32226 matches found
Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)
...
Apache Thrift: C++ WebSocket server transport does not read a full request length
...
Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back
...
Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection
...
Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path
...
Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up
...
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes available
...
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)
...
Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript
...
Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)
...
Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound
...
Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id
...
Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely
...
Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op
...
Apache Thrift: Perl TLS client disables certificate verification by default
...
Microsoft Exchange Server Elevation of Privilege Vulnerability
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network...
zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write
...
OpenSC card-setcos.c setcos_construct_fci_44 stack-based overflow
...
Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write
...
gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink
...
Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)
...
Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm
...
RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass
...
RabbitMQ: Admin path-traversal write via trace name
...
RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression
...
RabbitMQ OAuth credential refresh retains revoked runtime tags
...
RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint
...
RabbitMQ: LDAP DN injection via unescaped substitution
...
RabbitMQ: Atom table exhaustion via management API node field
...
RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values
...
RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass
...
RabbitMQ: Atom exhaustion: to_atom on global-parameter :name
...
RabbitMQ: Trust-store whitelist by Issuer+Serial only
...
RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access
...
RabbitMQ: Web-STOMP unbounded pre-auth accumulation
...
Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape
...
Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram
...
Axios: Header Injection via Inherited headers After Minimal Interceptor
...
sprintf-js through 1.1.3 Denial of Service via Unbounded Precision
...
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
...
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
...
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
...
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
...
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
...
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
...
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
...
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
...
PyJWT accepts public JWK containers as HMAC secrets
...