Stack-based buffer overflow in the Tenda AC9 wireless router (firmware 15.03.02.13) allows an attacker to corrupt memory and potentially execute code remotely by sending a crafted POST request containing an oversized netWanType parameter to the /goform/fast_setting_internet_set endpoint. Exploitation requires a privileged session on the device's web management interface (CVSS 4.0 PR:H / assessed CVSS 3.1 PR:H), and in default deployments the management UI is LAN-facing, so remote reach generally depends on remote management being enabled or unchanged default credentials. Publicly available exploit code exists, but no CISA KEV entry confirms active exploitation at time of analysis.
Missing rate limiting on the Monta EV-charging platform's WebSocket API authentication endpoint allows unauthenticated remote attackers to send unlimited login requests, enabling either resource-exhaustion denial of service or sustained credential brute-forcing against Monta accounts. The issue affects monta.app (all versions tracked by EUVD) and carries a CVSS 4.0 base score of 8.7 (High), with the assessed impact concentrated on availability (VA:H) and no direct confidentiality or integrity effect in the base vector; credential compromise via brute force is a downstream outcome that additionally requires weak, guessable, or non-MFA-protected credentials. No public exploit code has been identified at time of analysis, and the flaw has not been confirmed as actively exploited (CISA KEV); reporting originates from CISA ICS-CERT advisory ICSA-26-274-02.
Armatura One ships with a fixed, vendor-defined password assigned to its database superuser account during database initialization, so it is identical across installations unless an administrator has changed it. Anyone who already has access to the underlying host operating system and knows this value can authenticate to the database as the superuser on any deployment where the default has not been rotated. The flaw is rated 8.6 under CVSS 4.0 (assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), requires local OS-level access rather than a network path, requires no user interaction or application-level authentication, and there is no public exploit identified at time of analysis; exploitation is fully prevented on systems where the superuser password has been reset.
Armatura One and Armatura One (USA) installations that enable the optional AES-128-CBC credential protection store database and message-broker credentials under a hard-coded key and IV embedded in the software, so an attacker who has the installation package and separately obtains a target's encrypted install configuration file can decrypt those credentials. The independent assessment scores this as 8.6 but emphasizes a local attack vector: it is not remotely triggerable and requires prior access to the victim's configuration file, with no privileges required (PR:N) but a local prerequisite (AV:L). No public exploit identified at time of analysis.
Armatura One's backup and restore routine writes the complete database connection command - including the database superuser password in plaintext - into a log file stored on the host, so anyone able to read that log recovers credentials sufficient to take full control of the backend database. Exploitation is access-gated: it requires local access to the server operating system (CVSS vector AV:L/PR:L), the privilege to read the affected log, and a prior backup or restore operation to have actually populated the file with the credential, which makes the realistic risk post-compromise privilege escalation or insider abuse rather than remote attack. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the issue has been published through CISA's ICS advisory program (ICSA-26-274-01), indicating deployments in operational-technology and physical-security environments.
Privilege escalation in on-premises Microsoft Exchange Server allows an authenticated attacker with a standard mailbox or domain user account (PR:L) to gain high confidentiality, integrity, and availability impact over the network. The vulnerability affects Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. A vendor patch is available; no public exploit code or active exploitation has been identified at time of analysis, but the low complexity and network reachability make this a priority for organizations still running affected on-premises deployments.
Authenticated users of the Meari IoT Cloud Platform OpenAPI Service can retrieve the complete device shadow of any device on the platform simply by supplying that device's ID, because the service performs no ownership or authorization check on the request (CWE-862 Missing Authorization); CVSS 4.0 base score 7.1, assessed as CVSS 3.1 7.1 with high confidentiality impact and no integrity or availability impact. The attacker must hold valid credentials for the OpenAPI Service - the vector is PR:L, so any single legitimate device owner or registered developer account qualifies - and must know or be able to enumerate target device IDs; no user interaction or special configuration is required. Exposed data includes device credentials, owner details, network configuration, and telemetry, so a successful read can enable device takeover and account enumeration. Reporting comes from CISA ICS-CERT (ICSA-26-274-06); no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the low-complexity, network-reachable nature of the flaw makes follow-on abuse plausible.
SQL injection in HAVELSAN's Sef - AI Chatbot Platform, affecting all releases prior to 2.1, lets an attacker who holds a valid low-privilege account feed crafted SQL metacharacters through a user-controllable input that is concatenated into a database query, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is network-reachable with low attack complexity and needs no user interaction, but the vector's PR:L means an attacker must first obtain platform credentials; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1241) does not disclose the specific vulnerable endpoint or parameter. This is a credible, actionable priority rather than a high-CVSS-but-low-risk issue, though real-world exposure is bounded by the narrow deployment base of this specific vendor product.
Unauthenticated attackers can delete or overwrite federated entries in YesWiki instances before 4.6.7 that have ActivityPub federation enabled and mirror at least one remote entry, because the ActivityPub inbox does not bind the verified HTTP signature signer to the activity actor. Any party can generate their own ActivityPub keypair and sign a Delete or Update activity that references a mirrored entry's sourceUrl, causing the target instance to act on another actor's entry. No public exploit code has been identified at time of analysis, and the impact is limited to integrity and availability of federated entries - it does not allow reading private data or compromising the host.
Opening an attacker-controlled Kerchunk reference document with fsspec's ReferenceFileSystem can execute arbitrary Python code, because versions from 0.9.0 up to (but not including) 2026.6.0 render reference fields through unrestricted jinja2 templates instead of treating them as inert data. The vulnerability is exploitable by unauthenticated attackers but requires user interaction: the victim application - or a downstream consumer such as xarray - must actually open the malicious document, which can be supplied inline or fetched from an attacker-controlled URL, and the gen-array code path triggers with no special configuration at all. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-94), it is addressed by the vendor's 2026.6.0 release, which makes jinja interpretation opt-in; no public exploit identified at time of analysis.
Account takeover in the WordPress plugin Super Forms - Drag & Drop Form Builder affects every version through 6.3.316: any authenticated user with Subscriber-level access or above can overwrite the password and email address of an arbitrary account, including an administrator, and seize the site. The flaw sits in the Register & Login add-on, whose before_email_success_msg() routine trusts an attacker-supplied user_id in its register_login_action='update' flow and hands it directly to wp_update_user() without any ownership or capability check, while the super_save_form AJAX action that creates the malicious form is equally unprotected; the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) reflects that a low-privileged, self-registrable account is the only real prerequisite. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the low bar to entry plus the add-on requirement makes this a genuinely high-priority privilege-escalation flaw rather than an inflated score.
Type confusion in the V8 JavaScript engine of Google Chrome allows remote code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page, affecting all versions prior to 154.0.8037.97 (Chromium severity: High, CVSS 3.1 base 8.8). Exploitation is unauthenticated but requires user interaction (UI:R) - the victim must navigate to or render attacker-controlled HTML/JavaScript - and code execution is confined to the sandbox with scope Unchanged, so escaping to the host OS would require a separate sandbox-escape flaw and site isolation further limits cross-origin reach. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available.
Unauthenticated SQL injection in YesWiki before 4.6.7 allows remote attackers to read arbitrary database contents, including user password hashes, by saving crafted Bazar filtertags markup into a page. The Bazar filtertags action wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause, so a token ending in a backslash breaks quote parity under MySQL/MariaDB escaping and permits a five-column UNION subquery. Exploitation requires a MySQL-family backend and the ability to store filtertags markup - on default installations with open page editing no authentication or user interaction is required - and no public exploit code has been identified at time of analysis; the issue carries a CVSS 8.8 score and is a genuine high-priority flaw, not an inflated rating.
