CVE-2026-104611

A stack-based buffer overflow vulnerability exists in the Tenda AC9 (version 15.03.02.13). The flaw is located within an unknown function in the /goform/fast_setting_internet_set file of the POST Request Handler component. By manipulating the netWanType argument, an attacker can trigger the overf...

CVE-2026-85476

Versions of Apache Thrift prior to 0.25.0 are vulnerable to a Loop with unreachable exit condition ('infinite loop') within the c_glib bindings . Specifically, the read_all function spins indefinitely when the underlying read operation returns 0. This vulnerability can lead to high availability i...

CVE-2026-96289

Apache Thrift PHP bindings are vulnerable to an Uncontrolled Recursion vulnerability (CWE-674) in versions before 0.25.0 . Specifically, the php --gen php:inlined struct readers and TProtocol::skipBinary lack a recursion-depth guard, which can lead to a denial of service. Remediation is available...

CVE-2026-96287

The Apache Thrift Perl bindings are vulnerable to an Inefficient Algorithmic Complexity vulnerability (CWE-407) in versions prior to 0.25.0 . The root cause is that the Perl FramedTransport reads and TLS socket writes re-slice the remaining buffer on every call, resulting in quadratic time comple...

CVE-2026-96286

An uncaught exception vulnerability exists in the Apache Thrift Perl bindings for versions before 0.25.0 . The root cause involves the Perl server ending the serve() function when a single connection fails, which can lead to a high impact on availability. Users are recommended to upgrade to versi...

CVE-2026-96277

A flaw in the Apache Thrift Ruby bindings allows a remote attacker to cause a Denial of Service (DoS) . The root cause is the improper handling of exceptional conditions , where the SimpleServer ends serve() on any non-Transport/Protocol exception. By triggering an uncaught exception , an attacke...

CVE-2026-94658

Apache Thrift versions before 0.25.0 are vulnerable to an Inefficient Algorithmic Complexity (CWE-407) issue within the Lua bindings . The root cause is that the Lua TFramedTransport and THttpTransport components re-slice the buffer on every read operation, resulting in quadratic complexity . Thi...

CVE-2026-94657

A vulnerability in the Apache Thrift JavaME bindings allows a remote attacker to cause a Denial of Service (DoS) . The root cause is improper resource allocation controls , where sending requests that trigger unbounded resource consumption can exhaust system resources and make the service unavail...

CVE-2026-94656

The Apache Thrift ruby bindings are vulnerable to an allocation of resources without limits or throttling (CWE-770). Specifically, the rb TJsonProtocol/TJSONProtocol component lacks a string size bound, which could allow for resource exhaustion. This issue affects versions before 0.25.0 . To reme...

CVE-2026-104610

A stack-based buffer overflow vulnerability exists in the Boa Web Server component of Tenda HG7, HG9, and HG10 (300001138_en_xpon) devices. The issue is triggered by manipulating the Ethtype argument within the boaGetVar function of the /boaform/formLoopBack file. This vulnerability can be exploi...

CVE-2026-94655

Apache Thrift versions before 0.25.0 are vulnerable to an Allocation of Resources Without Limits or Throttling and Inefficient Algorithmic Complexity vulnerability within the Lua bindings . Specifically, the TJsonProtocol string and number readers lack size bounds and exhibit quadratic behavior. ...

CVE-2026-94654

The Apache Thrift python bindings are vulnerable to a Loop with unreachable exit condition (infinite loop) vulnerability (CWE-835). Specifically, the Python TNonblockingServer busy-loops and stops selecting all file descriptors after encountering an 8192-byte-boundary frame . This issue affects v...

CVE-2026-85209

The Learning Management System (LMS) developed by AVEZ Electronics Communication Training and Consultancy Trade Inc. is impacted by a Missing Authorization vulnerability (CWE-862). The root cause is incorrectly configured access control security levels , which allows for exploitation. The vulnera...

CVE-2026-94653

The Apache Thrift PHP bindings (versions prior to 0.25.0 ) are vulnerable to an Inefficient Algorithmic Complexity (CWE-407) issue. The root cause is that framed, memory, and HTTP transports re-slice the buffer on every read operation, leading to quadratic complexity. This can result in a high im...

CVE-2026-94652

The Apache Thrift c++ bindings contain a memory leak vulnerability (CWE-401) affecting versions before 0.25.0 . Specifically, the C++ TEvhttpServer component fails to release its RequestContext memory when a processor throws an exception before a callback is executed. This vulnerability can lead ...

