CWE-393 (CWE-393) — 5 disclosed vulnerabilities

Records the NVD classes under CWE-393, highest CVSS first.

CRITICAL 9.9CVE-2026-97381public PoC2026-10-13
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hos…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.8CVE-2026-928212026-10-06
A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access …
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-928342026-10-02
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-850872026-10-02
Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-854832026-10-02
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
AI risk analysis on Exploit-DB.ai →