Threat database

CVE-2026-62099 is a high-severity vulnerability in the Boutique product by kutethemes, affecting versions up to and including 2.3.3. It involves an unauthenticated local file inclusion (LFI) due to improper control of filenames in include/require statements in PHP, classified under CWE-98. This flaw allows an attacker to include files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-62098 is a medium severity vulnerability in kutethemes Boutique versions up to 2.3.3 that allows unauthenticated content injection due to improper control of code generation (CWE-94). This vulnerability could lead to limited confidentiality and integrity impacts without affecting availability. No patch or remediation information is currently provided.

CVE-2026-62096 is a high-severity vulnerability in kutethemes Biolife versions up to and including 3.2.3. It involves an unauthenticated Local File Inclusion (LFI) flaw, categorized under CWE-98, which relates to improper control of filenames in include/require statements in PHP programs. This vulnerability allows an attacker to include local files on the server without authentication, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-62095 is a high-severity vulnerability in kutethemes Biolife versions up to and including 3.2.3. It is an unauthenticated cross-site scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can lead to partial confidentiality, integrity, and availability impacts.

CVE-2026-62094 is a high-severity vulnerability in kutethemes TechOne versions up to and including 3.0.3. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP. This vulnerability allows an attacker to potentially include and execute arbitrary files on the server, impacting confidentiality, integrity, and availability.

CVE-2026-62093 is a high-severity vulnerability in kutethemes TechOne versions up to and including 3.0.3. It is an unauthenticated cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that can lead to partial confidentiality, integrity, and availability impacts.

CVE-2026-62092 is a high-severity vulnerability in kutethemes Armania versions up to 1.4.8 that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This flaw can lead to remote code execution or full system compromise if exploited.

CVE-2026-62091 is a high severity unauthenticated cross-site scripting (XSS) vulnerability affecting kutethemes Armania versions up to and including 1.4.8. The flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No patch or remediation information is currently provided.

CVE-2026-62090 is a critical vulnerability in ThemeREX WineShop versions up to 3.20 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62087 is a critical vulnerability in ThemeREX Equadio versions up to 1.1.4 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62086 is a critical vulnerability in ThemeREX Juno versions up to 2.25, involving unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication, impacting confidentiality, integrity, and availability.

CVE-2026-62082 is a high severity unauthenticated Cross-Site Scripting (XSS) vulnerability in An-Themes Pin WP affecting versions up to 7.0. This vulnerability allows an attacker to inject malicious scripts during web page generation without authentication. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector.

CVE-2026-62077 is a critical vulnerability in BoldThemes Avala versions up to 1.1.4 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-62076 is a critical vulnerability in The4 Kalles versions up to 1.1.7.1 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-62075 is a high-severity vulnerability in Mymoun Backhoe versions 2.0 and earlier that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This flaw can lead to remote file inclusion attacks, potentially resulting in full system compromise.

CVE-2026-62074 is a high severity vulnerability in ThemeREX Ozeum versions up to and including 1.3.0. It involves an unauthenticated Local File Inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP. This vulnerability can lead to remote file inclusion attacks, potentially allowing attackers to execute arbitrary code or access sensitive information.

CVE-2026-62070 is a high severity vulnerability in CKThemes Flipmart versions up to 2.8 that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This flaw can lead to remote file inclusion attacks, potentially resulting in full system compromise.

CVE-2026-62069 is a high severity vulnerability in CocoBasic Fabius versions 1.0 and earlier. It involves an unauthenticated local file inclusion due to improper control of filenames in include/require statements, classified under CWE-98. This flaw allows an attacker to potentially include arbitrary files, leading to full confidentiality, integrity, and availability compromise.

CVE-2026-62068 is a high-severity vulnerability in CocoBasic Teoro versions 1.1 and earlier. It is an unauthenticated Local File Inclusion (LFI) vulnerability caused by improper control of filenames used in include or require statements in PHP. This flaw allows an attacker to include local files on the server, potentially leading to remote code execution or data disclosure.

CVE-2026-62067 is a high-severity vulnerability in CocoBasic Kaven versions up to 1.2 that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This flaw can lead to remote file inclusion attacks, potentially compromising confidentiality, integrity, and availability of the affected system.