Heap-based memory corruption in Apache Thrift versions before 0.25.0 lets unauthenticated remote attackers who can send Thrift protocol messages to a parsing service trigger an integer-overflow-driven undersized heap allocation followed by an out-of-bounds write, resulting in a crash (denial of service) or potentially attacker-controlled memory corruption with high confidentiality, integrity, and availability impact. The affected surface is any service that deserializes untrusted Thrift traffic; the CVSS v4.0 score of 9.2 reflects network reachability and no required privileges or user interaction, while the AC:H and AT:P metrics (mirrored by the assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicate that a successful exploit depends on crafting malformed messages that reliably hit the overflow condition and on runtime factors such as heap layout, memory limits, and the specific protocol/transport in use. No public exploit code or confirmed active exploitation was identified at time of analysis, but the framework's broad embedding in RPC and serialization pipelines makes prompt upgrade to 0.25.0 the clear priority. Services that never parse Thrift input from untrusted or remote peers are not reachable through this vector.
Authorization bypass in YesWiki before 4.6.7 lets unauthenticated remote attackers call admin-only API routes when the instance has public API mode enabled, enabling configuration overwrites via api/ci/update_config and listing, downloading, or deleting backup archives via api/archives. The vulnerability is a missing-authorization flaw in ApiService::isAuthorized(), rated 9.2 under CVSS 4.0 but with a significant prerequisite: public API mode is a non-default administrative setting, so default installations are not exploitable through this path. No public exploit code or confirmed active exploitation is identified in the available intelligence, but the impact is high for exposed instances and patching to 4.6.7 is the primary fix.
Path traversal (CWE-22) in image-downloader 4.3.0 allows an attacker who controls the download URL to write response data outside the configured destination directory, resulting in arbitrary file overwrite or corruption (CVSS 9.1, I:H/A:H, C:N). Per the CVSS vector, the flaw is network-reachable, low-complexity, unauthenticated, and requires no user interaction against the library, but exploitation is limited to applications that forward untrusted URLs to it. No public exploit code or active exploitation (CISA KEV) has been identified, and an upstream fix commit (fb44543) is available.
Crafted small-order or out-of-range Diffie-Hellman values passed to DHAgreement.CalculateAgreement in Bouncy Castle C# (bc-csharp) before 2.7.0 let an on-path attacker or malicious peer defeat the key authentication MTI/A0 is designed to provide and, when the local party reuses a static DH private key, learn that key modulo the small factors of p-1 - with full recovery possible in groups where p-1 has many small prime factors. The issue is unauthenticated (CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), and exploitation is not opportunistic: it works only where an application calls DHAgreement directly in an MTI/A0 two-pass flow, and it requires a protocol peer or on-path attacker able to inject a crafted 'message' or public-key value; higher-level Bouncy Castle protocol wrappers are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates real-world blast radius as narrower than the 9.1 CVSS 4.0 base score suggests because of the narrow direct-caller API surface, the static-key reuse prerequisite, and the dependence on weak group parameters for complete key recovery.
Authenticated users of the Meari IoT Cloud Platform OpenAPI Service can retrieve the complete device shadow of any device on the platform simply by supplying that device's ID, because the service performs no ownership or authorization check on the request (CWE-862 Missing Authorization); CVSS 4.0 base score 7.1, assessed as CVSS 3.1 7.1 with high confidentiality impact and no integrity or availability impact. The attacker must hold valid credentials for the OpenAPI Service - the vector is PR:L, so any single legitimate device owner or registered developer account qualifies - and must know or be able to enumerate target device IDs; no user interaction or special configuration is required. Exposed data includes device credentials, owner details, network configuration, and telemetry, so a successful read can enable device takeover and account enumeration. Reporting comes from CISA ICS-CERT (ICSA-26-274-06); no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the low-complexity, network-reachable nature of the flaw makes follow-on abuse plausible.
