Threat database

CVE-2026-66569 is a critical vulnerability in axiomthemes Kicker versions up to 2.2.1 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-66568 is a critical vulnerability in axiomthemes Original versions up to 1.9.0 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-66565 is a critical vulnerability in axiomthemes FC United versions up to 1.1.1 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-42704 is a high-severity vulnerability in the Kids Care theme by axiomthemes, affecting versions up to and including 3.2.4. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP. This vulnerability could allow an attacker to include arbitrary files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-93945 is a critical deserialization of untrusted data vulnerability in Axiomthemes Balance up to version 1.12.0. It allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating a high severity with no required privileges or user interaction for exploitation.

CVE-2026-93927 is a critical deserialization of untrusted data vulnerability in Axiomthemes Veto, affecting versions up to and including 1.6.0. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-65581 is a critical vulnerability in Axiomthemes AI ANN versions up to and including 1.29.0. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows remote attackers to execute arbitrary code without any authentication. The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-65579 is a critical vulnerability in axiomthemes Agricola versions up to and including 1.21.0. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). The vulnerability allows an attacker to execute arbitrary code without authentication.

CVE-2026-65572 is a critical vulnerability in Axiomthemes A.Williams versions up to and including 1.3.1. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to execute arbitrary code remotely without any authentication. The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability.

CVE-2026-65571 is a critical unauthenticated PHP Object Injection vulnerability affecting Axiomthemes 69 Clothing versions up to and including 1.2.11.1. This vulnerability allows remote attackers to perform deserialization of untrusted data without any authentication, potentially leading to full system compromise.

Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.

Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0.

AxiomThemes Reprizo versions up to and including 1.0.8 are affected by an unauthenticated Local File Inclusion (LFI) vulnerability. This vulnerability involves improper control of filenames in include/require statements in PHP, classified as CWE-98. It allows an attacker to include local files on the server without authentication, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a high severity with a CVSS score of 8.1.

Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Racquet allows PHP Local File Inclusion. This issue affects Racquet: from n/a through 1.12.0.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Fermentio allows PHP Local File Inclusion. This issue affects Fermentio: from n/a through 1.5.0.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Spin allows PHP Local File Inclusion. This issue affects Spin: from n/a through 1.8.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Crafti allows PHP Local File Inclusion. This issue affects Crafti: from n/a through 1.12.