https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T01:49:58.220615+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-thrift-2026-43870 BIT-thrift-2026-43870 — Apache Thrift: Node.js web_server.js multi-vulnerability 2026-10-03T01:49:58.430735+00:00

Affected: Bitnami: thrift

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-308695 EUVD-2026-308695 2026-10-03T01:49:58.430854+00:00 EUVD-2026-308695 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43870 fkie_cve-2026-43870 2026-10-03T01:49:58.430884+00:00

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-526f-jxpj-jmg2 GHSA-526f-jxpj-jmg2 — Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource Consumption 2026-10-03T01:49:58.430929+00:00

Affected: npm: thrift

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version [0.23.0](https://github.com/apache/thrift/releases/tag/v0.23.0), which fixes the issue.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-43870 msrc_CVE-2026-43870 — Apache Thrift: Node.js web_server.js multi-vulnerability 2026-10-03T01:49:58.430970+00:00 msrc_CVE-2026-43870 https://cve.radiocsirt.org/vuln/rhsa-2026:36882 RHSA-2026:36882 — Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update 2026-10-03T01:49:58.431000+00:00

lodash: prototype pollution in _.unset and _.omit functions database/sql: Postgres Scan Race Condition Apache Thrift: c_glib: Apache Thrift c_glib: Denial of Service via specially crafted requests golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects angular: Angular: Cross-site scripting vulnerability in Template Compiler axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/russellhaering/goxmldsig: goxmlsig: Integrity bypass due to incorrect XML Digital Signature validation via loop variable capture issue axios: Axios: Remote Code Execution via Prototype Pollution escalation OpenFGA: github.com/openfga/openfga: OpenFGA: Information disclosure of preshared API…

 https://cve.radiocsirt.org/vuln/rhsa-2026:53415 RHSA-2026:53415 — Red Hat Security Advisory: opentelemetry-collector security update 2026-10-03T01:49:58.431163+00:00

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-43870 UBUNTU-CVE-2026-43870 2026-10-03T01:49:58.431253+00:00

Affected: Ubuntu:20.04:LTS: thrift, Ubuntu:22.04:LTS: thrift, Ubuntu:24.04:LTS: thrift, Ubuntu:25.10: thrift, Ubuntu:26.04:LTS: thrift

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2076 WID-SEC-W-2026-2076 — IBM App Connect Enterprise (Apache Thrift): Mehrere Schwachstellen 2026-10-03T01:49:58.431318+00:00

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen, und um nicht näher spezifizierte Auswirkungen zu verursachen.