Use-after-free in SVG rendering in Google Chrome versions prior to 154.0.8037.97 allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by convincing a victim to load a crafted HTML page. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting unauthenticated remote reach with high confidentiality, integrity and availability impact, but it does require user interaction - the victim must navigate to or render attacker-controlled content, and no non-default configuration is needed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the practical severity is further bounded by the fact that code execution stays within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape bug. Vendor-released patch: Chrome 154.0.8037.97.
Heap-based buffer overflow in Google Chrome's WebRTC component allows a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to open a crafted HTML page; all Chrome builds prior to 154.0.8037.97 on desktop and mobile platforms are affected. Successful exploitation requires user interaction (the victim must navigate to or open the attacker-controlled page), but no authentication or prior privileges are needed, and WebRTC is enabled by default. Impact is high for confidentiality, integrity, and availability within the renderer process, though the attack scope is unchanged - breaking out to the host operating system would require chaining a separate sandbox-escape flaw. Exploitation signals are currently weak: EPSS is only 0.25% (15th percentile), CISA SSVC rates exploitation as 'none', and no public exploit code has been identified at time of analysis; a vendor patch is available.
Opening a crafted untrusted document in Apache OpenOffice 4.1.16 and earlier can execute arbitrary code at the opening user's privilege level, including code fetched from a remote location, because the document's Java integration fails to authorize the external links it resolves. Exploitation is unauthenticated but requires user interaction: Java runtime integration must be enabled (the default configuration) and the victim must actively open an attacker-supplied file, making social engineering the primary delivery vector. There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV and SSVC both report none), and EPSS is only 0.22% (12th percentile); a vendor fix is expected in Apache OpenOffice 4.1.17, which is still in the release-candidate phase, so the recommended interim mitigation is to disable Java runtime integration in the Preferences dialog or to avoid opening untrusted documents entirely.
Use-after-free in Google Chrome's MediaStream component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim renders a crafted HTML page, affecting all Chrome builds prior to 154.0.8037.97 on the stable channel. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but depends on user interaction: the target must load a malicious page that exercises the WebRTC/MediaStream path, and the resulting code execution is confined to the sandboxed renderer (S:U), so host-level compromise would require a separate sandbox-escape bug. At time of analysis there is no public exploit identified and no evidence of active exploitation (SSVC Exploitation: none, EPSS 0.21% / 11th percentile), while a vendor patch exists at Chrome 154.0.8037.97, making this a serious-but-not-emergency patching priority.
Incorrect access control in TransformerOptimus SuperAGI v0.0.14 lets an authenticated, low-privilege organization user in a multi-tenant deployment supply another organization's agent_id or agent_execution_id to the save_agent_as_template and publish_template endpoints, which perform no ownership check on the referenced agent or execution - enabling cross-organization disclosure of agent data and unauthorized template creation. Exploitation requires a valid authenticated account (PR:L) and a deployment where multiple organizations' agents coexist, so single-tenant installations are essentially unaffected; no public exploit identified at time of analysis, EPSS is 0.21% (10th percentile), and there is no CISA KEV listing. Our independent re-assessment scores this 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) rather than the submitted 8.8, reflecting confirmed confidentiality exposure with more limited integrity impact and no availability impact.
Workflow-supplied container options in Gitea act_runner (versions before 3.0.0) are merged straight into the Docker HostConfig of the job container, letting a workflow author request host PID/IPC namespaces, CapAdd=ALL and unconfined seccomp/apparmor and then escape to the runner host as root. The twist is that the flaw is exploitable precisely when runner privileged mode is disabled: that code path forces only Privileged=false while preserving namespace, capability, device and security-profile flags from workflow YAML, so the control administrators rely on does not contain the attack. Only the Docker job-container backend is affected, and exploitation requires the ability to submit or trigger a workflow on a repository served by that runner (authenticated, push or pull-request privileges per the PR:L vector), with impact changing scope to the underlying host; no public exploit identified at time of analysis, and EPSS is low at 0.20% (9th percentile), though real-world risk is severe for shared runners open to untrusted workflow authors.
