CVE-2026-104415

The Ghost platform (versions 0.7.2 before 6.64.0 ) contains an information disclosure vulnerability within the Admin API . Authenticated users with staff-level privileges can query the Admin API to determine the relative ordering of password hashes belonging to other staff users. While this allow...

CVE-2026-104414

Ghost versions 2.5.0 before 6.64.0 are susceptible to a stored cross-site scripting (XSS) vulnerability. The root cause is the processing of untrusted scripts through oEmbed photo responses . An attacker can host malicious oEmbed responses which, when embedded, execute scripts in the Ghost editor...

CVE-2026-104413

Ghost versions 5.94.0 before 6.64.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. This flaw occurs when the application allows staff users, including Contributors, to host arbitrary HTML by abusing the bookmark card image fetching mechanism. An attacker can create bookmark ...

CVE-2026-104412

Ghost versions 0.5.0 before 6.64.0 are vulnerable to a privilege escalation flaw due to improper restrictions on staff role assignments. An authenticated user with an Editor or Super Editor role can bypass permission checks to assign their own role to other staff members. Specifically, these user...

CVE-2026-104411

Ghost versions 6.22.1 before 6.64.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists because the default local storage adapter allows staff users to upload files served with extension-derived content types , enabling them to host malicious scripts. An attacker ...

CVE-2026-103763

Versions of SiYuan prior to v3.8.5 are susceptible to an information disclosure vulnerability via the getNotebookInfo endpoint. This flaw allows read-only publish readers—including anonymous visitors if no password is set—to query publish-visible notebooks and retrieve metadata for publish-exclud...

CVE-2026-104410

Versions of SiYuan prior to 3.8.5 are vulnerable to an information disclosure flaw involving the /api/export/preview endpoint. This vulnerability allows readers of published content to access password-protected and publish-disabled database rows. Specifically, an attacker can request an export pr...

CVE-2026-103762

SiYuan versions prior to v3.8.5 are susceptible to a missing authorization vulnerability within the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints. Attackers with read-only or anonymous publish access can exploit this by performing a POST request with any open note...

CVE-2026-85088

The Apache Thrift C++ (0.7.0 through 0.24.0) and D (0.9.0 through 0.24.0) libraries are vulnerable to an improper certificate validation flaw during TLS connections. The default access managers (TSSLSocketFactory in C++ and accessManager in D) fail to reject certificates when subjectAltName dNSNa...

CVE-2026-9825

The IBM Cyber Fraud product (versions 1.0.0 - 1.0.2 ) is vulnerable to a security flaw where a missing secure attribute allows sensitive cookies to be transmitted over unencrypted connections. This could enable an attacker to intercept session data via network-based attacks. The issue is resolved...

CVE-2026-87800

IBM CyberFraud versions 1.0.0 through 1.0.2 are vulnerable to a flaw that allows a remote authenticated attacker to execute arbitrary code . The root cause is the unrestricted upload of a file with a dangerous type (CWE-434). The impact includes high severity consequences to the system's integrit...

CVE-2026-85087

The Apache Thrift python bindings are vulnerable to improper certificate validation and the return of wrong status codes in versions before 0.25.0 . A specific underlying cause involves the host-name check silently becoming a no-op when using Python ≥3.12 . This vulnerability can lead to security...

CVE-2026-85086

A vulnerability exists in the Apache Thrift perl bindings due to insecure default settings and improper certificate validation . These flaws cause client connections to fail to verify the authenticity of remote server certificates. An unauthenticated attacker positioned on the network could explo...

CVE-2026-82459

Apache Thrift versions before 0.25.0 are vulnerable to a Denial of Service (DoS) condition due to an integer underflow (wrap or wraparound) in the 32-bit C++ THeaderTransport component. A remote, unauthenticated attacker can exploit this by sending specially crafted network traffic, which trigger...

CVE-2026-82458

The Apache Thrift framework is vulnerable to a Denial of Service (DoS) condition in multiple language bindings, including Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D . The root cause is a failure to properly restrict memory allocation when processing input containing excessi...

CVE-2026-96288

The Apache Thrift Erlang bindings are vulnerable to Uncontrolled Recursion and Allocation of Resources Without Limits or Throttling (CWE-674, CWE-770). Specifically, Erlang generated struct reads lack a recursion-depth guard , which can lead to unbounded memory consumption. This issue impacts ver...

CVE-2026-96292

A flaw in the Apache Thrift Lua bindings allows a remote attacker to exploit an Inefficient Regular Expression Complexity vulnerability. By sending specially crafted input, an attacker can trigger a backtracking pattern (quadratic) in the THttpTransport:_parseHeaders function, leading to excessiv...

