CVE-2026-94422

The xdg-dbus-proxy filtering proxy (versions before 0.1.9 ) contains an incorrect implementation of message filtering. An attacker can bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. This vulnerability could allow a malicious ...

CVE-2026-93875

The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.5.2.1 . The root cause is insufficient input sanitization and output escaping of the 'friendlyTime' parameter. This flaw allows unauthenticated attackers to inject arbi...

CVE-2026-19652

The Divi Membership plugin for WordPress (versions up to and including 2.2.0 ) is vulnerable to unauthenticated privilege escalation via the form_id parameter. The root cause lies in the dmem_form_submit_handler() function, which determines a new user's role by iterating through all WordPress rol...

CVE-2026-104721

A path-traversal vulnerability exists in the logback-classic module for Java (versions 0.9.14 through 1.6.4 ). The flaw is caused by an unsanitized Mapped Diagnostic Context (MDC) discriminator value flowing into a nested FileAppender path. An attacker capable of influencing this MDC value—for ex...

CVE-2026-104613

The CodeAstro Simple Pharmacy Management System 1.0 is vulnerable to an SQL injection vulnerability within the /SimplePharmacy-PHP/product/view.php file. The root cause is the improper manipulation of the ID argument , which allows for remote execution of the attack. The exploit has been publicly...

CVE-2026-85215

A SQL Injection vulnerability exists in GG Soft Software Services Inc. Paperwork due to the improper neutralization of special elements used in SQL commands. This issue affects versions of the software through 2026-09-09 . The vulnerability allows an attacker to execute unauthorized SQL commands,...

CVE-2026-66054

The Apache Thrift C++ bindings are vulnerable to a Denial of Service (DoS) attack due to a flaw in how the software handles highly compressed data. Specifically, the C++ THeaderTransport component fails to enforce the configured maxFrameSize , allowing a remote, unauthenticated attacker to send s...

CVE-2026-61374

The Apache Thrift Java bindings are vulnerable to an Allocation of Resources Without Limits or Throttling (CWE-770) issue. Specifically, the Java TSaslTransport component fails to enforce a size limit on post-auth data-frames. This vulnerability affects versions before 0.25.0 . Impacting availabi...

CVE-2026-63772

The Apache Thrift go bindings are vulnerable to an Allocation of Resources Without Limits or Throttling vulnerability (CWE-770). This issue affects versions before 0.25.0 and can lead to an unauthenticated single-packet crash of Go Thrift servers via the THeader transform count . The high-severit...

CVE-2026-66055

The Apache Thrift framework (versions before 0.25.0 ) is vulnerable to an Allocation of Resources Without Limits or Throttling (CWE-770) flaw. Specifically, the TJSONProtocol component accepts a single JSON string or number that exceeds the configured size limit across multiple language bindings,...

CVE-2026-104612

The SourceCodester Student Result Management System 1.0 contains a Cross-Site Scripting (XSS) vulnerability within the Announcement Module . The flaw is located in the script/academic/core/new_announcement.php file, where the manipulation of the title/announcement argument allows for remote execu...

CVE-2026-11795

The Softtr Informatics Trading Limited Company E-Commerce Pack (affected through 2026-10-02) contains an observable discrepancy vulnerability (CWE-203) that facilitates Account Footprinting . This flaw allows for user enumeration or footprinting within the application. No specific root cause deta...

CVE-2026-102797

The ThemeREX Addons plugin for WordPress (versions

CVE-2026-102798

The ThemeREX Addons (trx_addons) WordPress plugin, from version n/a through 2.46.0 , is vulnerable to a Stored Cross-site Scripting (XSS) flaw. This issue is caused by the improper neutralization of input during web page generation, which could allow an attacker to inject and execute malicious sc...

CVE-2026-66081

A flaw exists in the Apache Thrift c_glib bindings (versions before 0.25.0 ) where the read_message_begin function leaves output parameters unset for non-versioned messages. This results in an Access of Uninitialized Pointer vulnerability. A remote, unauthenticated attacker can exploit this by se...

CVE-2026-66331

The Apache Thrift library, specifically versions before 0.25.0 , is vulnerable to an Allocation of Resources Without Limits or Throttling vulnerability (CWE-770). The issue exists within the Delphi bindings buffered transport, where buffered transport reads are not properly accounted against the ...

CVE-2026-66837

A flaw exists in the Apache Thrift PHP bindings (versions before 0.25.0 ) where an integer overflow allows a wire-controlled string length to improperly size a stack buffer. This leads to a stack-based buffer overflow when processing specially crafted data. A remote, unauthenticated attacker can ...

CVE-2026-66858

Apache Thrift versions before 0.25.0 are vulnerable to a Denial of Service (DoS) attack due to a flaw in the protocol skip routine. Specifically, multiple language bindings fail to enforce recursion limits when processing skipped fields in incoming messages. A remote, unauthenticated attacker can...

CVE-2026-66859

Apache Thrift versions prior to 0.25.0 are vulnerable to a NULL Pointer Dereference and Use of Uninitialized Variable within the c_glib bindings . Specifically, the c_glib multiplexed processor can be triggered to crash when it encounters a message it cannot route. The impact of this vulnerabilit...

CVE-2026-83632

Versions of Apache Thrift prior to 0.25.0 are vulnerable to a Heap-based buffer overflow , Integer overflow or wraparound , and Allocation of resources without limits or throttling . Specifically, the C++ THttpTransport component can grow its line buffer without bound. This vulnerability could le...