CVE-2026-62016 is a critical vulnerability in ThemeREX Gamic versions up to 1.19 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction.
CVE-2026-62015 is a critical vulnerability in ThemeREX Gamezone versions up to 1.1.11 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-62014 is a critical vulnerability in ThemeREX EmojiNation versions up to 1.0.12 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-62013 is a critical vulnerability in ThemeREX Edge Decor versions up to 2.9 that allows unauthenticated PHP Object Injection due to unsafe deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of affected systems.
CVE-2026-62012 is a critical vulnerability in ThemeREX Coinpress versions up to 1.0.15 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-62011 is a critical vulnerability in ThemeREX Bonbon versions up to 1.11 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-62010 is a critical vulnerability in ThemeREX Avventure versions up to 1.1.12 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-62009 is a critical vulnerability in ThemeREX Filmax versions up to 1.1.11 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-62008 is a critical vulnerability in ThemeREX Orpheus versions 1.8 and earlier. It involves unauthenticated PHP object injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication.
CVE-2026-62006 is a critical vulnerability in ThemeREX Nuts versions up to 1.12 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-62005 is a critical vulnerability in ThemeREX Muzicon versions up to 1.15 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-62004 is a critical vulnerability in ThemeREX Motorix versions up to 1.11, involving unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication.
CVE-2026-62003 is a critical vulnerability in ThemeREX Mission versions up to 1.22 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-62002 is a critical vulnerability in ThemeREX Meals & Wheels versions up to 1.1.13 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-62001 is a critical vulnerability in ThemeREX Marcell versions up to 1.2.14 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-61998 is a critical vulnerability in ThemeREX Le Truffe versions up to and including 1.1.7. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability.
CVE-2026-61997 is a critical vulnerability in ThemeREX Legal Stone versions up to 1.2.11 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-61996 is a SQL Injection vulnerability in MLS On The Fly versions up to and including 1.8.1.5. It involves improper neutralization of special elements in SQL commands, allowing an attacker with low privileges to execute unauthorized SQL queries. The vulnerability has a high severity score of 8.5 and impacts confidentiality and availability.
CVE-2026-61995 is a high-severity vulnerability in emarket-design's YouTube Showcase product, affecting versions up to and including 4.1.0. It is an unauthenticated Cross-Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can execute in the context of users' browsers.