Threat database

CVE-2026-57742 is a high-severity reflected cross-site scripting (XSS) vulnerability in ThemeREX Group's Kids Planet product. It allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability affects versions up to and including 2.2.14.2. No patch or remediation information is currently provided.

CVE-2026-62045 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Booklovers product. It allows object injection and affects versions from 0 up to and including 2.13.0. The vulnerability has a high CVSS score of 9.8, indicating severe potential impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.

CVE-2026-62046 is a critical deserialization of untrusted data vulnerability in the ThemeREX Group Gutentype product. It allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The issue affects Gutentype versions from initial releases up to and including 2.1.12. The vulnerability has a CVSS score of 9.8, indicating high severity. No patch or remediation information is provided in the available data.

CVE-2026-93944 is a critical vulnerability in ThemeREX Group's Camelia product that allows deserialization of untrusted data, leading to object injection. This flaw affects versions from the initial release up to and including 1.2.15. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-93943 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Convex product. It allows object injection attacks and affects versions from the initial release through 1.16.0. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-93942 is a critical vulnerability in ThemeREX Group's Dwell theme that allows deserialization of untrusted data, leading to object injection. This affects versions from 0 up to and including 1.16.0. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability if exploited.

CVE-2026-93941 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Edema product. This flaw allows object injection attacks and affects versions from 0 up to and including 1.2.2.2. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No patch or remediation details are currently provided.

CVE-2026-93940 is a critical vulnerability in ThemeREX Group's Greeny product affecting versions from 0 up to and including 2.10.0. It involves deserialization of untrusted data, which allows object injection. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-93938 is a critical vulnerability in ThemeREX Group's Hogwords product that allows deserialization of untrusted data leading to object injection. This flaw affects versions from 0 up to and including 1.2.7. The vulnerability has a high CVSS score of 9.8, indicating it can be exploited remotely without privileges or user interaction, resulting in complete confidentiality, integrity, and availability compromise.

CVE-2026-93937 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Hygia product. It allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The issue affects all versions from initial release up to and including 1.21.0. The vulnerability has a CVSS 3.1 score of 9.8, indicating high severity. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

A critical deserialization of untrusted data vulnerability (CWE-502) exists in ThemeREX Group IPharm ipharm, allowing object injection. This affects versions up to and including 1.2.4. The vulnerability has a CVSS 3.1 score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch information is currently available.