CVE-2026-96294

The Apache Thrift NodeJS bindings are susceptible to an Uncaught exception and Improper Handling of Exceptional Conditions vulnerability. This issue specifically impacts versions of Apache Thrift released before 0.25.0 . While some documentation suggests the root cause relates to a missing error ...

CVE-2026-61373

Apache Thrift versions before 0.25.0 are vulnerable to an Allocation of Resources Without Limits or Throttling issue within the Java TSaslNonblockingServer component. Specifically, the vulnerability involves a pre-auth unbounded SASL frame allocation . This flaw can lead to high impact on system ...

CVE-2026-96990

Apache Thrift Erlang bindings are vulnerable to an Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability. Specifically, the erlang thrift_json_protocol component reads a whole message without a size bound. This issue affects versions before 0.25.0 . To remediate, users are ...

CVE-2026-94642

The Apache Thrift library is susceptible to an uncaught exception vulnerability in its PHP bindings . Specifically, the TSimpleServer component may exit the entire process when encountering any non-transport exception. This issue affects versions before 0.25.0 . To remediate this vulnerability, u...

CVE-2026-94644

The Apache Thrift PHP bindings are vulnerable to an allocation of resources without limits or throttling (CWE-770). Specifically, the TJSONProtocol string and number readers lack size bounds, which can lead to resource exhaustion. This issue impacts Apache Thrift versions prior to 0.25.0 . To rem...

CVE-2026-94645

The Apache Thrift nodejs bindings are vulnerable to an improper validation of specified quantity in input and an allocation of resources without limits or throttling vulnerability. Specifically, the TJSONProtocol component uses a peer-declared container size as an unbounded loop bound. This issue...

CVE-2026-94650

The Apache Thrift library (versions before 0.25.0 ) is vulnerable to an Uncontrolled Recursion issue within the c_glib bindings . The root cause is that c_glib generated struct readers lack a recursion-depth guard , which can lead to native stack exhaustion . This vulnerability can potentially re...

CVE-2026-94651

The Apache Thrift Java bindings are vulnerable to an improper handling of exceptional conditions and a missing release of resource after effective lifetime vulnerability. Specifically, the TSaslNonblockingServer Computation.run method can orphan a connection when a pre-auth parse error occurs. Th...

CVE-2026-85483

Apache Thrift versions before 0.25.0 are vulnerable to a Use of Uninitialized Resource and Return of Wrong Status Code vulnerability within the c_glib bindings . Specifically, the c_glib TZlibTransport may report a full read even after a premature stream end occurs. To remediate this issue, users...

CVE-2026-85493

The Apache Thrift framework is vulnerable to an Uncontrolled Recursion vulnerability in its Dart and Java ME bindings, specifically affecting versions prior to 0.25.0 . The root cause is that TProtocolUtil.skip follows peer-chosen nesting to any depth permitted by the stack. This issue can lead t...

CVE-2026-85494

Apache Thrift versions before 0.25.0 are vulnerable to a flaw where the framed transport and binary protocol read buffers from a peer-declared length without a limit. This improper handling of length parameters, combined with flawed input processing and resource allocation, can trigger uncaught e...

CVE-2026-97876

A flaw in GRUB2 allows a local attacker with control over the boot configuration to bypass Secure Boot lockdown restrictions. The root cause is the insufficient validation of the MMIO base address passed to the serial command; GRUB fails to verify that the address corresponds to a legitimate UART...

CVE-2026-104606

A security flaw exists in the itsourcecode Online Admission System Project 1.0 . An unknown function within the confirm.php file is vulnerable to SQL injection due to the improper handling of the ID argument. This vulnerability can be exploited remotely. The documents indicate that an exploit has...

CVE-2026-91135

Apache Thrift versions before 0.25.0 are vulnerable to a heap-based buffer overflow in the C++ THeaderTransport component. The flaw exists in the THeaderTransport::transform() function when the ZLIB transform is enabled; the system copies compressed frames into the write buffer without verifying ...

CVE-2026-86326

A vulnerability exists in protocol gateways due to an improper verification of cryptographic signatures . The device fails to verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface can provide a sp...

CVE-2026-91137

The Apache Thrift PHP bindings are vulnerable to Improper Validation of Specified Quantity in Input , Allocation of Resources Without Limits or Throttling , and Excessive Iteration vulnerabilities. This issue specifically affects versions before 0.25.0 . The root cause involves improper handling ...

CVE-2026-86325

A stack-based buffer overflow vulnerability exists in the account management interface of protocol gateways . The root cause is insufficient length validation of the account_name parameter during account management requests. An attacker authenticated as a read-only user to the web management inte...

