CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism.
Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Uncaught exception, improper handling of exceptional conditions, and improper resource shutdown in Apache Thrift D TNonblockingServer. Affects versions before 0.25.0.
NULL pointer dereference vulnerability in Apache Thrift PHP bindings. Affects versions before 0.25.0.
Uncaught exception, infinite loop, and integer underflow in Apache Thrift D language bindings. Affects versions before 0.25.0.
Infinite loop and prototype pollution vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. Affects versions before 0.25.0.
Integer underflow and out-of-bounds write in Apache Thrift C++ 32-bit THeaderTransport. Affects versions before 0.25.0.
Memory allocation with excessive size and resource allocation without limits in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D language bindings. Affects versions before 0.25.0.
Allocation of resources without limits or throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. Affects versions before 0.25.0.
SQL injection vulnerability in the get function of edit_accounts.php in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Manipulation of user_id/patient_id/physician_id/discounts_id/services_id arguments allows remote attack. Exploit is publicly available.
Missing authorization in the attachment download handler in YesWiki before 4.6.7 allows unauthenticated attackers to bypass page read ACLs. They can retrieve confidential attachments from read-restricted pages by knowing the page tag and file parameter.
Unrestricted file upload in YesWiki before 4.6.7 allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. They can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS