SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the getNotebookInfo endpoint. Attackers, including anonymous visitors when no reader password is set, can query publish-visible notebooks to obtain document count, size and modification timestamps of hidden documents.
SiYuan versions prior to 3.8.5 have a missing authorization vulnerability in certain API endpoints that allows read-only or anonymous publish visitors to discover unpublished notebook box IDs. By sending a POST request with any open notebook ID, attackers can obtain the global save-box ID and save-path template, revealing the existence and creation time of hidden notebooks. This vulnerability has a medium severity rating with a CVSS score of 6.9.
Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift.
Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the host
name that was connected to. That comparison walks the subjectAltName dNSName entries first and consults the certificate Common Name afterwards. A name that does not match yields a "skip" result rather than
a rejection, so a certificate whose subjectAltName entries are all present and all non-matching falls through to the Common Name, which can then satisfy the check.
RFC 6125 section 6.4.4, and RFC 9525 section 2, require that the Common Name is not consulted when a dNSName subjectAltName is present. A certificate carrying subjectAltName entries for one name and a
Common Name for another is therefore accepted for a connection to the second name.
Exploitation requires an attacker positioned on the network path who holds a certificate that chains to a certificate authority in the client's trust store and whose Common Name matches the connected host
name. Public certificate authorities have not issued on Common Name alone for many years, so this is principally a concern for deployments using a private or enterprise public-key infrastructure.
This issue affects the C++ library of Apache Thrift from 0.7.0 through 0.24.0 and the D library from 0.9.0 through 0.24.0. Users should upgrade to 0.25.0.
Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-85494 is a medium-severity vulnerability in Apache Thrift's php-horde-thrift package. It involves improper handling of length parameter inconsistencies, uncaught exceptions, inefficient algorithmic complexity, memory allocation with excessive size, and insecure default resource initialization. This affects multiple php-horde-thrift versions and Apache Thrift versions prior to 0.25.0. The vulnerability can lead to denial of service due to resource exhaustion or crashes. Users should upgrade to Apache Thrift version 0.25.0 or later to mitigate the issue.
CVE-2026-94644 is a medium-severity vulnerability in Apache Thrift PHP bindings prior to version 0.25.0. It involves allocation of resources without limits or throttling, which can lead to resource exhaustion and potential denial of service. The issue is fixed in version 0.25.0, and users are advised to upgrade to mitigate the risk.
CVE-2026-94645 is a medium-severity vulnerability in Apache Thrift's Node.js bindings caused by improper validation of input quantities. This flaw allows unbounded allocation of resources, which can lead to resource exhaustion. The vulnerability affects Apache Thrift versions before 0.25.0. Upgrading to version 0.25.0 mitigates the issue.
A vulnerability in Apache Thrift Dart bindings before version 0.25.0 allows memory allocation with an excessive size value due to improper handling of length parameter inconsistencies. This can lead to potential memory-related issues. The issue is fixed in version 0.25.0.
Apache Thrift c_glib bindings contain a vulnerability involving the use of uninitialized resources and returning incorrect status codes. This affects versions prior to 0.25.0. The issue has been fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the vulnerability.
A memory and resource leak vulnerability exists in Apache Thrift's THeaderTransport component prior to version 0.25.0. The flaw involves missing release of memory and resources after their effective lifetime, which can lead to resource exhaustion. This issue is resolved in Apache Thrift version 0.25.0.
CVE-2026-91137 is a vulnerability in Apache Thrift PHP bindings prior to version 0.25.0. It involves improper validation of specified input quantity, which leads to allocation of resources without limits or throttling and excessive iteration. This can result in resource exhaustion or denial of service. The issue is fixed in Apache Thrift version 0.25.0.
Apache Thrift Java bindings prior to version 0.25.0 have a vulnerability caused by improper handling of exceptional conditions, leading to resources not being released after their effective lifetime. This can result in resource exhaustion and potentially cause denial of service. The issue is fixed in version 0.25.0.
CVE-2026-96990 is a medium-severity vulnerability in Apache Thrift Erlang bindings prior to version 0.25.0. It involves allocation of resources without proper limits or throttling, which can lead to resource exhaustion. The vulnerability is fixed in version 0.25.0. Users should upgrade to this version to mitigate the issue.
An uncaught exception vulnerability exists in the Apache Thrift PHP bindings before version 0.25.0. This flaw can cause unhandled exceptions during execution, leading to high-severity impacts. The issue is fixed in Apache Thrift version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
CVE-2026-85493 is a high-severity vulnerability in Apache Thrift affecting versions before 0.25.0. It involves uncontrolled recursion in the Dart and Java ME bindings, which can lead to a denial of service or other impacts. The issue is fixed in version 0.25.0, and users are advised to upgrade to this version.
CVE-2026-93925 is a high-severity stack-based buffer overflow vulnerability in the Apache Thrift C++ THeaderProtocol caused by an incorrect bitwise shift of an integer. This flaw affects Apache Thrift versions before 0.25.0. The issue has been fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
CVE-2026-94650 is a high-severity vulnerability in Apache Thrift's c_glib bindings caused by uncontrolled recursion. This flaw affects all versions before 0.25.0. The Apache Software Foundation has fixed the issue in version 0.25.0. Users are advised to upgrade to this version to mitigate the risk.
CVE-2026-97876 is a vulnerability in GNU grub2 where a local attacker with control over GRUB's configuration can bypass Secure Boot lockdown restrictions. This is due to insufficient validation of the MMIO base address passed to the GRUB serial command, allowing loading of unsigned GRUB modules while lockdown appears enabled.
Amir Barati, an alleged member of the Mabna Institute linked to Iran's IRGC, was extradited to the US from Montenegro. He is charged with cyberattacks targeting hundreds of universities, private companies, government agencies, and NGOs worldwide since 2013, resulting in over $3.4 billion in losses and theft of over 31 terabytes of scientific and intellectual property data. This extradition is notable due to the rarity of Iranian state-linked hackers being brought to trial in the US. Barati reportedly operated from Turkey after 2021, where he gained citizenship and changed his name.
Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.