CVE-2026-94648

The Apache Thrift dart bindings are vulnerable to an allocation of resources without limits or throttling (CWE-770) because the TJsonProtocol/TJSONProtocol components lack a string size bound . This issue affects versions before 0.25.0 . To remediate, users are recommended to upgrade to version 0...

CVE-2026-94646

A vulnerability exists in Apache Thrift nodejs bindings prior to version 0.25.0 due to improper input validation and prototype pollution . This condition allows an attacker to modify base JavaScript object properties, causing the application to fail when processing incoming data. A remote attacke...

CVE-2026-94638

The Apache Thrift PHP bindings are vulnerable to a Denial of Service (DoS) attack due to a lack of limits or throttling on resource allocation. Specifically, the PHP thrift_protocol C extension fails to honor the configured maxStringSize , allowing a remote attacker to send crafted requests that ...

CVE-2026-94637

A flaw in the Apache Thrift Go library (versions before 0.25.0 ) allows a remote attacker to submit specially crafted, highly compressed data to an affected service. Due to improper handling during decompression, specifically because the THeaderTransport does not bound the inflated size of a ZLIB...

CVE-2026-94636

The Apache Thrift py bindings are vulnerable to improper handling of highly compressed data (data amplification), function calls with incorrectly specified arguments, and improper validation of specified quantities in input. Specifically, the Python TZlibTransport stops enforcing its decompressed...

CVE-2026-92834

The Apache Thrift C++ WebSocket server is vulnerable to a use of uninitialized resource and the return of a wrong status code . The root cause is that the C++ WebSocket server transport fails to read a full request length. This issue affects versions before 0.25.0 . To remediate this vulnerabilit...

CVE-2026-104609

A SQL injection vulnerability exists in the onetwothreeneth HospitalManagementSystem (affected versions up to 9ef91ed6007314b6473110ed699dff76d158f61d ). The flaw is located in the get function of the edit_accounts.php file. An attacker can manipulate the user_id , patient_id , physician_id , dis...

CVE-2026-90440

Apache Thrift's D language implementation is vulnerable in the TNonblockingServer component due to improper handling of exceptional conditions and improper resource shutdown. This flaw allows an exception escaping a libevent callback to trigger an uncaught exception during server operations. A re...

CVE-2026-87117

A NULL pointer dereference vulnerability exists in the Apache Thrift PHP bindings affecting versions before 0.25.0 . The root cause involves the PHP thrift_protocol accelerator dereferencing a missing container-element spec. This vulnerability can result in a high impact on availability (CVSS 8.7...

CVE-2026-86537

A vulnerability exists in the Apache Thrift D language bindings (versions before 0.25.0 ) where a remote, unauthenticated attacker can cause a Denial of Service (DoS) . By sending specially crafted input—specifically a truncated HTTP request —the attacker can trigger an integer underflow or an un...

CVE-2026-86536

Apache Thrift (versions before 0.25.0 ) is vulnerable to a prototype pollution flaw in its all JS bindings . The root cause allows a map key from the wire to replace a decoded object's prototype in the generated JavaScript code. To remediate this issue, users are recommended to upgrade to version...

CVE-2026-104473

Versions of YesWiki before 4.5.3 are susceptible to multiple reflected cross-site scripting (XSS) vulnerabilities. The root cause is the failure to sanitize several input parameters, specifically incomingurl , id , file , tags , and template . A remote attacker can leverage these flaws by luring ...

CVE-2026-104471

Versions of YesWiki before 4.6.7 are vulnerable to an unrestricted file upload vulnerability. Authenticated administrators can exploit this by using the Bazar CSV import preview to write remote files into the web-accessible files/ directory. The root cause is a lack of extension checks when a CSV...

CVE-2026-104472

YesWiki versions prior to 4.6.7 are affected by a missing authorization vulnerability in the attachment download handler . This flaw allows unauthenticated attackers to bypass page read Access Control Lists (ACLs). By requesting the download handler with a known page tag and file parameter , an a...

CVE-2026-104470

Versions of YesWiki before 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the Bazar valeur action . This flaw allows authenticated page editors to force the server to fetch arbitrary URLs by providing them via the url parameter . By embedding this action with a ...

CVE-2026-104468

YesWiki versions prior to 4.6.7 are vulnerable to an insufficient session expiration vulnerability (CWE-613). The root cause is that password reset tokens lack expiry timestamps , allowing an attacker to reuse old reset links. If an attacker obtains an unused reset URL from sources such as mailbo...

CVE-2026-104469

YesWiki versions prior to 4.6.7 are susceptible to a session fixation vulnerability. The root cause is that the application fails to regenerate the PHP session ID during the login process. An attacker who obtains or sets a victim's pre-authentication YesWiki- * session cookie can reuse that cooki...