Cross-site request forgery in the Webriti 'Wallstreet' WordPress theme affects all versions through 2.8.6, letting an attacker forge state-changing requests that are executed with the privileges of a logged-in site administrator. The independent assessment rates this at CVSS 3.1 4.3-class impact (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) rather than the vendor-published 8.8, because exploitation depends on tricking an already-authenticated admin into visiting attacker-controlled content or clicking a crafted link while their session is active - the UI:R requirement is the primary limiting factor. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory (reported by Patchstack) indicates versions above 2.8.6 are not affected, though the input does not name that fixed version.
Denial of service in Apache Thrift deployments that use the D language bindings before version 0.25.0, where malformed input reaching the service endpoint triggers an uncaught exception, an infinite loop with an unreachable exit condition, and an integer underflow that can crash or hang the service. The assessed impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.7), meaning unauthenticated remote attackers who can reach a D-bindings Thrift service need no credentials, user interaction, or non-default configuration to cause disruption. Exposure is narrow because only services compiled against the D bindings are affected - Java, Python, C++, Go and other language binding deployments are not - and no public exploit code has been identified at time of analysis.
Server-side request forgery in YesWiki before 4.6.7 allows unauthenticated remote attackers to force the server to issue arbitrary GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action, with fetched responses stored back as readable Bazar entries. The CVE carries a CVSS 4.0 base score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N, high confidentiality impact, low integrity and availability impact), matching our independent assessment of CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - no special privileges or user interaction are required, only network reachability to an instance running a vulnerable version that exposes the sync action. Impact is highest where the YesWiki host sits adjacent to internal services or a cloud metadata endpoint, and no public exploit code has been identified at time of analysis; the issue is not listed as confirmed actively exploited (CISA KEV).
SQL injection in YesWiki before 4.6.7 allows an attacker with page-write access - which the supplied CVSS 4.0 vector (PR:N) rates as unauthenticated on default installations - to inject a UNION subquery through the Bazar nuagetag action's tags attribute, exfiltrating password hashes and arbitrary database table contents. The flaw carries a CVSS 4.0 score of 8.8, and an independent assessment confirms high confidentiality impact with low integrity and availability impact. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but the vendor has released a patch (4.6.7) and public advisories are available.
Denial of service in the Apache Thrift Node.js bindings (all versions before 0.25.0) lets remote, unauthenticated attackers crash the hosting Node.js process by delivering a crafted Thrift message that triggers an uncaught exception during deserialization. The vendor-supplied CVSS 4.0 score of 8.7 is driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N), and our independent assessment maps this to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - no authentication, user interaction, or non-default configuration is required, so any deployment that parses untrusted Thrift input over the network is exposed. The practical risk is bounded by reachability: services that only accept trusted internal Thrift traffic are far less exposed. No public exploit code or confirmed active exploitation was identified at time of analysis. The description also cites improper validation of input quantities and prototype pollution, but the assessed impact per the vendor metrics remains availability-only.
Remote denial of service against Apache Thrift C++ deployments that use the THeaderProtocol is achievable by sending a crafted frame header to a network-reachable Thrift endpoint, causing a stack-based buffer overflow that crashes the service; the flaw combines CWE-121 with an incorrect bitwise shift of an integer in the same header-parsing code path. Every Apache Thrift release before 0.25.0 ships the vulnerable C++ implementation, although only services that actually use the THeaderProtocol transport are exposed - services built against other Thrift protocols or transports are not affected by this specific code path. The CVSS 4.0 base score is 8.7 on a fully unauthenticated, network-reachable vector with availability-only impact (VC:N/VI:N/VA:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Denial of service in the Go language bindings of Apache Thrift affects all versions before 0.25.0, where resources are allocated without limits or throttling, allowing a remote unauthenticated client to exhaust server memory or other resources and take down the service. Per the assessed vector (AV:N/AC:L/PR:N/UI:N, availability-only impact), any Thrift Go server endpoint reachable over the network is exposed, with no confidentiality or integrity consequence; the practical exposure is narrowed by network reachability and by whether the deployment accepts Thrift traffic from untrusted clients. CISA KEV does not list this issue and no public exploit code was identified at time of analysis, so exploitation appears to require only a crafted or excessive-volume Thrift message rather than a published attack tool.
