Threat database

CVE-2026-93934 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Partiso product. It allows object injection and affects versions from 0 up to and including 1.1.13. The vulnerability has a high CVSS score of 9.8, indicating it can be exploited remotely without privileges or user interaction, leading to full confidentiality, integrity, and availability compromise.

CVE-2026-93933 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Rosalinda product, affecting versions up to 1.2.4. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-93932 is a critical vulnerability in ThemeREX Group's Smart Casa product that allows deserialization of untrusted data, leading to object injection. This vulnerability affects versions from 0 up to and including 1.0.12. It has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-93931 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Smash product. It allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The issue affects Smash versions from initial releases up to and including 1.12.0. The vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector and no required privileges or user interaction.

CVE-2026-93930 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Tantra product. It allows object injection and affects Tantra versions from the initial release through 2.9.0. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the available data.

CVE-2026-93929 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Travesia product. It allows object injection attacks in versions from 0 up to and including 1.1.16. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the available data.

CVE-2026-93927 is a critical deserialization of untrusted data vulnerability in Axiomthemes Veto, affecting versions up to and including 1.6.0. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-93950 is a Missing Authorization vulnerability in the StylemixThemes Motors product, affecting versions from 0 up to and including 1.4.108. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a high severity with a CVSS score of 7.5. No official patch or remediation information is provided in the available data.

CVE-2026-93949 is a high-severity authentication bypass vulnerability in Omegathemes Grocery Shopping Store up to version 1.3.3. The flaw allows attackers to exploit the password recovery mechanism via an alternate path or channel, potentially bypassing authentication controls. This could lead to unauthorized actions impacting the integrity and availability of the affected system.

CVE-2026-106606 is a deserialization of untrusted data vulnerability in the YITH WooCommerce Affiliates plugin. It allows object injection, potentially leading to complete compromise of confidentiality, integrity, and availability. The issue affects versions from initial releases up to 3.31.0. The vulnerability has a high severity score of 7.2 and requires high privileges to exploit. No known exploits are reported in the wild, and no patch information is provided in the source data.