CVE-2026-94644

The Apache Thrift PHP bindings are vulnerable to an allocation of resources without limits or throttling (CWE-770). Specifically, the TJSONProtocol string and number readers lack size bounds, which can lead to resource exhaustion. This issue impacts Apache Thrift versions prior to 0.25.0 . To rem...

CVE-2026-94644 Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94644 Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91407

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85494 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)

Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D...

CVE-2026-85494

Apache Thrift versions before 0.25.0 are vulnerable to a flaw where the framed transport and binary protocol read buffers from a peer-declared length without a limit. This improper handling of length parameters, combined with flawed input processing and resource allocation, can trigger uncaught e...

CVE-2026-91137 Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements

Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-91137

The Apache Thrift PHP bindings are vulnerable to Improper Validation of Specified Quantity in Input , Allocation of Resources Without Limits or Throttling , and Excessive Iteration vulnerabilities. This issue specifically affects versions before 0.25.0 . The root cause involves improper handling ...

CVE-2026-91137 Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements

Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91372

Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ayukiab in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.19...

CVE-2026-85005

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as...

CVE-2026-85005 Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as...

CVE-2026-85005 Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as...

WordPress Popup Maker WP plugin 1.2.2.1-1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation vulnerability

Subscriber+ Zero-Argument PHP Callable Invocation vulnerability discovered by Artus KG in WordPress Plugin Popup Maker WP versions 1.2.2.1-1.4.5...

EUVD-2026-91211

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as...

WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by nakko in WordPress Plugin The Events Calendar versions = 6.17.4...

CVE-2026-91828

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire si...

CVE-2026-91828 OMGF < 6.3.11 - Unauthenticated DoS via do_optimize

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire si...

CVE-2026-91828 OMGF < 6.3.11 - Unauthenticated DoS via do_optimize

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire si...