Remote, unauthenticated attackers can crash applications built against Apache Thrift's c_glib (C/GLib) language bindings before version 0.25.0 by supplying crafted Thrift protocol input that triggers access of an uninitialized pointer (CWE-824), degrading availability with no confidentiality or integrity impact. The flaw carries a CVSS 4.0 score of 8.7 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and only deployments that use the c_glib binding and expose a Thrift endpoint to an attacker-reachable network are affected - services using Java, Python, Go or other bindings are not exposed to this particular defect. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV); a vendor-released patch, version 0.25.0, is available.
Denial of service in Apache Thrift's c_glib (C/GLib) language bindings before 0.25.0, where a crafted or malformed message reaching the deserialization/parsing path triggers a NULL pointer dereference and uninitialized-variable use that crashes the process. The issue is remotely reachable and unauthenticated (CVSS:4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with availability-high impact only), so any network-exposed Thrift service built on the c_glib binding is at risk of abrupt termination; confidentiality and integrity are unaffected. Only the c_glib binding is implicated - other Thrift bindings are not affected - and no public exploit code has been identified at time of analysis, with the vendor shipping a fix in 0.25.0.
Denial of service in Apache Thrift's Go bindings (all versions before 0.25.0) allows an unauthenticated remote peer to crash an entire Thrift-serving process by sending a single crafted frame over the TFramedTransport or THeaderTransport. A frame that yields no payload bytes causes the transport to recurse into Read rather than loop, so a peer can drive unbounded recursion with only 4 bytes (declared frame size of zero) or 18 bytes (a header block that fills the frame) until the Go stack limit is hit; the resulting runtime fatal error is not catchable by recover() and kills the process. The impact is availability-only - no confidentiality or integrity effect - and no public exploit code has been identified at time of analysis, though exploitation needs only network reachability to the Thrift listener with no authentication or user interaction (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/.../VA:H).
Memory exhaustion in Apache Thrift's Node.js and D language WebSocket server transports (all versions before 0.25.0) lets unauthenticated remote attackers commit 513 MiB on a Node.js server, or up to 2 GiB on the D transport, by sending a single ~14-byte frame that merely declares a huge payload length. The transport reads the length out of the WebSocket frame header and allocates that many bytes immediately, before the payload has actually arrived, so an extremely small request causes disproportionate memory growth; in the Node.js case the connection is left open afterwards, allowing the same frame to be resent repeatedly until the service is exhausted or killed. Impact is limited to availability (CVSS 4.0 8.7, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no authentication or user interaction is required, and no public exploit code was identified at time of analysis. Affected deployments are those exposing the Thrift WebSocket server transport from the Node.js or D bindings; other Thrift transports and language bindings are out of scope.
Uncaught exception handling in the Apache Thrift Ruby bindings lets unauthenticated remote attackers crash network-reachable Thrift RPC services running any version before 0.25.0. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or special configuration are required: any reachable Thrift Ruby service that parses attacker-supplied protocol messages can be knocked offline, though impact is limited to availability with no confidentiality or integrity loss. The flaw carries a CVSS 4.0 score of 8.7 (High) and an assessed CVSS 3.1 of 7.5, and no public exploit identified at time of analysis; exposure is confined to deployments using the Ruby language bindings rather than Thrift bindings for other languages.
