Security alerts

1,054 alerts · page 39 of 53

1. Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-10-30 21:18

   CVE-2026-62010 WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

   Critical·CVSS 9.8 EPSS 0.40%

   Exploit status: No public exploit known

   Affects: wordpress avventure, ThemeREX Avventure

   Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

2. Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-10-30 21:18

   CVE-2026-62009 WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

   Critical·CVSS 9.8 EPSS 0.43%

   Exploit status: No public exploit known

   Affects: ThemeREX Filmax, wordpress filmax

   Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

3. Critical (CVSS 9+) Published 2026-10-29 17:24

   CVE-2026-62008 WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

   Critical·CVSS 9.8 EPSS 0.42%

   Exploit status: No public exploit known

   Affects: wordpress orpheus, ThemeREX Orpheus

   Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

4. Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-10-30 21:18

   CVE-2026-62005 WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

   Critical·CVSS 9.8 EPSS 0.40%

   Exploit status: No public exploit known

   Affects: ThemeREX Muzicon, wordpress muzicon

   Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

5. Critical (CVSS 9+) Published 2026-10-29 17:24

   CVE-2026-62006 WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

   Critical·CVSS 9.8 EPSS 0.42%

   Exploit status: No public exploit known

   Affects: ThemeREX Nuts, wordpress nuts

   Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

6. Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-10-30 21:18

   CVE-2026-62004 WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

   Critical·CVSS 9.8 EPSS 0.40%

   Exploit status: No public exploit known

   Affects: ThemeREX Motorix, wordpress motorix

   Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

7. Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-10-30 21:18

   CVE-2026-62003 WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

   Critical·CVSS 9.8 EPSS 0.40%

   Exploit status: No public exploit known

   Affects: wordpress mission, ThemeREX Mission

   Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

8. Critical (CVSS 9+) Published 2026-10-29 17:24

   CVE-2026-62001 WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

   Critical·CVSS 9.8 EPSS 0.48%

   Exploit status: No public exploit known

   Affects: ThemeREX Marcell, wordpress marcell

   Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

9. Critical (CVSS 9+) Published 2026-10-29 17:24

   CVE-2026-62002 WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

   Critical·CVSS 9.8 EPSS 0.51%

   Exploit status: No public exploit known

   Affects: ThemeREX Meals & Wheels, wordpress meals-wheels

   Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

10. Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-10-30 21:18

    CVE-2026-61998 WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

    Critical·CVSS 9.8 EPSS 0.48%

    Exploit status: No public exploit known

    Affects: ThemeREX Le Truffe, wordpress letruffe

    Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

11. Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-10-30 21:18

    CVE-2026-61997 WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

    Critical·CVSS 9.8 EPSS 0.51%

    Exploit status: No public exploit known

    Affects: ThemeREX Legal Stone, wordpress legal-stone

    Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

12. Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-11-03 22:06

    CVE-2026-61992 WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

    Critical·CVSS 9.8 EPSS 0.39%

    Exploit status: No public exploit known

    Affects: wordpress geo-my-wp, Von Eyal Fitoussi GEO my WordPress

    Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

13. Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-11-05 00:01

    CVE-2026-61991 WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability

    Critical·CVSS 10.0 EPSS 0.75%

    Exploit status: No public exploit known

    Affects: Ajax Load More AjaxLoadMore Cache, wordpress ajax-load-more-cache

    Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

14. Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-11-03 22:03

    CVE-2026-54860 WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

    Critical·CVSS 9.8 EPSS 0.49%

    Exploit status: No public exploit known

    Affects: ThemeREX Ozisti, wordpress ozisti

    Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

15. Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-11-03 22:03

    CVE-2026-54859 WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

    Critical·CVSS 9.8 EPSS 0.53%

    Exploit status: No public exploit known

    Affects: ThemeREX Preservation, wordpress preservation

    Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

16. Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-11-03 22:03

    CVE-2026-54858 WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

    Critical·CVSS 9.8 EPSS 0.49%

    Exploit status: No public exploit known

    Affects: ThemeREX Printy, wordpress printy

    Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

17. Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-11-04 23:58

    CVE-2026-54857 WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability

    Critical·CVSS 9.8 EPSS 0.49%

    Exploit status: No public exploit known

    Affects: ThemeREX Quirky, wordpress quirky

    Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

18. Critical (CVSS 9+) Published 2026-10-29 17:24 · updated 2026-11-03 22:03

    CVE-2026-54856 WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability

    Critical·CVSS 9.8 EPSS 0.49%

    Exploit status: No public exploit known

    Affects: ThemeREX RexCoin, wordpress rexcoin

    Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

19. Critical (CVSS 9+) Published 2026-10-29 17:19 · updated 2026-10-30 15:23

    CVE-2026-18894 Langflow OSS is affected by multiple vulnerabilities

    Critical·CVSS 9.8 EPSS 0.52%

    Exploit status: No public exploit known

    Affects: ibm langflow oss, langflow

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public exe...

20. Critical (CVSS 9+) Published 2026-10-29 17:18 · updated 2026-10-30 20:18

    CVE-2026-93680 Langflow OSS is affected by multiple vulnerabilities

    Critical·CVSS 9.8 EPSS 2.2% Framework module

    Exploit status: Public exploit available

    Affects: ibm langflow oss, langflow

    IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).