Path traversal in TaskingAI v0.3.0's DALL-E 3 image-generation tool lets an attacker who can invoke that tool write downloaded images to arbitrary locations on the server filesystem by injecting traversal sequences into the project_id parameter passed to save_url_image (CWE-22). The independent assessment scores this as an integrity-only file-write issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), which is materially more conservative than the CNA's 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) that asserts no privileges required and full confidentiality plus integrity impact - the vector conflict matters because it changes who is realistically in scope. Exploitation is not unconditional: the DALL-E 3 tool must be enabled and configured with valid image-generation API credentials and the attacker must be able to drive that pipeline with a controlled project_id; EPSS is 0.14% (3rd percentile), there is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting in the WHM Manage SSL Hosts interface of cPanel and WP Squared allows an authenticated attacker who can create or modify an SSL host entry to inject arbitrary script that executes in the browser of a higher-privileged operator - typically a server administrator - when that administrator later views the interface, giving the attacker arbitrary code execution in the victim's session context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) confirms the prerequisites: a prior authenticated foothold and administrator user interaction, which is a low barrier in multi-tenant or reseller hosting environments where low-privileged accounts are routine. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV); vendor-released patches are available in cPanel builds 11.110.0.148, 11.134.0.61, 11.136.0.45, 11.138.0.11 and WP Squared 11.138.1.13.
Stored cross-site scripting (XSS) in the WHM Mass Modify Accounts interface of cPanel and WP Squared allows an authenticated low-privilege WHM user (such as a reseller) to inject malicious script that executes when a higher-privileged operator views the affected interface, potentially leading to arbitrary code execution in the context of the victim's browser session. Affected versions include cPanel before 11.110.0.148, 11.134.0.61, 11.136.0.45, and 11.138.0.11, and WP Squared before 11.138.1.13. No public exploit identified at time of analysis, but vendor patches are available; the high CVSS score (9.0) is tempered by the requirement for an authenticated foothold and victim interaction.
Unauthenticated session prediction in Monta App's WebSocket backend permits remote attackers to impersonate other charging station sessions or cause denial of service by reusing predictable charging-station identifiers. The CVSS 3.1 base score of 7.3 reflects network reachability, low complexity, no privileges required, and limited confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Authentication identifiers for Monta-managed charging stations are published on publicly accessible web-based mapping platforms, so any remote, unauthenticated party can retrieve them simply by browsing those maps. The exposure is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and stems from insufficiently protected credentials (CWE-522); EUVD-2026-91820 lists all versions of monta.app as affected. Impact is bounded to a confidentiality disclosure that enables follow-on misuse rather than direct station or account takeover, since how far the leaked identifiers can be abused depends on how Monta's backend trusts them; there is no public exploit identified at time of analysis and CISA ICSA-26-274-02 does not confirm active exploitation.
SQL injection in HAVELSAN's Sef - AI Chatbot Platform, affecting all releases prior to 2.1, lets an attacker who holds a valid low-privilege account feed crafted SQL metacharacters through a user-controllable input that is concatenated into a database query, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is network-reachable with low attack complexity and needs no user interaction, but the vector's PR:L means an attacker must first obtain platform credentials; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1241) does not disclose the specific vulnerable endpoint or parameter. This is a credible, actionable priority rather than a high-CVSS-but-low-risk issue, though real-world exposure is bounded by the narrow deployment base of this specific vendor product.
Unauthenticated attackers can delete or overwrite federated entries in YesWiki instances before 4.6.7 that have ActivityPub federation enabled and mirror at least one remote entry, because the ActivityPub inbox does not bind the verified HTTP signature signer to the activity actor. Any party can generate their own ActivityPub keypair and sign a Delete or Update activity that references a mirrored entry's sourceUrl, causing the target instance to act on another actor's entry. No public exploit code has been identified at time of analysis, and the impact is limited to integrity and availability of federated entries - it does not allow reading private data or compromising the host.