Inefficient algorithmic complexity (CWE-407) in Apache Thrift's Lua bindings prior to version 0.25.0 allows remote, unauthenticated attackers to exhaust CPU and cause denial of service by supplying crafted input that the Lua binding parses. Only deployments that specifically use the Thrift Lua language binding and expose it to attacker-influenced data are affected; applications using other Thrift language bindings (Java, Python, C++, Go, etc.) are not impacted. The impact is limited to availability - no confidentiality or integrity loss is indicated by the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 8.7), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers can crash applications that use the Apache Thrift PHP bindings prior to version 0.25.0 by supplying crafted Thrift protocol messages that trigger a NULL pointer dereference (CWE-476). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the flaw is remotely reachable with low complexity and requires no authentication or user interaction, but the impact profile is availability-only (VC:N/VI:N/VA:H) - there is no confidentiality or integrity exposure, so the 8.7 score reflects a pure denial-of-service outcome rather than code execution. Exploitation is conditional on the target PHP service actually accepting and deserializing attacker-controlled Thrift input, and no public exploit code has been identified at time of analysis. A vendor patch is available in Apache Thrift 0.25.0, which per the advisory fixes the issue.
Memory exhaustion in Apache Thrift before 0.25.0 lets unauthenticated remote attackers crash services that deserialize attacker-controlled Thrift messages, and the flaw is present across the Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D language bindings. The supplied CVSS 4.0 vector (8.7 High) and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree that impact is availability-only: no confidentiality or integrity loss, and no authentication, user interaction, or special configuration is required beyond a reachable endpoint that accepts untrusted Thrift input. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor-released fix is version 0.25.0.
Denial of service in Apache Thrift Node.js bindings before 0.25.0 allows unauthenticated remote attackers who can reach a Thrift listener to send a crafted or malformed message that triggers an uncaught exception and terminates the Node.js process. The vendor CVSS 4.0 score is 8.7 and the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is availability-only with no confidentiality or integrity loss. Only the Node.js language bindings are affected; no public exploit identified at time of analysis.
Resource-exhaustion denial of service in Apache Thrift's Java TSaslNonblockingServer component allows remote attackers to drive the service into an unresponsive state by consuming server resources without limit (CWE-770). All Apache Thrift releases before 0.25.0 are affected, and the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms the attack is network-reachable and requires no credentials or user interaction once an exposed TSaslNonblockingServer endpoint is reachable; impact is confined to availability, with no confidentiality or integrity loss. Exploitation is only possible against deployments that specifically use the Java non-blocking SASL server class, which limits real-world exposure since blocking servers and non-SASL configurations are unaffected; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a patch-now hygiene item rather than an emergency.
An uncaught exception (CWE-248) in Apache Thrift's PHP language bindings before 0.25.0 allows unauthenticated remote attackers to terminate PHP processes that accept arbitrary Thrift protocol input, producing a denial of service with no confidentiality or integrity impact. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) means no privileges or user interaction are required against a default deployment that exposes a vulnerable PHP-based Thrift endpoint to untrusted network traffic; the practical prerequisite is that the target actually uses the PHP bindings rather than another language binding. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation potential is bounded to service availability - this is a genuine but limited availability risk rather than a data-breach emergency.
Uncontrolled recursion in the Dart and Java ME bindings of Apache Thrift before 0.25.0 lets a remote, unauthenticated attacker crash or hang a service by sending a Thrift message containing deeply nested or self-referential structures that exhaust the parser's stack. Impact is availability-only (no confidentiality or integrity effect per the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and the vulnerable surface is confined to deployments that deserialize untrusted data using the Dart or Java ME bindings, so most Thrift users on Java SE, C++, Python, or Go are not exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 4.0 base score of 8.7 should be read alongside the narrow binding-specific exposure, which makes real-world priority moderate rather than critical.
Denial of service in Apache Thrift before 0.25.0 allows unauthenticated remote attackers to crash or exhaust services running affected language bindings by sending malformed Thrift protocol data. The flaw combines improper length-parameter handling with excessive memory allocation, inefficient algorithmic complexity, uncaught exceptions, and insecure default initialization across the Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP, and D bindings. It is availability-only: no code execution, data disclosure, or data tampering is known from this issue. No public exploit code or confirmed active exploitation was identified at time of analysis; upgrading to 0.25.0 resolves it.
