CVE-2026-66858: Uncontrolled Recursion

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

PT-2026-104091

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire si...

PT-2026-104324

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description The protocol skip routine in several Apache Thrift bindings fails to apply the recursion limit. This allows a message containing deeply nested unknown fields to exhaust the stack, potentially...

CVE-2026-91828: Uncontrolled Resource Consumption

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire si...

CVE-2026-91137: Improper Validation of Specified Quantity in Input

Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-104614: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /SimplePharmacy-PHP/product/delete.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit is public...

CVE-2026-87117: NULL Pointer Dereference

NULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-96289: Uncontrolled Recursion

Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94644: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94653: Inefficient Algorithmic Complexity

Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104075

Name of the Vulnerable Software and Affected Versions CTX Feed Pro versions prior to 7.6.13 Description Insufficient input validation on the 'Feed Config' field allows authenticated attackers with Administrator-level access and above to execute arbitrary PHP code on the server. This occurs becaus...

PT-2026-104356

A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The impacted element is an unknown function of the file php/sessions.php. The manipulation of the argument ID leads to improper authentication. Remote exploitatio...

Debian dsa-6539 : php-mongodb - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6539 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6539-1 [email protected] https://www.debian.org/securit...

SUSE SLES16 Security Update : php-composer2 (SUSE-SU-2026:23943-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23943-1 advisory. - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. Tenable has...

openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21970-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21970-1 advisory. - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. Tenable has extracted the...

PT-2026-104293

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description A NULL pointer dereference occurs within the Apache Thrift PHP bindings. A NULL pointer dereference is a condition where a program attempts to read or write to a memory address that is NULL,...

CVE-2026-71426

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is...

CVE-2026-53953

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

CVE-2026-71426

GetSimple CMS CE versions 3.3.22 and prior are vulnerable to a directory-traversal Local File Inclusion (LFI) . An authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute . When a visitor requests the affected page, this value is passed un...

CVE-2026-71426 GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is...