Opening an attacker-controlled Kerchunk reference document with fsspec's ReferenceFileSystem can execute arbitrary Python code, because versions from 0.9.0 up to (but not including) 2026.6.0 render reference fields through unrestricted jinja2 templates instead of treating them as inert data. The vulnerability is exploitable by unauthenticated attackers but requires user interaction: the victim application - or a downstream consumer such as xarray - must actually open the malicious document, which can be supplied inline or fetched from an attacker-controlled URL, and the gen-array code path triggers with no special configuration at all. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-94), it is addressed by the vendor's 2026.6.0 release, which makes jinja interpretation opt-in; no public exploit identified at time of analysis.
Account takeover in the WordPress plugin Super Forms - Drag & Drop Form Builder affects every version through 6.3.316: any authenticated user with Subscriber-level access or above can overwrite the password and email address of an arbitrary account, including an administrator, and seize the site. The flaw sits in the Register & Login add-on, whose before_email_success_msg() routine trusts an attacker-supplied user_id in its register_login_action='update' flow and hands it directly to wp_update_user() without any ownership or capability check, while the super_save_form AJAX action that creates the malicious form is equally unprotected; the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) reflects that a low-privileged, self-registrable account is the only real prerequisite. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the low bar to entry plus the add-on requirement makes this a genuinely high-priority privilege-escalation flaw rather than an inflated score.
Type confusion in the V8 JavaScript engine of Google Chrome allows remote code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page, affecting all versions prior to 154.0.8037.97 (Chromium severity: High, CVSS 3.1 base 8.8). Exploitation is unauthenticated but requires user interaction (UI:R) - the victim must navigate to or render attacker-controlled HTML/JavaScript - and code execution is confined to the sandbox with scope Unchanged, so escaping to the host OS would require a separate sandbox-escape flaw and site isolation further limits cross-origin reach. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available.
Unauthenticated SQL injection in YesWiki before 4.6.7 allows remote attackers to read arbitrary database contents, including user password hashes, by saving crafted Bazar filtertags markup into a page. The Bazar filtertags action wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause, so a token ending in a backslash breaks quote parity under MySQL/MariaDB escaping and permits a five-column UNION subquery. Exploitation requires a MySQL-family backend and the ability to store filtertags markup - on default installations with open page editing no authentication or user interaction is required - and no public exploit code has been identified at time of analysis; the issue carries a CVSS 8.8 score and is a genuine high-priority flaw, not an inflated rating.
Use-after-free in SVG rendering in Google Chrome versions prior to 154.0.8037.97 allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by convincing a victim to load a crafted HTML page. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting unauthenticated remote reach with high confidentiality, integrity and availability impact, but it does require user interaction - the victim must navigate to or render attacker-controlled content, and no non-default configuration is needed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the practical severity is further bounded by the fact that code execution stays within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape bug. Vendor-released patch: Chrome 154.0.8037.97.
Heap-based buffer overflow in Google Chrome's WebRTC component allows a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to open a crafted HTML page; all Chrome builds prior to 154.0.8037.97 on desktop and mobile platforms are affected. Successful exploitation requires user interaction (the victim must navigate to or open the attacker-controlled page), but no authentication or prior privileges are needed, and WebRTC is enabled by default. Impact is high for confidentiality, integrity, and availability within the renderer process, though the attack scope is unchanged - breaking out to the host operating system would require chaining a separate sandbox-escape flaw. Exploitation signals are currently weak: EPSS is only 0.25% (15th percentile), CISA SSVC rates exploitation as 'none', and no public exploit code has been identified at time of analysis; a vendor patch is available.
Opening a crafted untrusted document in Apache OpenOffice 4.1.16 and earlier can execute arbitrary code at the opening user's privilege level, including code fetched from a remote location, because the document's Java integration fails to authorize the external links it resolves. Exploitation is unauthenticated but requires user interaction: Java runtime integration must be enabled (the default configuration) and the victim must actively open an attacker-supplied file, making social engineering the primary delivery vector. There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV and SSVC both report none), and EPSS is only 0.22% (12th percentile); a vendor fix is expected in Apache OpenOffice 4.1.17, which is still in the release-candidate phase, so the recommended interim mitigation is to disable Java runtime integration in the Preferences dialog or to avoid opening untrusted documents entirely.
