefficient Algorithmic Complexity vulnerability in the Apache Thrift PHP bindings affecting versions before 0.25.0. This vulnerability can cause performance degradation or denial of service by exhausting system resources. The issue has a high severity score of 8.2 and is fixed in version 0.25.0. Users should upgrade to version 0.25.0 to mitigate this risk.
CVE-2026-82458 is a high severity vulnerability in libthrift-java involving memory allocation with excessive size values and allocation of resources without limits or throttling. It is addressed in a Red Hat Hardened Images RPM update that includes multiple thrift-related packages. The advisory does not provide detailed individual vulnerability descriptions or CVSS scores but confirms the availability of a security update. The affected versions include specific libthrift-java package builds listed in the advisory.
CVE-2026-94636 is a high-severity vulnerability in Apache Thrift's Python bindings affecting versions before 0.25.0. It involves improper handling of highly compressed data leading to data amplification, incorrect function call arguments, and improper validation of input quantities. The issue is fixed in Apache Thrift version 0.25.0.
CVE-2026-94646 is a high-severity vulnerability in Apache Thrift's Node.js bindings affecting versions before 0.25.0. It involves uncaught exceptions, improper validation of input quantities, and prototype pollution due to improperly controlled modification of object prototype attributes. This vulnerability can lead to significant security risks if exploited. Users are advised to upgrade to version 0.25.0, which addresses and fixes the issue.
CVE-2026-90440 is a high-severity vulnerability in Apache Thrift prior to version 0.25.0. It involves uncaught exceptions and improper handling of exceptional conditions in the thrift.server.nonblocking.TNonblockingServer component, leading to improper resource shutdown. This can cause service disruption or other impacts related to resource management. Users are advised to upgrade to Apache Thrift version 0.25.0, which addresses this issue.
CVE-2026-86537 is a high-severity vulnerability in Apache Thrift's D language bindings affecting versions before 0.25.0. It involves an uncaught exception, an infinite loop due to an unreachable exit condition, and an integer underflow (wraparound). The issue is fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
CVE-2026-86535 is a high-severity vulnerability in Apache Thrift NodeJS bindings involving an infinite loop caused by a loop with an unreachable exit condition and prototype pollution. This affects versions before 0.25.0. The issue is fixed in version 0.25.0, and users are advised to upgrade.
CVE-2026-85087 is a medium severity vulnerability in Apache Thrift's Python bindings involving improper certificate validation and incorrect status code returns. This flaw affects versions before 0.25.0. The issue is resolved in Apache Thrift version 0.25.0. Users are advised to upgrade to this fixed version to mitigate the vulnerability.
CVE-2026-85086 is a medium severity vulnerability in Apache Thrift's Perl bindings involving improper certificate validation and insecure default resource initialization. It affects versions before 0.25.0. The issue is fixed in version 0.25.0, and users are advised to upgrade to this version to remediate the vulnerability.
CVE-2026-96294 is a high-severity vulnerability in Apache Thrift's NodeJS bindings caused by uncaught exceptions and improper handling of exceptional conditions. This flaw affects all versions before 0.25.0. The issue has been fixed in Apache Thrift version 0.25.0. Users should upgrade to this version to remediate the vulnerability.
CVE-2026-96288 is a high-severity vulnerability in Apache Thrift's Erlang bindings involving uncontrolled recursion and unbounded resource allocation. This flaw affects versions prior to 0.25.0 and can lead to resource exhaustion. The issue is fixed in Apache Thrift version 0.25.0.
Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift
nodejs and D lang bindings.
Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare -- measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js case the connection is left open afterwards, so the frame can simply be sent again.
This issue affects Apache Thrift before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.