PT-2026-104091

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire si...

CVE-2026-104637: Unrestricted Upload of File with Dangerous Type

A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the function addpatient/addphysician/addaccount/updateaccount/updatesubaccount/editphysician/editpatient of the file php/controller.php. Executing a...

CVE-2026-66837: Stack-based Buffer Overflow

Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66858: Uncontrolled Recursion

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

CVE-2026-94638: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85494: Improper Handling of Length Parameter Inconsistency

Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D...

CVE-2026-91137: Improper Validation of Specified Quantity in Input

Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94642: Uncaught Exception

Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94644: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94653: Inefficient Algorithmic Complexity

Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-96289: Uncontrolled Recursion

Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104075

Name of the Vulnerable Software and Affected Versions CTX Feed Pro versions prior to 7.6.13 Description Insufficient input validation on the 'Feed Config' field allows authenticated attackers with Administrator-level access and above to execute arbitrary PHP code on the server. This occurs becaus...

PT-2026-104307

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Inefficient Algorithmic Complexity in Apache Thrift PHP bindings. Recommendations Upgrade to version 0.25.0...

PT-2026-104211

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An uncaught exception issue exists within the Apache Thrift PHP bindings. Recommendations Upgrade to version 0.25.0...

PT-2026-104204

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift PHP bindings contain an issue involving improper validation of specified quantities in input, allocation of resources without limits or throttling, and excessive iteration. This...

PT-2026-104316

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Uncontrolled recursion occurs within the PHP bindings of Apache Thrift. Uncontrolled recursion is a condition where a function calls itself without a proper termination condition, potentially...

PT-2026-104212

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift PHP bindings contain an issue where resources are allocated without limits or throttling, which can lead to resource exhaustion. Recommendations Update to version 0.25.0...

PT-2026-104293

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description A NULL pointer dereference occurs within the Apache Thrift PHP bindings. A NULL pointer dereference is a condition where a program attempts to read or write to a memory address that is NULL,...

PT-2026-104298

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift PHP bindings contain an issue where resources are allocated without limits or throttling, which can lead to resource exhaustion. Recommendations Update to version 0.25.0...

PT-2026-104110

Name of the Vulnerable Software and Affected Versions Popup Maker WP WordPress plugin versions prior to 1.4.6 Description The plugin fails to perform authorization checks on several actions and exposes its management page to any logged-in user. This allows users with low-privileged roles, such as...