Use-after-free in Google Chrome's MediaStream component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim renders a crafted HTML page, affecting all Chrome builds prior to 154.0.8037.97 on the stable channel. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but depends on user interaction: the target must load a malicious page that exercises the WebRTC/MediaStream path, and the resulting code execution is confined to the sandboxed renderer (S:U), so host-level compromise would require a separate sandbox-escape bug. At time of analysis there is no public exploit identified and no evidence of active exploitation (SSVC Exploitation: none, EPSS 0.21% / 11th percentile), while a vendor patch exists at Chrome 154.0.8037.97, making this a serious-but-not-emergency patching priority.
Incorrect access control in TransformerOptimus SuperAGI v0.0.14 lets an authenticated, low-privilege organization user in a multi-tenant deployment supply another organization's agent_id or agent_execution_id to the save_agent_as_template and publish_template endpoints, which perform no ownership check on the referenced agent or execution - enabling cross-organization disclosure of agent data and unauthorized template creation. Exploitation requires a valid authenticated account (PR:L) and a deployment where multiple organizations' agents coexist, so single-tenant installations are essentially unaffected; no public exploit identified at time of analysis, EPSS is 0.21% (10th percentile), and there is no CISA KEV listing. Our independent re-assessment scores this 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) rather than the submitted 8.8, reflecting confirmed confidentiality exposure with more limited integrity impact and no availability impact.
Workflow-supplied container options in Gitea act_runner (versions before 3.0.0) are merged straight into the Docker HostConfig of the job container, letting a workflow author request host PID/IPC namespaces, CapAdd=ALL and unconfined seccomp/apparmor and then escape to the runner host as root. The twist is that the flaw is exploitable precisely when runner privileged mode is disabled: that code path forces only Privileged=false while preserving namespace, capability, device and security-profile flags from workflow YAML, so the control administrators rely on does not contain the attack. Only the Docker job-container backend is affected, and exploitation requires the ability to submit or trigger a workflow on a repository served by that runner (authenticated, push or pull-request privileges per the PR:L vector), with impact changing scope to the underlying host; no public exploit identified at time of analysis, and EPSS is low at 0.20% (9th percentile), though real-world risk is severe for shared runners open to untrusted workflow authors.
Cross-site request forgery in the Webriti 'Wallstreet' WordPress theme affects all versions through 2.8.6, letting an attacker forge state-changing requests that are executed with the privileges of a logged-in site administrator. The independent assessment rates this at CVSS 3.1 4.3-class impact (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) rather than the vendor-published 8.8, because exploitation depends on tricking an already-authenticated admin into visiting attacker-controlled content or clicking a crafted link while their session is active - the UI:R requirement is the primary limiting factor. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory (reported by Patchstack) indicates versions above 2.8.6 are not affected, though the input does not name that fixed version.
Denial of service in Apache Thrift deployments that use the D language bindings before version 0.25.0, where malformed input reaching the service endpoint triggers an uncaught exception, an infinite loop with an unreachable exit condition, and an integer underflow that can crash or hang the service. The assessed impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.7), meaning unauthenticated remote attackers who can reach a D-bindings Thrift service need no credentials, user interaction, or non-default configuration to cause disruption. Exposure is narrow because only services compiled against the D bindings are affected - Java, Python, C++, Go and other language binding deployments are not - and no public exploit code has been identified at time of analysis.
Server-side request forgery in YesWiki before 4.6.7 allows unauthenticated remote attackers to force the server to issue arbitrary GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action, with fetched responses stored back as readable Bazar entries. The CVE carries a CVSS 4.0 base score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N, high confidentiality impact, low integrity and availability impact), matching our independent assessment of CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - no special privileges or user interaction are required, only network reachability to an instance running a vulnerable version that exposes the sync action. Impact is highest where the YesWiki host sits adjacent to internal services or a cloud metadata endpoint, and no public exploit code has been identified at time of analysis; the issue is not listed as confirmed actively exploited (CISA KEV).