Denial of service in the Apache Thrift PHP bindings before version 0.25.0 lets remote, unauthenticated attackers exhaust CPU and memory on a Thrift-serving PHP application by sending a crafted Thrift message whose declared quantity is never validated. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor CVSS 4.0 base 8.7), the weakness is availability-only: there is no code execution, data exposure, or integrity impact, and only deployments that use the PHP bindings to parse untrusted Thrift input over the network are exposed. No public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis, and no EPSS score was supplied; non-PHP Thrift bindings are out of scope for this issue.
Memory exhaustion in Apache Thrift's THeaderTransport affects all versions before 0.25.0, allowing remote attackers to cause a denial of service. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is unauthenticated and requires no user interaction: an attacker can send crafted messages to a Thrift endpoint that uses THeaderTransport, triggering unreleased memory allocations that accumulate and eventually exhaust server resources. The flaw is rated CVSS 8.7 (4.0) with availability-only impact (VC:N/VI:N/VA:H); no public exploit code has been identified at the time of analysis.
Denial of service in Apache Thrift's Dart bindings (all versions before 0.25.0) lets an unauthenticated remote attacker crash or hang a service by sending a Thrift message whose length or size field declares an excessive allocation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, score 8.7) confirms the flaw is remotely reachable without authentication or user interaction, but impact is confined to availability - confidentiality and integrity are explicitly rated N, with no data exposure or code execution described in any source. Only deployments that deserialize attacker-supplied Thrift traffic through the Dart bindings are affected, and no public exploit identified at time of analysis.
Denial of service in Apache Thrift's Lua language bindings (all versions before 0.25.0) allows unauthenticated remote attackers to drive unbounded resource allocation by sending protocol messages whose declared length parameter is inconsistent with the actual data, abusing a missing allocation limit (CWE-770). Per the vendor vector (PR:N/UI:N) no credentials or user interaction are required; impact is confined to availability (AV:N/AC:L/PR:N/UI:N with A:H, and no confidentiality or integrity effect), meaning memory or CPU exhaustion and likely process termination rather than data exposure or modification. Only deployments that expose a Thrift service implemented with the Lua bindings are in scope, so services built on Thrift's C++, Java, Python, Go and other bindings are not affected by this specific issue; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, and no EPSS score was supplied for this analysis.
Memory exhaustion in Bouncy Castle C# (bc-csharp) before 2.7.0 allows a remote, unauthenticated attacker to cause a denial of service against applications that verify HSS/LMS (RFC 8554) signatures using an attacker-supplied public key, because the HSS level count L is parsed without being bounded and then drives a huge array allocation during signature parsing - a single verification can commit roughly 17 GB of memory or terminate with an OutOfMemoryException. Impact is availability-only (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): no confidentiality or integrity loss, and no authentication or user interaction is required. Exposure is bounded by the fact that HSS/LMS is a niche post-quantum feature, so only deployments that parse untrusted HSS keys and then verify signatures are affected; no public exploit identified at time of analysis, and no evidence of confirmed active exploitation (no CISA KEV listing).
Memory-exhaustion denial of service in the C# DTLS implementation of Bouncy Castle (bc-csharp) before 2.7.0 lets a remote, unauthenticated DTLS peer crash or stall a process by driving unbounded handshake-fragment reassembly buffers. A crafted fragment header can declare a message length of nearly 16 MB; because the reassembler is sized from that attacker-controlled 24-bit length before any check against the negotiated maximum handshake message size, a payload-free fragment forces an allocation of roughly 16 MB, and up to 16 pending messages per handshake multiply this toward hundreds of MB per unauthenticated connection, all before the handshake is authenticated. DTLS servers and DTLS clients built on bc-csharp are both affected, while pure TLS usage is explicitly not; no public exploit code has been identified at time of analysis, and the issue is rated CVSS 4.0 8.7 / CVSS 3.1 8.7 (AV:N/AC:L/PR:N/UI:N, availability-only impact).
