Apache Thrift versions prior to 0.25.0 contain a critical vulnerability involving uncontrolled resource allocation, integer overflow or wraparound, and a heap-based buffer overflow. This flaw can lead to severe memory corruption issues. The vulnerability is addressed in version 0.25.0. Users should upgrade to this version to mitigate the risk.
An Access of Uninitialized Pointer vulnerability exists in the Apache Thrift c_glib bindings affecting versions before 0.25.0. This vulnerability is due to improper memory handling and can lead to severe impacts. The issue is fixed in version 0.25.0, and users are advised to upgrade to this version to remediate the vulnerability.
CVE-2026-83663 is an uncontrolled recursion vulnerability in the Go bindings of Apache Thrift before version 0.25.0. The issue arises because the Go transports read frames recursively when encountering frames with no payload bytes, leading to unbounded recursion depth. This causes the Go runtime stack limit to be exceeded, resulting in a fatal error that terminates the entire process. The vulnerability has a high severity with a CVSS score of 8.7. Users are advised to upgrade to Apache Thrift version 0.25.0, which contains the fix.
CVE-2026-66859 is a high severity vulnerability in Apache Thrift affecting versions before 0.25.0. It involves a NULL Pointer Dereference and use of uninitialized variable in the c_glib bindings. The issue is fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
CVE-2026-66858 is a high-severity vulnerability in Apache Thrift before version 0.25.0. It involves uncontrolled recursion in the protocol skip routine of several Apache Thrift bindings, which do not enforce the binding's recursion limit. This can lead to stack exhaustion when processing deeply nested unknown fields. The affected components include the Python C++ accelerator, PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk, and OCaml libraries. The issue is fixed in Apache Thrift version 0.25.0.
CVE-2026-66837 is a high-severity stack-based buffer overflow and integer overflow vulnerability in the PHP bindings of Apache Thrift. It affects all versions prior to 0.25.0. The issue allows for potential memory corruption due to improper handling of buffer sizes. Apache has released version 0.25.0 to address this vulnerability.
CVE-2026-104733 is a high-severity vulnerability in ProcessOne's ejabberd XMPP server versions prior to 26.07. It allows an attacker with limited privileges to impersonate arbitrary users by exploiting an unvalidated authzid parameter in the SASL-PLAIN authentication mechanism. This flaw could enable unauthorized access and actions under the guise of legitimate users.
CVE-2026-66055 is a high severity vulnerability in Apache Thrift affecting multiple language bindings including C++, Java, Go, netstd, Python, and Delphi. The flaw involves allocation of resources without limits or throttling, which can lead to resource exhaustion. This issue affects all versions prior to 0.25.0. Apache has released version 0.25.0 to address this vulnerability.
CVE-2026-66054 is a medium severity vulnerability in Apache Thrift C++ bindings that involves allocation of resources without limits or throttling. This flaw leads to improper handling of highly compressed data, resulting in potential data amplification issues. The vulnerability affects Apache Thrift versions prior to 0.25.0. The issue has been fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
CVE-2026-61374 is a high-severity vulnerability in Apache Thrift's Java bindings that involves allocation of resources without limits or throttling. This flaw affects Apache Thrift versions before 0.25.0 and can lead to resource exhaustion. The Apache Software Foundation has addressed this issue in version 0.25.0. Users should upgrade to this fixed version to mitigate the risk.
CloudSyncD is a persistent backdoor malware targeting macOS users via a fake Zoom installer. Delivered through social engineering, the malware dropper masquerades as a legitimate Zoom installer and requires user activation, during which it collects the user's password to gain root privileges. The malware runs stealthily as a daemon named CloudSyncD, performing host profiling and exfiltrating system and user details to its command-and-control servers. It avoids standard infostealer functions and focuses on establishing long-term access. Researchers observed the malware progressing from development to deployment, with multiple builds communicating with C2 servers disguised as benign JavaScript fetches.
CVE-2026-85215 is a high severity SQL injection vulnerability in GG Soft Software Services Inc.'s Paperwork application. It allows improper neutralization of special elements in SQL commands, potentially enabling unauthorized data access or manipulation. The vulnerability affects versions of Paperwork up to 2026-09-09. It requires low attack complexity and privileges, with no user interaction needed. Confidentiality impact is high, integrity impact is low, and availability is not affected.
CVE-2026-63772 is a high-severity vulnerability in Apache Thrift's Go bindings involving allocation of resources without limits or throttling. This flaw affects all versions before 0.25.0. The issue can lead to resource exhaustion due to uncontrolled allocation. The Apache Software Foundation has fixed the vulnerability in version 0.25.0. Users are advised to upgrade to this version to mitigate the risk.
CVE-2026-104612 is a cross-site scripting (XSS) vulnerability in SourceCodester Student Result Management System version 1.0, specifically in the Announcement Module. The issue is due to improper sanitization of the title/announcement parameter in the script/academic/core/new_announcement.php file. This allows remote attackers to inject malicious scripts. The vulnerability has a medium severity score of 5.3 and an exploit has been publicly disclosed. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-11795 is an observable discrepancy vulnerability in Softtr Informatics Trading Limited Company's E-Commerce Pack that allows account footprinting. It affects versions before 5.03.01.54. The vulnerability has a medium severity with a CVSS score of 5.3 and does not require privileges or user interaction for exploitation.
Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments. [...]
CVE-2026-66331 is a resource allocation vulnerability in Apache Thrift affecting versions before 0.25.0. It involves the Delphi bindings buffered transport component, where resources can be allocated without proper limits or throttling. This can potentially lead to resource exhaustion. The issue is fixed in Apache Thrift version 0.25.0.
YesWiki versions prior to 4.6.7 have a server-side request forgery (SSRF) vulnerability in the Bazar valeur action. This flaw allows page editors to cause the server to fetch arbitrary URLs, including internal or loopback addresses. Exploitation can lead to probing of internal services and injection of unescaped remote HTML, which may execute scripts in the browsers of users viewing the affected pages. The vulnerability has a CVSS 3.1 score of 7.4, indicating a medium severity level.
YesWiki versions prior to 4.6.7 have an authorization bypass vulnerability in the ApiService::isAuthorized() function. This flaw allows unauthenticated attackers to access admin-only API routes when public API mode is enabled. Exploitation can lead to unauthorized configuration changes and manipulation of backup archives, including listing, downloading, or deleting them.
YesWiki versions before 4.6.7 have a vulnerability where password reset tokens do not expire, allowing attackers to reuse old reset links. This flaw enables attackers who obtain unused reset URLs from various sources to reset passwords and take over accounts. The vulnerability is identified as CVE-2026-104468 and has a medium severity rating with a CVSS score of 4.8.