SQL injection in YesWiki before 4.6.7 allows an attacker with page-write access - which the supplied CVSS 4.0 vector (PR:N) rates as unauthenticated on default installations - to inject a UNION subquery through the Bazar nuagetag action's tags attribute, exfiltrating password hashes and arbitrary database table contents. The flaw carries a CVSS 4.0 score of 8.8, and an independent assessment confirms high confidentiality impact with low integrity and availability impact. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but the vendor has released a patch (4.6.7) and public advisories are available.
Denial of service in the Apache Thrift Node.js bindings (all versions before 0.25.0) lets remote, unauthenticated attackers crash the hosting Node.js process by delivering a crafted Thrift message that triggers an uncaught exception during deserialization. The vendor-supplied CVSS 4.0 score of 8.7 is driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N), and our independent assessment maps this to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - no authentication, user interaction, or non-default configuration is required, so any deployment that parses untrusted Thrift input over the network is exposed. The practical risk is bounded by reachability: services that only accept trusted internal Thrift traffic are far less exposed. No public exploit code or confirmed active exploitation was identified at time of analysis. The description also cites improper validation of input quantities and prototype pollution, but the assessed impact per the vendor metrics remains availability-only.
Remote denial of service against Apache Thrift C++ deployments that use the THeaderProtocol is achievable by sending a crafted frame header to a network-reachable Thrift endpoint, causing a stack-based buffer overflow that crashes the service; the flaw combines CWE-121 with an incorrect bitwise shift of an integer in the same header-parsing code path. Every Apache Thrift release before 0.25.0 ships the vulnerable C++ implementation, although only services that actually use the THeaderProtocol transport are exposed - services built against other Thrift protocols or transports are not affected by this specific code path. The CVSS 4.0 base score is 8.7 on a fully unauthenticated, network-reachable vector with availability-only impact (VC:N/VI:N/VA:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Denial of service in the Go language bindings of Apache Thrift affects all versions before 0.25.0, where resources are allocated without limits or throttling, allowing a remote unauthenticated client to exhaust server memory or other resources and take down the service. Per the assessed vector (AV:N/AC:L/PR:N/UI:N, availability-only impact), any Thrift Go server endpoint reachable over the network is exposed, with no confidentiality or integrity consequence; the practical exposure is narrowed by network reachability and by whether the deployment accepts Thrift traffic from untrusted clients. CISA KEV does not list this issue and no public exploit code was identified at time of analysis, so exploitation appears to require only a crafted or excessive-volume Thrift message rather than a published attack tool.
Remote, unauthenticated attackers can crash applications built against Apache Thrift's c_glib (C/GLib) language bindings before version 0.25.0 by supplying crafted Thrift protocol input that triggers access of an uninitialized pointer (CWE-824), degrading availability with no confidentiality or integrity impact. The flaw carries a CVSS 4.0 score of 8.7 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and only deployments that use the c_glib binding and expose a Thrift endpoint to an attacker-reachable network are affected - services using Java, Python, Go or other bindings are not exposed to this particular defect. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV); a vendor-released patch, version 0.25.0, is available.
Denial of service in Apache Thrift's c_glib (C/GLib) language bindings before 0.25.0, where a crafted or malformed message reaching the deserialization/parsing path triggers a NULL pointer dereference and uninitialized-variable use that crashes the process. The issue is remotely reachable and unauthenticated (CVSS:4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with availability-high impact only), so any network-exposed Thrift service built on the c_glib binding is at risk of abrupt termination; confidentiality and integrity are unaffected. Only the c_glib binding is implicated - other Thrift bindings are not affected - and no public exploit code has been identified at time of analysis, with the vendor shipping a fix in 0.25.0.