Denial of service and limited integrity tampering in Apache Thrift before 0.25.0 stem from a combination of an infinite loop (CWE-835) and prototype pollution in the Node.js bindings when the TJSONProtocol deserializer parses crafted JSON. Any application exposing a Thrift service built on the Node.js library with TJSONProtocol enabled on an untrusted, attacker-reachable input path can be driven into an unreachable-exit loop that hangs the process, with secondary risk of object prototype attribute manipulation altering application state; the vulnerability is reachable unauthenticated and without user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability High, integrity Low) and the vendor rates it 8.7. No public exploit code has been identified at time of analysis and the issue is not recorded as actively exploited, though the affected product family and the low attack complexity make it a realistic target for opportunistic scanning. Risk is bounded by deployment: services using TBinaryProtocol, TCompactProtocol or non-Node.js Thrift bindings are not affected by this vector.
Authenticated SQL injection in UTMStack before 11.2.16 lets any valid low-privilege logged-in user execute arbitrary SQL against the backend PostgreSQL database via the assetType and groupName parameters of GET /api/utm-asset-groups/searchGroupsByFilter. Because the database connection runs with DBA (PostgreSQL superuser-class) privileges, successful exploitation extends from full read and modification of stored data to potential filesystem access on the host. The vendor has released a fix in v11.2.16; no public exploit code has been identified at time of analysis, and the main practical constraint is that an authenticated session is required. Reported by VulnCheck, and tracked as CWE-89.
Heap-exhaustion denial of service in the MLS implementation of Bouncy Castle for Java (bc-java) before 1.86, triggered by a single small PrivateMessage whose SenderData carries a wire-encoded uint32 leaf_index with its top bit set. Because that value is held in a signed int, it decodes as negative and passes the signed bounds checks in GroupKeySet.SecretTree.hasLeaf and Group.validateRemove, letting a sender outside the tree reach LeafIndex.directPath()/NodeIndex.parent() arithmetic that never terminates at the tree root and grows a node list until the JVM runs out of heap. Impact is confined to availability (CVSS 4.0 8.7 with VA:H and no confidentiality or integrity effect); group membership is a practical prerequisite since the triggering MLS message or Remove proposal must originate from a current group participant, and applications that do not use org.bouncycastle.mls are unaffected. No public exploit code identified at time of analysis and the issue is not in CISA KEV; the vendor has released a fix in Bouncy Castle 1.86.
Denial of service in Legion of the Bouncy Castle's C# cryptography library (bc-csharp) before 2.7.0 lets an unauthenticated remote attacker exhaust server CPU by sending a CMP message or CRMF certificate request whose PBMParameter declares an iteration count as large as roughly 2^31; the library then performs that many hash iterations before it can even check the password-based MAC. Only deployments that accept untrusted inbound CMP/CRMF traffic and process it through ProtectedPkiMessage.Verify or CertificateRequestMessage.IsValidSigningKeyPop using a PKMacBuilder constructed without an explicit iteration ceiling are exposed - applications that already pass an explicit maximum are not affected, and general bc-csharp use (TLS, signing, hashing) never reaches the vulnerable path. Impact is availability-only (CVSS 4.0 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no public exploit identified at time of analysis, and a vendor-released fix exists in bc-csharp 2.7.0.
Uncontrolled recursion in Bouncy Castle C# (bc-csharp) before 2.7.0 allows unauthenticated remote attackers to crash or stall applications that parse attacker-supplied ASN.1 by submitting deeply nested constructed elements. About 2,000 nesting levels (roughly 8 KB of DER) exhaust the default ~1.5 MB .NET thread stack and raise a StackOverflowException that cannot be caught and terminates the process, while on threads with larger stacks the same input causes quadratic parse-time growth (about 9 seconds of CPU for 64 KB). Any code path that parses untrusted X.509 certificates or CRLs, CMS/PKCS#7, PKCS#8/PKCS#12, OCSP, or TLS Certificate messages is affected; no public exploit code has been identified at time of analysis, and the vendor has released a fix in version 2.7.0.