CVE-2026-59668

The Repasat application is susceptible to a Cross-Site Scripting (XSS) vulnerability. An attacker can exploit the "nomTamano" parameter on the "/es/companysizebills/store" endpoint to trick a user into executing arbitrary code within their browser. No specific remediation steps, exploit links, or...

CVE-2026-93925

Apache Thrift versions before 0.25.0 are vulnerable to a stack-based buffer overflow caused by an incorrect bitwise integer shift within the C++ THeaderProtocol implementation. Specifically, the flaw exists in the THeaderTransport::writeVarint32() function when processing a negative protocol ID. ...

CVE-2026-59667

The Repasat application contains a Cross-Site Scripting (XSS) vulnerability (CWE-79). The issue exists in the "nomTamano" parameter within the "/es/companysizemployees/update" endpoint. Successful exploitation could allow an attacker to deceive a user into executing arbitrary code within their br...

CVE-2026-93926

Apache Thrift versions before 0.25.0 are vulnerable to a memory leak in the THeaderTransport component. Specifically, the C++ THeaderTransport::untransform() function fails to release the zlib stream on the error path. This failure to release allocated memory and system resources allows a remote ...

CVE-2026-94633

A vulnerability exists in the Apache Thrift Dart bindings (versions before 0.25.0 ) where an unauthenticated remote attacker can trigger a Denial of Service (DoS) condition. The flaw occurs when sending input with inconsistent length parameters , specifically causing the TBinaryProtocol.readMessa...

CVE-2026-59666

The Repasat application is affected by a Cross-Site Scripting (XSS) vulnerability. The flaw exists in the "nomOrigen" parameter located at the "/es/origins/store" endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code within their web browser. No s...

CVE-2026-94634

The Apache Thrift Python bindings are vulnerable to allocation of resources without limits or throttling and initialization of a resource with an insecure default (CWE-770, CWE-1188). Specifically, the Python TJSONProtocol has a string length limit that is disabled by default. This issue affects ...

CVE-2026-59665

The Repasat application is susceptible to a Cross-Site Scripting (XSS) vulnerability. The flaw exists in the "nomMotivo" parameter at the "/es/lostmotives/store" endpoint. Successful exploitation could allow an attacker to deceive a user into executing arbitrary code within their browser. No spec...

CVE-2026-103885

The Apache Directory LDAP API (versions 2.1.0 through 2.1.8 ) contains an Asymmetric Resource Consumption vulnerability. An attacker can cause a Denial of Service (DoS) by submitting specially crafted Telephone Numbers , which leads to indefinite 100% CPU core consumption . This can severely degr...

CVE-2026-103877

The Apache Directory LDAP API is vulnerable to a deserialization of untrusted data flaw (CWE-502) in versions 2.1.0 through 2.1.8 . A rogue or compromised LDAP server, or a pre-TLS Man-in-the-Middle (MITM) attacker, can provide a malicious schema object during a loadSchema() subschema search. Thi...

CVE-2026-59662

The Repasat application is affected by a Cross-Site Scripting (XSS) vulnerability, categorized as CWE-79 . The flaw exists in the "nomCompetidor" parameter at the "/es/competitors/store" endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code within...

CVE-2026-103880

The Apache Directory LDAP API is vulnerable to an Asymmetric Resource Consumption (CWE-405) vulnerability. When storing a password using the bcrypt algorithm with a high cost factor (e.g., 30), the server CPU can be forced to run for hours while checking credentials, leading to a Denial of Servic...

CVE-2026-59664

A Cross-Site Scripting (XSS) vulnerability exists in the Repasat application . The flaw is located in the "nomServicioPrestado" parameter of the "/es/providedservices/store" endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code within their browse...

CVE-2026-103878

The Apache Directory LDAP API versions 2.1.0 through 2.1.8 are vulnerable to a cleartext transmission of sensitive information. The root cause involves a StartTLS extended operation initiated after a Search request has been sent, which can result in data being received in plain text before the TL...

CVE-2026-59663

The Repasat application is susceptible to a Cross-Site Scripting (XSS) vulnerability. The flaw exists in the "nomDelegacion" parameter at the "/es/delegations/store" endpoint. If successfully exploited, an attacker could trick a user into executing arbitrary code within their web browser. No spec...

CVE-2026-104403

The ThimPress LearnPress WordPress plugin (versions up to and including 4.4.9 ) is susceptible to an Authorization Bypass Through User-Controlled Key vulnerability. This flaw arises from incorrectly configured access control security levels , which can lead to Insecure Direct Object References (I...