Denial of service in Apache Thrift's Go bindings (all versions before 0.25.0) allows an unauthenticated remote peer to crash an entire Thrift-serving process by sending a single crafted frame over the TFramedTransport or THeaderTransport. A frame that yields no payload bytes causes the transport to recurse into Read rather than loop, so a peer can drive unbounded recursion with only 4 bytes (declared frame size of zero) or 18 bytes (a header block that fills the frame) until the Go stack limit is hit; the resulting runtime fatal error is not catchable by recover() and kills the process. The impact is availability-only - no confidentiality or integrity effect - and no public exploit code has been identified at time of analysis, though exploitation needs only network reachability to the Thrift listener with no authentication or user interaction (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/.../VA:H).
Memory exhaustion in Apache Thrift's Node.js and D language WebSocket server transports (all versions before 0.25.0) lets unauthenticated remote attackers commit 513 MiB on a Node.js server, or up to 2 GiB on the D transport, by sending a single ~14-byte frame that merely declares a huge payload length. The transport reads the length out of the WebSocket frame header and allocates that many bytes immediately, before the payload has actually arrived, so an extremely small request causes disproportionate memory growth; in the Node.js case the connection is left open afterwards, allowing the same frame to be resent repeatedly until the service is exhausted or killed. Impact is limited to availability (CVSS 4.0 8.7, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no authentication or user interaction is required, and no public exploit code was identified at time of analysis. Affected deployments are those exposing the Thrift WebSocket server transport from the Node.js or D bindings; other Thrift transports and language bindings are out of scope.
Uncaught exception handling in the Apache Thrift Ruby bindings lets unauthenticated remote attackers crash network-reachable Thrift RPC services running any version before 0.25.0. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or special configuration are required: any reachable Thrift Ruby service that parses attacker-supplied protocol messages can be knocked offline, though impact is limited to availability with no confidentiality or integrity loss. The flaw carries a CVSS 4.0 score of 8.7 (High) and an assessed CVSS 3.1 of 7.5, and no public exploit identified at time of analysis; exposure is confined to deployments using the Ruby language bindings rather than Thrift bindings for other languages.
Inefficient algorithmic complexity (CWE-407) in Apache Thrift's Lua bindings prior to version 0.25.0 allows remote, unauthenticated attackers to exhaust CPU and cause denial of service by supplying crafted input that the Lua binding parses. Only deployments that specifically use the Thrift Lua language binding and expose it to attacker-influenced data are affected; applications using other Thrift language bindings (Java, Python, C++, Go, etc.) are not impacted. The impact is limited to availability - no confidentiality or integrity loss is indicated by the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 8.7), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers can crash applications that use the Apache Thrift PHP bindings prior to version 0.25.0 by supplying crafted Thrift protocol messages that trigger a NULL pointer dereference (CWE-476). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the flaw is remotely reachable with low complexity and requires no authentication or user interaction, but the impact profile is availability-only (VC:N/VI:N/VA:H) - there is no confidentiality or integrity exposure, so the 8.7 score reflects a pure denial-of-service outcome rather than code execution. Exploitation is conditional on the target PHP service actually accepting and deserializing attacker-controlled Thrift input, and no public exploit code has been identified at time of analysis. A vendor patch is available in Apache Thrift 0.25.0, which per the advisory fixes the issue.
Memory exhaustion in Apache Thrift before 0.25.0 lets unauthenticated remote attackers crash services that deserialize attacker-controlled Thrift messages, and the flaw is present across the Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D language bindings. The supplied CVSS 4.0 vector (8.7 High) and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree that impact is availability-only: no confidentiality or integrity loss, and no authentication, user interaction, or special configuration is required beyond a reachable endpoint that accepts untrusted Thrift input. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor-released fix is version 0.25.0.
Denial of service in Apache Thrift Node.js bindings before 0.25.0 allows unauthenticated remote attackers who can reach a Thrift listener to send a crafted or malformed message that triggers an uncaught exception and terminates the Node.js process. The vendor CVSS 4.0 score is 8.7 and the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is availability-only with no confidentiality or integrity loss. Only the Node.js language bindings are affected; no public exploit identified at time of analysis.
