Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 03:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

151-75% vs 7-day avg of 598

2 critical, 41 high, 61 medium, 27 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	7.1	CVE-2026-112849	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects... AivahThemesAivahThemes Hostme v2	NVD	Oct 23 13:17 UTC
CVE-2026-112849Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects... Executive summary A cross-site scripting flaw affects the Hostme v2 WordPress theme by AivahThemes, in versions 7.0 and earlier. The advisory rates it at CVSS 7.1 and says it is expected to be exploited, and it recommends updating the theme right away or asking a hosting provider or web developer for help if that is not possible. Technical summary The flaw is a DOM-based cross-site scripting issue (CWE class: improper neutralization of input during web page generation) in the Hostme v2 theme, with versions 7.0 and earlier listed as vulnerable and a CVSS severity of 7.1. The advisory says it can be triggered by an unauthenticated attacker, but successful exploitation requires a privileged user to perform an action such as clicking a malicious link or visiting a crafted page. A patched version is not stated, and the advisory says no official patch is available at the time of writing. Patchstack has issued a mitigation rule to block attacks until an official patch is available, which is the only workaround described. The advisory does not state specific detection guidance or whether exploitation has been observed in the wild beyond a statement that it is expected to become exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects AivahThemes AivahThemes Hostme v2 NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112848	Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0. AivahThemes, PatchstackAivahThemes Hostme v2	NVD	Oct 23 13:17 UTC
CVE-2026-112848Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0. Executive summary A deserialization flaw in the Hostme v2 WordPress theme from AivahThemes allows attackers to inject objects into the site. Patchstack rates it high priority with a CVSS score of 9.8, and it says the flaw is likely to be exploited in mass attacks. No official patch is stated as available, and the advisory recommends updating or mitigating immediately, with a web host or developer's help if needed. Technical summary The weakness is PHP Object Injection caused by deserialization of untrusted data, and the advisory classifies it under OWASP A3 Injection. The attack requires no authentication (unauthenticated access), and the CVSS score of 9.8 is given by Patchstack. The advisory says the affected versions are from n/a through 7.0 and lists <= 7.0 as vulnerable, with no official patched version stated ("No official patch available"). Patchstack has issued a mitigation rule that blocks attacks until an official patch is applied, and the advisory does not describe a manual workaround or specific detection signatures beyond that. The advisory does not state a CVSS vector string or whether exploitation has been observed in the wild, only that it is expected to be exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects AivahThemes Patchstack AivahThemes Hostme v2 NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee