CVE-2026-96294 Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-96294

The Apache Thrift NodeJS bindings are susceptible to an Uncaught exception and Improper Handling of Exceptional Conditions vulnerability. This issue specifically impacts versions of Apache Thrift released before 0.25.0 . While some documentation suggests the root cause relates to a missing error ...

EUVD-2026-91411

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-96294

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94645

The Apache Thrift nodejs bindings are vulnerable to an improper validation of specified quantity in input and an allocation of resources without limits or throttling vulnerability. Specifically, the TJSONProtocol component uses a peer-declared container size as an unbounded loop bound. This issue...

CVE-2026-94645

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Improper Handling of Length Parameter Inconsistency

Overview Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency via improper message handling in language bindings. An attacker can cause application crashes or excessive resource consumption by sending specially crafted requests. Remediation A fix...

Improper Handling of Length Parameter Inconsistency

Overview thrift is a Python bindings package for Apache Thrift. Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency via improper message handling in language bindings. An attacker can cause application crashes or excessive resource consumption b...

axios: Axios: HTTP header injection via inherited prototype properties

A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...

CVE-2026-91137

Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

UBUNTU-CVE-2026-94639

improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91366

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94633

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-80443

Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle AiTM. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-94635

A vulnerability exists in the Apache Thrift Lua bindings (versions before 0.25.0 ) caused by the improper handling of length parameter inconsistencies . Specifically, the TBinaryProtocol:readMessageBegin function may bypass checkStringSize on the pre-versioned name, allowing a remote attacker to ...

Improper Handling of Length Parameter Inconsistency

Overview Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency in the handling of length parameters in the Lua bindings. An attacker can cause excessive resource allocation by sending requests with inconsistent length parameters, potentially...

CVE-2026-94635

Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91326

Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle AiTM. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-80443

HAVELSAN Inc. Sef - AI Chatbot Platform (versions before 2.1 ) is vulnerable to an improper certificate validation flaw within the API Tool Runner component. This vulnerability allows an Adversary in the Middle (AiTM) to intercept communications. While the impact is rated as High with potential f...

CVE-2026-63571

Improper verification of cryptographic signature in the attribute certificate path validator PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to have a forged X.509 attribute certificate accepted as...