Resource-exhaustion denial of service in Apache Thrift's Java TSaslNonblockingServer component allows remote attackers to drive the service into an unresponsive state by consuming server resources without limit (CWE-770). All Apache Thrift releases before 0.25.0 are affected, and the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms the attack is network-reachable and requires no credentials or user interaction once an exposed TSaslNonblockingServer endpoint is reachable; impact is confined to availability, with no confidentiality or integrity loss. Exploitation is only possible against deployments that specifically use the Java non-blocking SASL server class, which limits real-world exposure since blocking servers and non-SASL configurations are unaffected; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a patch-now hygiene item rather than an emergency.
An uncaught exception (CWE-248) in Apache Thrift's PHP language bindings before 0.25.0 allows unauthenticated remote attackers to terminate PHP processes that accept arbitrary Thrift protocol input, producing a denial of service with no confidentiality or integrity impact. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) means no privileges or user interaction are required against a default deployment that exposes a vulnerable PHP-based Thrift endpoint to untrusted network traffic; the practical prerequisite is that the target actually uses the PHP bindings rather than another language binding. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation potential is bounded to service availability - this is a genuine but limited availability risk rather than a data-breach emergency.
Uncontrolled recursion in the Dart and Java ME bindings of Apache Thrift before 0.25.0 lets a remote, unauthenticated attacker crash or hang a service by sending a Thrift message containing deeply nested or self-referential structures that exhaust the parser's stack. Impact is availability-only (no confidentiality or integrity effect per the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and the vulnerable surface is confined to deployments that deserialize untrusted data using the Dart or Java ME bindings, so most Thrift users on Java SE, C++, Python, or Go are not exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 4.0 base score of 8.7 should be read alongside the narrow binding-specific exposure, which makes real-world priority moderate rather than critical.
Denial of service in Apache Thrift before 0.25.0 allows unauthenticated remote attackers to crash or exhaust services running affected language bindings by sending malformed Thrift protocol data. The flaw combines improper length-parameter handling with excessive memory allocation, inefficient algorithmic complexity, uncaught exceptions, and insecure default initialization across the Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP, and D bindings. It is availability-only: no code execution, data disclosure, or data tampering is known from this issue. No public exploit code or confirmed active exploitation was identified at time of analysis; upgrading to 0.25.0 resolves it.
Denial of service in the Apache Thrift PHP bindings before version 0.25.0 lets remote, unauthenticated attackers exhaust CPU and memory on a Thrift-serving PHP application by sending a crafted Thrift message whose declared quantity is never validated. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor CVSS 4.0 base 8.7), the weakness is availability-only: there is no code execution, data exposure, or integrity impact, and only deployments that use the PHP bindings to parse untrusted Thrift input over the network are exposed. No public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis, and no EPSS score was supplied; non-PHP Thrift bindings are out of scope for this issue.
Memory exhaustion in Apache Thrift's THeaderTransport affects all versions before 0.25.0, allowing remote attackers to cause a denial of service. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is unauthenticated and requires no user interaction: an attacker can send crafted messages to a Thrift endpoint that uses THeaderTransport, triggering unreleased memory allocations that accumulate and eventually exhaust server resources. The flaw is rated CVSS 8.7 (4.0) with availability-only impact (VC:N/VI:N/VA:H); no public exploit code has been identified at the time of analysis.
Denial of service in Apache Thrift's Dart bindings (all versions before 0.25.0) lets an unauthenticated remote attacker crash or hang a service by sending a Thrift message whose length or size field declares an excessive allocation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, score 8.7) confirms the flaw is remotely reachable without authentication or user interaction, but impact is confined to availability - confidentiality and integrity are explicitly rated N, with no data exposure or code execution described in any source. Only deployments that deserialize attacker-supplied Thrift traffic through the Dart bindings are affected, and no public exploit identified at time of analysis.