CVE-2026-104467

Versions of YesWiki prior to 4.6.7 are susceptible to an authorization bypass vulnerability within the ApiService::isAuthorized() function. When public API mode is enabled, unauthenticated attackers can access administrative-only API routes. Specifically, attackers can target endpoints such as ap...

CVE-2026-104465

Versions of YesWiki prior to 4.6.7 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the mail handler due to improper sanitization of the field parameter . Unauthenticated attackers can craft malicious links where a crafted field value breaks out of the aj...

CVE-2026-104466

YesWiki versions prior to 4.6.7 are susceptible to a stored cross-site scripting (XSS) vulnerability located in the formatters/wakka.php component. The root cause is the improper handling of quotes in markdown image URLs , which allows users with page editing or comment posting privileges to inje...

CVE-2026-104464

YesWiki versions prior to 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to force the server to make GET requests by providing an unvalidated actor URL within the Bazar abonnements sync action. Exploitation enables attackers ...

CVE-2026-104462

YesWiki versions before 4.6.7 are vulnerable to an SQL injection within the Bazar nuagetag action. The root cause is the concatenation of unescaped tags attributes into a raw SQL IN clause. Attackers with page-write access (which is unauthenticated on default installations) can inject a tag endin...

CVE-2026-104463

YesWiki versions prior to 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker can trigger server-side requests by sending signed Follow activities to the public forms actor inbox route. By signing requests with their own keyId and supplying inte...

CVE-2026-104461

YesWiki versions prior to 4.6.7 are vulnerable to a stored cross-site scripting (XSS) vulnerability in the Bazar FileField . The root cause is that the application validates only the file extension during upload and fails to call HtmlPurifierService::cleanFile, allowing SVG files to be stored ver...

CVE-2026-104459

Versions of YesWiki prior to 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) in the WebfingerService component. Unauthenticated attackers can exploit this by sending a POST request containing a crafted actor_handle with a numeric host and port to the abonnements view. This allows the...

CVE-2026-104460

Versions of YesWiki prior to 4.6.7 are vulnerable to a blind SQL injection within the {{newtextsearch}} action. The root cause is the concatenation of Bazar list option ids into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without proper escaping. This allows anonymous attackers to plant ...

CVE-2026-104458

YesWiki versions prior to 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the validateKeyIdUrl() function. This flaw allows unauthenticated attackers to bypass the existing SSRF guard by utilizing 6to4, NAT64, or IPv4-compatible IPv6 addresses . By sending a craf...

CVE-2026-104457

YesWiki versions before 4.6.7 are vulnerable to an SQL injection in the Bazar filtertags action. The vulnerability occurs because the application wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default in...

CVE-2026-104456

YesWiki versions prior to 4.6.7 are vulnerable to a second-order SQL injection in the AclService::updateRequestWithACL function. The root cause is the unescaped concatenation of a stored username into a read-ACL LIKE clause. An attacker can exploit this by self-registering an account with a usern...

CVE-2026-104454

YesWiki versions before 4.6.7 are vulnerable to an algorithmic-complexity denial of service within the wakka.php formatter. The root cause is an O(n^2) markdown-link regular expression that allows unauthenticated attackers to submit a small, specially crafted body of bracket characters to the pag...

CVE-2026-104455

YesWiki versions prior to 4.6.7 are vulnerable to an access control bypass via the recentchangesrssplus RSS action. Unauthenticated attackers can request the xml method of a page hosting this action to retrieve 500-character body excerpts of all latest pages. This includes access to read-restrict...

CVE-2026-104453

YesWiki versions prior to 4.6.7 are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability within the admintag action. The root cause allows an attacker to delete tag associations by luring authenticated administrators into clicking crafted GET links. By supplying a wide ID range in the...

CVE-2026-104451

YesWiki versions prior to 4.6.7 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw in the RevisionsHandler component. The root cause is the lack of CSRF token validation for GET requests , which allows an attacker to trick users with write capabilities into navigating to a URL containing ...

CVE-2026-104452

Versions of YesWiki prior to 4.6.7 are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability within the filemanager page handler . The root cause is the failure to validate a CSRF token on GET requests that perform file operations. An attacker could trick a logged-in administrator or p...

CVE-2026-104450

YesWiki versions before 4.6.7 are vulnerable to a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php ). This flaw allows unauthenticated attackers to bypass write Access Control List (ACL) checks by sending POST requests with pagetag, title, and description f...