CVE-2026-66565 is a critical vulnerability in axiomthemes FC United versions up to 1.1.1 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.
CVE-2026-66564 is a critical unauthenticated PHP Object Injection vulnerability affecting ThemeREX ShiftCV versions up to and including 3.0.14. This vulnerability involves deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-66563 is a critical vulnerability in ThemeREX Windsor versions up to 2.10 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-66483 is a critical vulnerability in ThemeREX Education Center versions up to 3.6.12. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, allowing an attacker to execute arbitrary code without authentication.
CVE-2026-66482 is a critical vulnerability in AncoraThemes Drone Media versions up to 2.2.0 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring any user interaction or privileges.
CVE-2026-62130 is a high-severity vulnerability in WooCommerce Multilingual & Multicurrency versions up to 5.5.8. It involves PHP Object Injection due to deserialization of untrusted data by users with shop manager privileges. This flaw can lead to full confidentiality, integrity, and availability compromise of the affected system.
CVE-2026-62125 is a critical vulnerability in ThemeREX Asia Garden versions up to 1.3.1 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.
CVE-2026-62124 is a critical vulnerability in ThemeREX's N7 | Golf Club Sports & Events plugin, affecting versions up to 2.21. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, which can lead to full system compromise. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-62123 is a critical vulnerability in ThemeREX's Invetex product, affecting versions up to 2.18. It involves unauthenticated PHP object injection due to deserialization of untrusted data, which can lead to full system compromise without requiring user interaction.
CVE-2026-62120 is a critical vulnerability in ThemeREX Law Office versions up to 3.20 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-62090 is a critical vulnerability in ThemeREX WineShop versions up to 3.20 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-62087 is a critical vulnerability in ThemeREX Equadio versions up to 1.1.4 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-62086 is a critical vulnerability in ThemeREX Juno versions up to 2.25, involving unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication, impacting confidentiality, integrity, and availability.
CVE-2026-62077 is a critical vulnerability in BoldThemes Avala versions up to 1.1.4 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.
CVE-2026-62076 is a critical vulnerability in The4 Kalles versions up to 1.1.7.1 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.
CVE-2026-62054 is a critical vulnerability in ThemeREX Yacht Rental versions up to 2.6 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-62053 is a critical vulnerability in ThemeREX Wine House versions up to 3.20 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-62052 is a critical vulnerability in ThemeREX Tipsy versions 1.6 and earlier that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-62051 is a critical vulnerability in ThemeREX Stargaze versions up to 1.10 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-62050 is a critical vulnerability in ThemeREX Splendour versions up to 1.23 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.