Denial of service in Apache Thrift's Lua language bindings (all versions before 0.25.0) allows unauthenticated remote attackers to drive unbounded resource allocation by sending protocol messages whose declared length parameter is inconsistent with the actual data, abusing a missing allocation limit (CWE-770). Per the vendor vector (PR:N/UI:N) no credentials or user interaction are required; impact is confined to availability (AV:N/AC:L/PR:N/UI:N with A:H, and no confidentiality or integrity effect), meaning memory or CPU exhaustion and likely process termination rather than data exposure or modification. Only deployments that expose a Thrift service implemented with the Lua bindings are in scope, so services built on Thrift's C++, Java, Python, Go and other bindings are not affected by this specific issue; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, and no EPSS score was supplied for this analysis.
Memory exhaustion in Bouncy Castle C# (bc-csharp) before 2.7.0 allows a remote, unauthenticated attacker to cause a denial of service against applications that verify HSS/LMS (RFC 8554) signatures using an attacker-supplied public key, because the HSS level count L is parsed without being bounded and then drives a huge array allocation during signature parsing - a single verification can commit roughly 17 GB of memory or terminate with an OutOfMemoryException. Impact is availability-only (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): no confidentiality or integrity loss, and no authentication or user interaction is required. Exposure is bounded by the fact that HSS/LMS is a niche post-quantum feature, so only deployments that parse untrusted HSS keys and then verify signatures are affected; no public exploit identified at time of analysis, and no evidence of confirmed active exploitation (no CISA KEV listing).
Memory-exhaustion denial of service in the C# DTLS implementation of Bouncy Castle (bc-csharp) before 2.7.0 lets a remote, unauthenticated DTLS peer crash or stall a process by driving unbounded handshake-fragment reassembly buffers. A crafted fragment header can declare a message length of nearly 16 MB; because the reassembler is sized from that attacker-controlled 24-bit length before any check against the negotiated maximum handshake message size, a payload-free fragment forces an allocation of roughly 16 MB, and up to 16 pending messages per handshake multiply this toward hundreds of MB per unauthenticated connection, all before the handshake is authenticated. DTLS servers and DTLS clients built on bc-csharp are both affected, while pure TLS usage is explicitly not; no public exploit code has been identified at time of analysis, and the issue is rated CVSS 4.0 8.7 / CVSS 3.1 8.7 (AV:N/AC:L/PR:N/UI:N, availability-only impact).
Denial of service and limited integrity tampering in Apache Thrift before 0.25.0 stem from a combination of an infinite loop (CWE-835) and prototype pollution in the Node.js bindings when the TJSONProtocol deserializer parses crafted JSON. Any application exposing a Thrift service built on the Node.js library with TJSONProtocol enabled on an untrusted, attacker-reachable input path can be driven into an unreachable-exit loop that hangs the process, with secondary risk of object prototype attribute manipulation altering application state; the vulnerability is reachable unauthenticated and without user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability High, integrity Low) and the vendor rates it 8.7. No public exploit code has been identified at time of analysis and the issue is not recorded as actively exploited, though the affected product family and the low attack complexity make it a realistic target for opportunistic scanning. Risk is bounded by deployment: services using TBinaryProtocol, TCompactProtocol or non-Node.js Thrift bindings are not affected by this vector.
Authenticated SQL injection in UTMStack before 11.2.16 lets any valid low-privilege logged-in user execute arbitrary SQL against the backend PostgreSQL database via the assetType and groupName parameters of GET /api/utm-asset-groups/searchGroupsByFilter. Because the database connection runs with DBA (PostgreSQL superuser-class) privileges, successful exploitation extends from full read and modification of stored data to potential filesystem access on the host. The vendor has released a fix in v11.2.16; no public exploit code has been identified at time of analysis, and the main practical constraint is that an authenticated session is required. Reported by VulnCheck, and tracked as CWE-89.