110011 matches found
EUVD-2026-91372
Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-91137
The Apache Thrift PHP bindings are vulnerable to Improper Validation of Specified Quantity in Input , Allocation of Resources Without Limits or Throttling , and Excessive Iteration vulnerabilities. This issue specifically affects versions before 0.25.0 . The root cause involves improper handling ...
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ayukiab in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.19...
CVE-2026-85005
The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as...
EUVD-2026-91211
The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as...
WordPress Popup Maker WP plugin 1.2.2.1-1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation vulnerability
Subscriber+ Zero-Argument PHP Callable Invocation vulnerability discovered by Artus KG in WordPress Plugin Popup Maker WP versions 1.2.2.1-1.4.5...
CVE-2026-85005 Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization
The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as...
CVE-2026-85005 Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization
The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as...
WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by nakko in WordPress Plugin The Events Calendar versions = 6.17.4...
CVE-2026-91828
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire si...
CVE-2026-91828
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin (versions before 6.3.11 ) is vulnerable to an unauthenticated Denial of Service (DoS) . The flaw exists because the plugin fails to require authentication or a valid nonce for an action that triggers a slow server-side l...
CVE-2026-91828 OMGF < 6.3.11 - Unauthenticated DoS via do_optimize
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire si...
CVE-2026-91828 OMGF < 6.3.11 - Unauthenticated DoS via do_optimize
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire si...
CVE-2026-92174 SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary...
CVE-2026-10026
The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval function. This makes it possible for authenticated attackers, with...
EUVD-2026-91171
The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval function. This makes it possible for authenticated attackers, with...
CVE-2026-10026 CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution
The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval function. This makes it possible for authenticated attackers, with...
CVE-2026-10026 CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution
The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval function. This makes it possible for authenticated attackers, with...
Juniper Devices - Remote Code Execution
Multiple cves in Juniper Network CVE-2023-36844|CVE-2023-36845|CVE-2023-36846|CVE-2023-36847.A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environments variables...
PT-2026-104356
A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The impacted element is an unknown function of the file php/sessions.php. The manipulation of the argument ID leads to improper authentication. Remote exploitatio...