CVE-2026-104874 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items, in multidictitemsviewor2impl and subtraction operation, d.items - operand, in multidictitemsviewsub1impl fail to release new key-identit...

CVE-2026-104874

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items, in multidictitemsviewor2impl and subtraction operation, d.items - operand, in multidictitemsviewsub1impl fail to release new key-identit...

CVE-2026-94650

A flaw was found in Apache Thrift. An uncontrolled recursion vulnerability in the C GLib library bindings allows a remote, unauthenticated attacker to send specially crafted input to an affected application. Processing this input triggers excessive nested function calls that exhaust stack memory,...

CVE-2026-66081

A flaw was found in Apache Thrift's C GLib bindings. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted input that triggers the access of an uninitialized pointer. This access can cause the application to crash, resulting in a Denial of Service DoS...

WordPress WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete vulnerability

Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete vulnerability discovered by Niv Kochan in WordPress Plugin WPCafe versions = 3.0.19...

OPENSUSE-SU-2026:22013-1 Security update for openexr

This update for openexr fixes the following issue: - CVE-2026-88384: NULL pointer dereference in the C++ attribute parsing path when a specially crafted EXR file containing an unknown-type attribute with dataSize set to zero is processed bsc1282700...

CVE-2026-66054

A flaw was found in the Apache Thrift C++ bindings. A remote, unauthenticated attacker could cause a Denial of Service DoS by sending specially crafted, highly compressed data payloads. Because the software does not properly restrict resource allocation during decompression, processing these...

CVE-2026-93393

A flaw was found in mongo-c-driver. A heap-based buffer overflow exists in the Transport Layer Security TLS transport layer when compiled with the Windows platform TLS backend. A remote server can exploit this flaw by sending crafted encrypted traffic after the TLS handshake completes, causing th...

AZL-105950 CVE-2026-66858 affecting package thrift 0.24.0-1

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

DEBIAN-CVE-2026-66858

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

CVE-2026-66858

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

DEBIAN-CVE-2026-66055

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

AZL-105935 CVE-2026-66055 affecting package thrift 0.24.0-1

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

AZL-105938 CVE-2026-66054 affecting package thrift 0.24.0-1

Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

AZL-106023 CVE-2026-66055 affecting package kata-containers-preview 3.27.0~preview2-2

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

AZL-106506 CVE-2026-66055 affecting package kata-containers 4.1.0.kata0-1

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

AZL-106521 CVE-2026-66055 affecting package kata-containers-cc 3.15.0.aks0-21

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

DEBIAN-CVE-2026-66054

Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66055

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66054

Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...