Critical severity threats

CVE-2026-62010 is a critical vulnerability in ThemeREX Avventure versions up to 1.1.12 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of affected systems.

CVE-2026-62009 is a critical vulnerability in ThemeREX Filmax versions up to 1.1.11 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw enables remote attackers to execute arbitrary code without authentication.

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

CVE-2026-62006 is a critical vulnerability in ThemeREX Nuts versions up to 1.12 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62005 is a critical vulnerability in ThemeREX Muzicon versions up to 1.15 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw enables remote attackers to execute arbitrary code without any authentication.

CVE-2026-62004 is a critical vulnerability in ThemeREX Motorix versions 1.11 and earlier. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, allowing remote attackers to execute arbitrary code without any privileges or user interaction.

CVE-2026-62003 is a critical vulnerability in ThemeREX Mission versions up to 1.22, involving unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication.

Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

CVE-2026-62001 is a critical vulnerability in ThemeREX Marcell versions up to 1.2.14 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-61998 is a critical vulnerability in ThemeREX Le Truffe versions up to 1.1.7 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-61997 is a critical vulnerability in ThemeREX Legal Stone versions up to 1.2.11 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-61992 is a critical vulnerability in GEO my WordPress plugin versions up to 4.5.5.3 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-61991 is a critical unauthenticated remote code execution vulnerability in AjaxLoadMore Cache versions up to 3.1.1. It is caused by a code injection flaw (CWE-94) that allows attackers to execute arbitrary code remotely without authentication.

CVE-2026-54860 is a critical vulnerability in ThemeREX Ozisti versions up to 1.1.10 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

CVE-2026-54858 is a critical vulnerability in ThemeREX Printy versions up to 1.13.0 involving unauthenticated PHP object injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication.

CVE-2026-54857 is a critical vulnerability in ThemeREX Quirky versions up to 1.23 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw enables remote attackers to execute arbitrary code without any authentication.

CVE-2026-54856 is a critical vulnerability in ThemeREX RexCoin versions up to 1.2.6 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

IBM Langflow OSS versions 1.0.0 through 1.12.8 contain an improper authentication vulnerability that could allow a remote attacker to bypass security restrictions. This flaw enables unauthorized access with potentially full confidentiality, integrity, and availability impact. The vulnerability is classified as critical with a CVSS score of 9.8.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.