[Git][security-tracker-team/security-tracker][master] Add another batch of thirft issues (need assessment for built bindings)
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 2 21:19:36 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
fc579642 by Salvatore Bonaccorso at 2026-10-02T22:18:02+02:00
Add another batch of thirft issues (need assessment for built bindings)
Just adding the first batch of new thift issues, but this need
sassessment which of the bindings are built and which are not provided
in a binary package.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -146,9 +146,11 @@ CVE-2026-94405 (Authorization Bypass Through User-Controlled Key vulnerability i
CVE-2026-94180 (Authorization Bypass Through User-Controlled Key vulnerability in Mone ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-93926 (Missing release of memory after effective lifetime, Missing release of ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/9353rb8mpoq4ltff88h1j2y3hfy6blgb
CVE-2026-93925 (Stack-based buffer overflow, Incorrect bitwise shift of integer vulner ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/b4rrkrwoyqb9g7hk58d3fx09cbvp1tg9
CVE-2026-93880 (The Greenshift \u2013 animation and page builder blocks plugin for Wor ...)
NOT-FOR-US: WordPress plugin
CVE-2026-93875 (The JetAppointment plugin for WordPress is vulnerable to Stored Cross- ...)
@@ -156,61 +158,81 @@ CVE-2026-93875 (The JetAppointment plugin for WordPress is vulnerable to Stored
CVE-2026-93756 (The Smash Balloon Social Post Feed \u2013 Simple Social Feeds for Word ...)
NOT-FOR-US: WordPress plugin
CVE-2026-92834 (Use of uninitialized resource, Return of wrong status code vulnerabili ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/bjor9ttx7hk23gzcx60ohz0f20xzvgv0
CVE-2026-91784 (cjbassi/gotop is vulnerable to local argument injection via process te ...)
TODO: check
CVE-2026-91137 (Improper validation of specified quantity in input, Allocation of reso ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/bf12g1b11r4x9x3wsy4mgwfgd0t779h7
CVE-2026-91135 (Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderT ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/rbpwlhlxnv2qgyk8cfscp2d2fd3p0ojb
CVE-2026-90970 (GitLab has remediated a vulnerability in the GitLab AI Gateway compone ...)
NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-90440 (Uncaught exception, improper handling of exceptional conditions, impro ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/s8fjltl6c1pkm7vg9v4qkr89b5b74jbg
CVE-2026-87920 (The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross- ...)
NOT-FOR-US: WordPress plugin
CVE-2026-87117 (NULL pointer dereference vulnerability in Apache Thrift PHP bindings. ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/y05tvpv19ow44j16gtbcy9ht7lb0qjpy
CVE-2026-86537 (Uncaught exception, Loop with unreachable exit condition ('infinite lo ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/k14jfr1xwc0vtmm2s7xro6lt7q4y6s7m
CVE-2026-86536 (Improperly controlled modification of object prototype attributes ('pr ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/xckvfky30kdnk8vqnhy0wndthvc9nymp
CVE-2026-86535 (Loop with unreachable exit condition ('infinite loop'), Improperly con ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/94cvvzzl0rh707bn2j4zt844v547508g
CVE-2026-86326 (An improper verification of cryptographic signature vulnerability exis ...)
NOT-FOR-US: Moxa
CVE-2026-86325 (A stack-based buffer overflow vulnerability exists in protocol gateway ...)
NOT-FOR-US: Moxa
CVE-2026-85494 (Improper handling of length parameter inconsistency, Uncaught exceptio ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/rm0m34gt6fh1flvt16wty559hfg191qr
CVE-2026-85493 (Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/oqr0h2k1cg9hho3oh8trmovmxc04fl5m
CVE-2026-85492 (The All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffi ...)
NOT-FOR-US: WordPress plugin
CVE-2026-85483 (Use of uninitialized resource, Return of wrong status code vulnerabili ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/ro1y0ckzfzcc45yk9qkt1p6t4g2jvrfy
CVE-2026-85476 (Loop with unreachable exit condition ('infinite loop') vulnerability i ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/1zdvscq7p3hf3z30s26h4tm9dvljm1jj
CVE-2026-85215 (Improper neutralization of special elements used in an SQL command ('S ...)
TODO: check
CVE-2026-85209 (Missing Authorization vulnerability in AVEZ Electronics Communication ...)
TODO: check
CVE-2026-85088 (Improper Validation of Certificate with Host Mismatch in the C++ and D ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/zcgm7lx6037lvgvn87rc1tj3p0zhv371
CVE-2026-85087 (Improper certificate validation, Return of wrong status code vulnerabi ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/l2rgp3dqhpy2w347forzdt9g7o2d6k0d
CVE-2026-85086 (Improper certificate validation, Initialization of a resource with an ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/c7f9g4027ok0gocyso2y84r2mhgc2xmy
CVE-2026-83745 (Memory allocation with excessive size value, Improper handling of leng ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/64y7f0b89mnq4xoqcn4h26to8kskolgc
CVE-2026-83663 (Uncontrolled Recursion vulnerability in Apache Thrift go bindings. ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/yjz317wq7h86q9k8ws6ton0ojgl8hjct
CVE-2026-83632 (Allocation of resources without limits or throttling, Integer overflow ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/zjv6hjmhl4tb4l4l1dk4bmc2whxh0lb4
CVE-2026-82459 (Integer underflow (wrap or wraparound), Out-of-bounds write vulnerabil ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/zf8ppfpl6nqhp53sxnz6osnjw93g9fw2
CVE-2026-82458 (Memory allocation with excessive size value, Allocation of resources w ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/7xqf651pvjykw0xr9vw0ooz0bwx7wzy7
CVE-2026-80464 (Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef ...)
TODO: check
CVE-2026-80443 (Improper certificate validation vulnerability in HAVELSAN Inc. Sef - A ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fc579642e32fdce6211e30b7b6f166d3cd0fd066
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fc579642e32fdce6211e30b7b6f166d3cd0fd066
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/9bd260d6/attachment.htm>
More information about the debian-security-tracker-commits
mailing list