Threat database

CVE-2026-66567 is a critical vulnerability in AncoraThemes Anesta versions up to 1.5.3 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-66566 is a high-severity vulnerability in Elated-Themes Ambient versions up to 1.7. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP. This vulnerability allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-66565 is a critical vulnerability in axiomthemes FC United versions up to 1.1.1 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-66564 is a critical unauthenticated PHP Object Injection vulnerability affecting ThemeREX ShiftCV versions up to and including 3.0.14. This vulnerability involves deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-66563 is a critical vulnerability in ThemeREX Windsor versions up to 2.10 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-66483 is a critical vulnerability in ThemeREX Education Center versions up to 3.6.12. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, allowing an attacker to execute arbitrary code without authentication.

CVE-2026-66482 is a critical vulnerability in AncoraThemes Drone Media versions up to 2.2.0 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring any user interaction or privileges.

CVE-2026-66481 is a path traversal vulnerability in Presto Player Pro versions up to 3.0.1 that allows an authenticated user with high privileges to arbitrarily delete files. This vulnerability does not impact confidentiality or integrity but can cause denial of service by deleting critical files.

CVE-2026-65459 is a high-severity vulnerability in WPMU DEV's Forminator plugin versions up to 1.57.3. It involves missing authorization controls allowing unauthenticated attackers to arbitrarily delete content. This flaw impacts availability but does not affect confidentiality or integrity. No patch information is provided, and no known exploits are reported in the wild.

CVE-2026-62130 is a high-severity vulnerability in WooCommerce Multilingual & Multicurrency versions up to 5.5.8. It involves PHP Object Injection due to deserialization of untrusted data by users with shop manager privileges. This flaw can lead to full confidentiality, integrity, and availability compromise of the affected system.

CVE-2026-62129 is a critical vulnerability in WPFunnels Creator LMS versions up to 1.2.21 that allows contributor-level users to upload arbitrary files without restriction on file type. This unrestricted file upload can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62125 is a critical vulnerability in ThemeREX Asia Garden versions up to 1.3.1 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-62124 is a critical vulnerability in ThemeREX's N7 | Golf Club Sports & Events plugin, affecting versions up to 2.21. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, which can lead to full system compromise. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-62123 is a critical vulnerability in ThemeREX's Invetex product, affecting versions up to 2.18. It involves unauthenticated PHP object injection due to deserialization of untrusted data, which can lead to full system compromise without requiring user interaction.

CVE-2026-62120 is a critical vulnerability in ThemeREX Law Office versions up to 3.20 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62118 is a high-severity vulnerability in Dmitry V.'s Barcode Scanner with Inventory & Order Manager software versions up to 1.13.1. It involves missing authorization controls, allowing unauthenticated users to bypass access restrictions. This flaw can lead to unauthorized information disclosure, modification, and availability impact.

CVE-2026-62117 is a high severity SQL Injection vulnerability in Dmitry V.'s Barcode Scanner with Inventory & Order Manager affecting versions up to and including 1.13.1. The flaw allows improper neutralization of special elements in SQL commands, potentially enabling an attacker with low privileges to execute unauthorized database queries. This vulnerability impacts confidentiality and availability but does not affect integrity. No patch or remediation information is currently provided.

CVE-2026-62116 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in Dmitry V.'s Barcode Scanner with Inventory & Order Manager software versions up to 1.13.1. This vulnerability allows an attacker to inject malicious scripts during web page generation without authentication, potentially impacting confidentiality, integrity, and availability.

CVE-2026-62115 is a high severity vulnerability in KuteShop versions up to and including 4.2.9. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements, classified under CWE-98. This vulnerability allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62100 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in KuteShop versions up to and including 4.2.9. This vulnerability allows an attacker to inject malicious scripts during web page generation without requiring authentication. The flaw is categorized under CWE-79, indicating improper neutralization of input. No patch or remediation information is currently provided by the vendor.