CVE-2026-66081

HighCVSS 8.7/10Last modified Oct 2, 2026

Description

Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-824

Affected software

No affected versions have been published.

Timeline

Published
Oct 2, 2026
Last modified
Oct 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-660826.5An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow sCVE-2026-660836.5The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoCVE-2026-660848.1An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are CVE-2026-660855.5In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local infCVE-2026-660869.8In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messageCVE-2026-660878.1An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are noCVE-2026-66096.3A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function form_valid of the file oauth/views.py. CVE-2026-660986.5The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot intoCVE-2026-66103.7A vulnerability has been found in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file djangoblog/CVE-2026-661098.5A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker whCVE-2026-66113.1A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of tCVE-2026-66126.3A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This impacts the function get_agent_execution/update_agent_execu
CVE-2026-66081: High severity, CVSS 8.7 | Vulnix