electronegativity

Electronegativity ⚠️ We're no longer actively maintaining this project ⚠️ What's Electronegativity? Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as...

PT-2026-111667

Name of the Vulnerable Software and Affected Versions XenServer versions 8.4 through 9 Description A logic error exists in the handling of XSA-308 where VMX VMEntry checks fail when a specific state combination occurs: DB is intercepted, Single Stepping is active, and blocked by STI/MovSS is...

PT-2026-109183

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

PYSEC-2026-4199

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by t...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: Fixed the race condition in cpntf publish in nfs4initcpstate. In nfs4allocinitcpntfstate, the new cpntf entry was published into the s2scpstateids IDR with cstype set, and then the lock was taken again to append it to...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Do not reset the dql stats during a NONFATAL reset. All ibmvnic resets should instead call netdevtxresetqueue when reopening the device. netdevtxresetqueue resets the numqueued and numcompleted byte counters. These stats...

CVE-2026-101160

The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors...

CVE-2026-101160 WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating

The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors...

PT-2026-104517

Name of the Vulnerable Software and Affected Versions WP Ultimate Review WordPress plugin versions prior to 2.4.4 Description Unauthenticated users can store crafted review content that causes the reviewed page to fail with a fatal error on every subsequent visit. This leads to a persistent denia...

Linux Distros Unpatched Vulnerability : CVE-2026-83663

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no...

CVE-2026-83663

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

AZL-106551 CVE-2026-83663 affecting package thrift 0.24.0-1

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

AZL-106029 CVE-2026-83663 affecting package kata-containers-preview 3.27.0~preview2-2

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

UBUNTU-CVE-2026-83663

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

CVE-2026-83663

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

EUVD-2026-91581

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

Allocation of Resources Without Limits or Throttling

Overview github.com/apache/thrift/lib/go/thrift is a Go implementation of the Apache Thrift library. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in TFramedTransport.Read in lib/go/thrift/framedtransport.go and THeaderTransport.Read in...

CVE-2026-83663: Uncontrolled Recursion

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

PT-2026-104327

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An uncontrolled recursion issue exists in the Go bindings. Both Go transports attempt to satisfy a read from a buffered frame; if the frame contains no payload bytes, the system reads the next...

PT-2026-102411

Name of the Vulnerable Software and Affected Versions Zephyr versions 4.3.0 through 4.4.x Description The native BSD-socket layer incorrectly records pending asynchronous socket errors by storing them in the user data field of the net context structure. This field is also used by the network stac...