CVE-2026-62013 is a critical vulnerability in ThemeREX Edge Decor versions up to 2.9 that allows unauthenticated PHP Object Injection due to unsafe deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of affected systems.
CVE-2026-62012 is a critical vulnerability in ThemeREX Coinpress versions up to 1.0.15 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-62011 is a critical vulnerability in ThemeREX Bonbon versions up to 1.11 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-62010 is a critical vulnerability in ThemeREX Avventure versions up to 1.1.12 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-62009 is a critical vulnerability in ThemeREX Filmax versions up to 1.1.11 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-62008 is a critical vulnerability in ThemeREX Orpheus versions 1.8 and earlier. It involves unauthenticated PHP object injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication.
CVE-2026-62006 is a critical vulnerability in ThemeREX Nuts versions up to 1.12 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-62005 is a critical vulnerability in ThemeREX Muzicon versions up to 1.15 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-62004 is a critical vulnerability in ThemeREX Motorix versions up to 1.11, involving unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication.
CVE-2026-62003 is a critical vulnerability in ThemeREX Mission versions up to 1.22 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-62002 is a critical vulnerability in ThemeREX Meals & Wheels versions up to 1.1.13 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-62001 is a critical vulnerability in ThemeREX Marcell versions up to 1.2.14 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-61998 is a critical vulnerability in ThemeREX Le Truffe versions up to and including 1.1.7. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability.
CVE-2026-61997 is a critical vulnerability in ThemeREX Legal Stone versions up to 1.2.11 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-61996 is a SQL Injection vulnerability in MLS On The Fly versions up to and including 1.8.1.5. It involves improper neutralization of special elements in SQL commands, allowing an attacker with low privileges to execute unauthorized SQL queries. The vulnerability has a high severity score of 8.5 and impacts confidentiality and availability.
CVE-2026-61995 is a high-severity vulnerability in emarket-design's YouTube Showcase product, affecting versions up to and including 4.1.0. It is an unauthenticated Cross-Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can execute in the context of users' browsers.
CVE-2026-61992 is a critical vulnerability in the GEO my WordPress plugin (version 4.5.5.3 and earlier) that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-61991 is a critical vulnerability in AjaxLoadMore Cache versions up to 3.1.1 that allows unauthenticated remote code execution due to improper control of code generation (CWE-94). This flaw enables an attacker to execute arbitrary code on the affected system without authentication.
CVE-2026-61989 is a high-severity vulnerability in Easy Property Listings version 3.5.25 and earlier. It allows unauthenticated attackers to perform Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability.