UBUNTU-CVE-2026-94633

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

UBUNTU-CVE-2026-85494

Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D...

Improper Handling of Length Parameter Inconsistency

Overview Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency via improper message handling in language bindings. An attacker can cause application crashes or excessive resource consumption by sending specially crafted requests. Remediation A fix...

EUVD-2026-91401

Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D...

Improper Handling of Length Parameter Inconsistency

Overview thrift is a Python bindings package for Apache Thrift. Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency via improper message handling in language bindings. An attacker can cause application crashes or excessive resource consumption b...

Poc_CVE-2025-68645

CVE-2025-68645 - Zimbra 경로 순회 취약점 📋 개요 CVE-2025-68645 는 Zimbra Collaboration Suite 의 경로 순회 취약점으로, 인증되지 않은 공격자가 서버 파일 시스템에서 임의 파일을 읽을 수 있습니다. 취약한 엔드포인트 /h/printconversations?javax.servlet.include.servletpath= 🎯 영향 영향| 심각도 ---|--- 인증되지 않은 파일 읽기| 🔴 높음 구성 정보 노출| 🔴 높음 자격 증명 유출| 🔴 높음 내부 네트워크 매핑| 🟠 중간 📁...

IPFire_2.19_RCE_Authenticated

IPFire 2.19 OINKCODE RCE PoC IPFire 2.19 の ids.cgi ページにおける OINKCODE パラメータを介した認証を必要とするコマンドインジェクション脆弱性の Python 製概念実証 PoC です。 認可されたセキュリティテストおよびトレーニングラボのみを対象としています。 この PoC は、自分が所有しているか、明示的なテスト許可を得たシステムに対してのみ実行してください。作者は、このコードによって引き起こされた誤用や損害について一切責任を負いません。 脆弱性の概要 IPFire 2.19 は、/cgi-bin/ids.cgi...

CVE-2026-18953

CVE-2026-18953 — PoC 任意のファイル書き込みを awslabs.aws-transform-mcp-server AWS Transform MCP サーバー において、getresource ツールの savePath パラメータ経由で行うものです。 | ---|--- CVE| CVE-2026-18953 CWE| CWE-22 — 制限付きディレクトリへのパス名の不適切な制限 影響を受けるバージョン| awslabs.aws-transform-mcp-server 0.1.0 – 0.1.4 修正バージョン| 0.1.5 CVSS v3.1| 8.6 HIG...

CVE-2026-97652

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

AZL-106629 CVE-2026-94635 affecting package thrift 0.24.0-1

Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

DEBIAN-CVE-2026-94635

Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94635

Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

UBUNTU-CVE-2026-94635

Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94633 Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94633

A vulnerability exists in the Apache Thrift Dart bindings (versions before 0.25.0 ) where an unauthenticated remote attacker can trigger a Denial of Service (DoS) condition. The flaw occurs when sending input with inconsistent length parameters , specifically causing the TBinaryProtocol.readMessa...

CVE-2026-94633 Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91366

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-97652 WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

EUVD-2026-91337

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-97652

The WP Statistics WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 14.16.14 . The root cause is insufficient input sanitization and output escaping of the REQUEST_URI Query-Parameter Key. This allows unauthenticated attackers to inject arb...