Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

Type

Severity

Period

1,055 alerts · page 35 of 53

Critical (CVSS 9+) Published 2026-10-29 17:24

CVE-2026-62006 WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

CriticalCVSS 9.8 EPSS 0.42%

Exploit status: No public exploit known

Affects: ThemeREX Nuts, wordpress nuts

Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.
Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-10-30 21:18

CVE-2026-62004 WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

CriticalCVSS 9.8 EPSS 0.40%

Exploit status: No public exploit known

Affects: ThemeREX Motorix, wordpress motorix

Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.
Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-10-30 21:18

CVE-2026-62003 WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

CriticalCVSS 9.8 EPSS 0.40%

Exploit status: No public exploit known

Affects: wordpress mission, ThemeREX Mission

Unauthenticated PHP Object Injection in Mission <= 1.22 versions.
Critical (CVSS 9+) Published 2026-10-29 17:24

CVE-2026-62001 WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

CriticalCVSS 9.8 EPSS 0.48%

Exploit status: No public exploit known

Affects: ThemeREX Marcell, wordpress marcell

Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.
Critical (CVSS 9+) Published 2026-10-29 17:24

CVE-2026-62002 WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

CriticalCVSS 9.8 EPSS 0.51%

Exploit status: No public exploit known

Affects: ThemeREX Meals & Wheels, wordpress meals-wheels

Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.
Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-10-30 21:18

CVE-2026-61998 WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

CriticalCVSS 9.8 EPSS 0.48%

Exploit status: No public exploit known

Affects: ThemeREX Le Truffe, wordpress letruffe

Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-10-30 21:18

CVE-2026-61997 WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

CriticalCVSS 9.8 EPSS 0.51%

Exploit status: No public exploit known

Affects: ThemeREX Legal Stone, wordpress legal-stone

Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-11-03 22:06

CVE-2026-61992 WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

CriticalCVSS 9.8 EPSS 0.39%

Exploit status: No public exploit known

Affects: wordpress geo-my-wp, Von Eyal Fitoussi GEO my WordPress

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-11-05 00:01

CVE-2026-61991 WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability

CriticalCVSS 10.0 EPSS 0.75%

Exploit status: No public exploit known

Affects: Ajax Load More AjaxLoadMore Cache, wordpress ajax-load-more-cache

Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-11-03 22:03

CVE-2026-54860 WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

CriticalCVSS 9.8 EPSS 0.49%

Exploit status: No public exploit known

Affects: ThemeREX Ozisti, wordpress ozisti

Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-11-03 22:03

CVE-2026-54859 WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

CriticalCVSS 9.8 EPSS 0.53%

Exploit status: No public exploit known

Affects: ThemeREX Preservation, wordpress preservation

Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.
Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-11-03 22:03

CVE-2026-54858 WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

CriticalCVSS 9.8 EPSS 0.49%

Exploit status: No public exploit known

Affects: ThemeREX Printy, wordpress printy

Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-11-04 23:58

CVE-2026-54857 WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability

CriticalCVSS 9.8 EPSS 0.49%

Exploit status: No public exploit known

Affects: ThemeREX Quirky, wordpress quirky

Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-11-03 22:03

CVE-2026-54856 WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability

CriticalCVSS 9.8 EPSS 0.49%

Exploit status: No public exploit known

Affects: ThemeREX RexCoin, wordpress rexcoin

Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
Critical (CVSS 9+) Published 2026-10-29 17:19 · updated 2026-10-30 15:23

CVE-2026-18894 Langflow OSS is affected by multiple vulnerabilities

CriticalCVSS 9.8 EPSS 0.52%

Exploit status: No public exploit known

Affects: ibm langflow oss, langflow

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public exe...
Critical (CVSS 9+) Published 2026-10-29 17:18 · updated 2026-10-30 20:18

CVE-2026-93680 Langflow OSS is affected by multiple vulnerabilities

CriticalCVSS 9.8 EPSS 2.2% Framework module

Exploit status: Public exploit available

Affects: ibm langflow oss, langflow

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.
Critical (CVSS 9+) Published 2026-10-29 17:17 · updated 2026-10-30 20:17

CVE-2026-104317 Langflow OSS is affected by multiple vulnerabilities

CriticalCVSS 9.8 EPSS 0.59%

Exploit status: No public exploit known

Affects: ibm langflow oss, langflow

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.
Critical (CVSS 9+) Published 2026-10-29 17:16 · updated 2026-10-30 15:29

CVE-2026-104339 Langflow OSS is affected by multiple vulnerabilities

CriticalCVSS 9.8 EPSS 0.75%

Exploit status: No public exploit known

Affects: ibm langflow oss, langflow

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Critical (CVSS 9+) Published 2026-10-29 17:15 · updated 2026-10-30 20:17

CVE-2026-110186 Langflow OSS is affected by multiple vulnerabilities

CriticalCVSS 9.8 EPSS 0.62%

Exploit status: No public exploit known

Affects: ibm langflow oss, langflow

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
Critical (CVSS 9+) Published 2026-10-29 15:08 · updated 2026-11-04 03:17

CVE-2026-119050 Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection

CriticalCVSS 9.2 EPSS 0.43%

Exploit status: No public exploit known

Affects: pypi agno

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on att...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).