[CVE_SUBSCRIPTIONS]

Receive alerts for specific vendors, products, or severities
📡 [FLUX RSS CVE]

Subscribe to the CVE feed

7 derniers jours

> FILTERS

> Last 7 Days

STATISTIQUES

Total CVE: 411883
> CVE-2026-94651 [HIGH 8.2]
[PUBLISHED: 2026-10-02] [EPSS 0.47%]
improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
> CVE-2026-94650 [HIGH 8.2]
[PUBLISHED: 2026-10-02] [EPSS 0.43%]
Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
AFFECTED_PRODUCTS: Red Hat Red Hat Hardened Images
> CVE-2026-94645 [HIGH 8.2]
[PUBLISHED: 2026-10-02] [EPSS 0.43%]
Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
> CVE-2026-94644 [HIGH 8.2]
[PUBLISHED: 2026-10-02] [EPSS 0.43%]
Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
> CVE-2026-94642 [HIGH 8.7]
[PUBLISHED: 2026-10-02] [EPSS 0.43%]
Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
> CVE-2026-94633 [HIGH 8.7]
[PUBLISHED: 2026-10-02] [EPSS 0.43%]
Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
AFFECTED_PRODUCTS: Red Hat Red Hat Hardened Images
> CVE-2026-93926 [HIGH 8.7]
[PUBLISHED: 2026-10-02] [EPSS 0.43%]
Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
AFFECTED_PRODUCTS: Red Hat Red Hat Hardened Images
> CVE-2026-93925 [HIGH 8.7]
[PUBLISHED: 2026-10-02] [EPSS 0.46%]
Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
AFFECTED_PRODUCTS: Red Hat Red Hat Hardened Images
> CVE-2026-91137 [HIGH 8.7]
[PUBLISHED: 2026-10-02] [EPSS 0.43%]
Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
> CVE-2026-91135 [CRITICAL 9.2]
[PUBLISHED: 2026-10-02] [EPSS 0.46%]
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as...
> CVE-2026-86326 [HIGH 8.6]
[PUBLISHED: 2026-10-02] [EPSS 0.19%]
An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provide...
> CVE-2026-86325 [CRITICAL 9.4]
[PUBLISHED: 2026-10-02] [EPSS 0.34%]
A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management requests. An attacker authenticated as a read-only user to the web m...
> CVE-2026-85494 [HIGH 8.7]
[PUBLISHED: 2026-10-02] [EPSS 0.47%]
Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D lang...
AFFECTED_PRODUCTS: Red Hat Red Hat Hardened Images
> CVE-2026-85493 [HIGH 8.7]
[PUBLISHED: 2026-10-02] [EPSS 0.43%]
Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
> CVE-2026-85483 [MEDIUM 6.3]
[PUBLISHED: 2026-10-02] [EPSS 0.43%]
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
> CVE-2026-59668 [MEDIUM 4.8]
[PUBLISHED: 2026-10-02] [EPSS 0.23%]
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizebills/store”.
> CVE-2026-59667 [MEDIUM 4.8]
[PUBLISHED: 2026-10-02] [EPSS 0.29%]
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizemployees/update”.
> CVE-2026-59666 [MEDIUM 4.8]
[PUBLISHED: 2026-10-02] [EPSS 0.29%]
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomOrigen” parameter is affected – endpoint “/es/origins/store”.
> CVE-2026-104606 [LOW 2.1]
[PUBLISHED: 2026-10-02] [EPSS 0.25%]
A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file confirm.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public...
> CVE-2026-97652 [MEDIUM 6.1]
[PUBLISHED: 2026-10-02] [EPSS 0.26%]
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes it...
> CVE-2026-95662 [MEDIUM 4.8]
[PUBLISHED: 2026-10-02] [EPSS 0.23%]
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – endpoint “/es/competitors/store”.
> CVE-2026-94639 [HIGH 8.2]
[PUBLISHED: 2026-10-02] [EPSS 0.43%]
improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
> CVE-2026-94635 [HIGH 8.7]
[PUBLISHED: 2026-10-02] [EPSS 0.43%]
Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
AFFECTED_PRODUCTS: Red Hat Red Hat Hardened Images
> CVE-2026-94634 [HIGH 8.2]
[PUBLISHED: 2026-10-02] [EPSS 0.43%]
Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
> CVE-2026-94541 [CRITICAL 9.8]
[PUBLISHED: 2026-10-02] [EPSS 0.49%]
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...
> CVE-2026-94405 [MEDIUM 5.3]
[PUBLISHED: 2026-10-02] [EPSS 0.33%]
Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71.
> CVE-2026-94180 [MEDIUM 4.3]
[PUBLISHED: 2026-10-02] [EPSS 0.28%]
Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sensitive Data. This issue affects Advanced Ads: from n/a through 2.0.26.
> CVE-2026-87920 [HIGH 7.2]
[PUBLISHED: 2026-10-02] [EPSS 0.24%]
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to in...
> CVE-2026-85492 [MEDIUM 6.1]
[PUBLISHED: 2026-10-02] [EPSS 0.21%]
The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output escapin...
> CVE-2026-80298 [HIGH 8.8]
[PUBLISHED: 2026-10-02] [EPSS 0.30%]
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows SQL Injection. This issue affects Sef - AI Chatbot Platform: before 2.1.
> CVE-2026-59673 [MEDIUM 4.8]
[PUBLISHED: 2026-10-02] [EPSS 0.38%]
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTipoCli” parameter is affected – endpoint “/es/clientypes/update/109441”.
> CVE-2026-59672 [MEDIUM 4.8]
[PUBLISHED: 2026-10-02] [EPSS 0.38%]
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomGrupoEmpresarial” parameter is affected – endpoint "/es/corporategroups/update/246”.
> CVE-2026-59665 [MEDIUM 4.8]
[PUBLISHED: 2026-10-02] [EPSS 0.23%]
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomMotivo” parameter is affected – endpoint “/es/lostmotives/store”.
> CVE-2026-59664 [MEDIUM 4.8]
[PUBLISHED: 2026-10-02] [EPSS 0.23%]
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomServicioPrestado” parameter is affected – endpoint “/es/providedservices/store”.
> CVE-2026-59663 [MEDIUM 4.8]
[PUBLISHED: 2026-10-02] [EPSS 0.23%]
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomDelegacion” parameter is affected – endpoint “/es/delegations/store”.
> CVE-2026-59662 [MEDIUM 4.8]
[PUBLISHED: 2026-10-02] [EPSS 0.23%]
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – endpoint “/es/competitors/store”.
> CVE-2026-59661 [MEDIUM 4.8]
[PUBLISHED: 2026-10-02] [EPSS 0.23%]
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomRuta” parameter is affected – endpoint “/es/routes/update/693”.
> CVE-2026-59660 [MEDIUM 4.8]
[PUBLISHED: 2026-10-02] [EPSS 0.23%]
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTransportista” parameter is affected – endpoint “/es/carriers/update”.
> CVE-2026-59659 [MEDIUM 4.8]
[PUBLISHED: 2026-10-02] [EPSS 0.23%]
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomZonaGeo” parameter is affected – endpoint “/es/geozones/update/149979”.
> CVE-2026-104403 [MEDIUM 5.3]
[PUBLISHED: 2026-10-02] [EPSS 0.20%]
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9.
> CVE-2026-103885
[PUBLISHED: 2026-10-02] [EPSS 0.49%]
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9....
> CVE-2026-103880
[PUBLISHED: 2026-10-02] [EPSS 0.49%]
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to  run for hours checking the credentials. A bounded cost should be enforced...
> CVE-2026-103878
[PUBLISHED: 2026-10-02] [EPSS 0.21%]
Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP AP...
> CVE-2026-103877
[PUBLISHED: 2026-10-02] [EPSS 0.57%]
Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java class, allowing some potential RCE.  This issue affects Apach...
> CVE-2026-103552
[PUBLISHED: 2026-10-02] [EPSS 0.34%]
Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9. Users are recommended to upgrade to version 1.2...
> CVE-2026-102731
[PUBLISHED: 2026-10-02] [EPSS 0.43%]
Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer (or a MITM) can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM O...
> CVE-2026-95512 [MEDIUM 5.5]
[PUBLISHED: 2026-10-02] [EPSS 0.17%]
A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subrouti...
AFFECTED_PRODUCTS: Red Hat Red Hat Hardened Images
> CVE-2026-91784 [MEDIUM 4.8]
[PUBLISHED: 2026-10-02] [EPSS 0.15%]
cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- (e.g. containing a target user's UID). When the user running g...
> CVE-2026-80464 [MEDIUM 4.9]
[PUBLISHED: 2026-10-02] [EPSS 0.27%]
Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue affects Sef - AI Chatbot Platform: before 2.1.
> CVE-2026-80443 [HIGH 7.4]
[PUBLISHED: 2026-10-02] [EPSS 0.16%]
Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle (AiTM). This issue affects Sef - AI Chatbot Platform: before 2.1.