Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 03:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

151-75% vs 7-day avg of 598

2 critical, 41 high, 61 medium, 27 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Critical	9.8	CVE-2026-112858	Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3. Axiomthemes, PatchstackAxiomthemes Rhodos	NVD	Oct 23 13:17 UTC
CVE-2026-112858Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3. Executive summary A deserialization flaw in the Rhodos WordPress theme, published by axiomthemes, affects versions up to and including 1.3.3. The advisory rates it 9.8 (critical) and says it is expected to be exploited, and it notes that no official patch is available yet. Technical summary The flaw is a PHP Object Injection caused by deserialization of untrusted data, which Patchstack classifies under OWASP A3 Injection. The advisory states that it can be exploited without authentication (required privilege: Unauthenticated), and the CVSS severity is listed as 9.8. Vulnerable versions are stated as <= 1.3.3, and the NVD entry says "from n/a through 1.3.3". No patched version is stated; the advisory says no official patch is available. Patchstack has issued a mitigation rule that blocks attacks until an official patch is available. The advisory advises updating the theme once a fix exists, and asking a hosting provider or developer for help if that is not possible. No specific detection indicators, exploit details, or fixed version are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Patchstack Axiomthemes Rhodos NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112857	Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8. Axiomthemes, PatchstackAxiomthemes Reprizo	NVD	Oct 23 13:17 UTC
CVE-2026-112857Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8. Executive summary A deserialization flaw in the Reprizo WordPress theme, affecting versions through 1.0.8, lets unauthenticated attackers run harmful code on affected websites. Patchstack rates it high priority with a CVSS score of 9.8 and expects it to be exploited. The advisory says no official patch is available yet, and it recommends updating the theme when a fix exists or asking a hosting provider or developer for help in the meantime. Technical summary The weakness is PHP Object Injection, classified under deserialization of untrusted data (OWASP A3: Injection). The advisory states that it requires no authentication, and it gives a CVSS severity of 9.8. Affected versions are listed as from n/a through 1.0.8 and as <= 1.0.8. The advisory states that no official patched version is available. Patchstack has issued a mitigation rule that blocks attacks until an official patch is released. The advisory does not state a specific workaround beyond that rule, and it does not describe the exact vulnerable code path or payload format. Detection guidance beyond the Patchstack mitigation rule is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Patchstack Axiomthemes Reprizo NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112855	Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5. AxiomthemesAxiomthemes Redy	NVD	Oct 23 13:17 UTC
CVE-2026-112855Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5. Executive summary A deserialization flaw in the Redy WordPress theme by axiomthemes lets unauthenticated attackers run harmful code on affected websites. The advisory rates it 9.8 out of 10 severity and says it is expected to be exploited in mass attack campaigns. The advisory says to update the theme immediately, but notes that no official patch is available yet, so a mitigation rule from Patchstack is the interim option. Technical summary The vulnerability is a PHP Object Injection caused by deserialization of untrusted data, classified under OWASP A3: Injection. The advisory states it requires no authentication (required privilege: Unauthenticated), and it affects Redy versions from n/a through 1.3.5, with 1.3.5 listed as vulnerable. The advisory states that no official patched version is available, so the fixed version is not stated. The CVSS vector string is not stated, though the advisory gives a CVSS severity of 9.8. Patchstack has issued a mitigation rule that blocks attacks until an official patch is released; beyond that, no other workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Axiomthemes Redy NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112854	Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6. AxiomthemesAxiomthemes Holistic Center	NVD	Oct 23 13:17 UTC
CVE-2026-112854Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6. Executive summary A deserialization flaw in the Holistic Center WordPress theme, published by axiomthemes, lets attackers inject PHP objects into sites running version 1.2.6 and earlier. The advisory rates it critical at CVSS 9.8 and says it requires no login and is expected to be exploited. The advisory says no official patch is available yet, and it recommends updating the theme once a fix exists, or asking a hosting provider or web developer for help if that is not possible. Technical summary The vulnerability is classified as PHP Object Injection (untrusted data deserialization, OWASP A3: Injection) in the Holistic Center theme, affecting versions from n/a through 1.2.6. The advisory states the required privilege is unauthenticated, so remote exploitation appears to need no account, though the exact network vector is not described. No patched version is stated; the advisory says no official patch is available. Patchstack has issued a mitigation rule that blocks attacks until an official patch is available, which is the only workaround mentioned. The advisory does not give specific detection indicators or logging guidance, and it does not state whether exploitation in the wild has been observed beyond saying it is expected. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Axiomthemes Holistic Center NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112853	Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1. Axiomthemes, PatchstackAxiomthemes Hallelujah	NVD	Oct 23 13:17 UTC
CVE-2026-112853Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1. Executive summary A deserialization flaw in the Hallelujah WordPress theme by axiomthemes affects versions up to and including 1.1.1. The advisory rates it critical at CVSS 9.8, notes it can be exploited without logging in, and says mass-exploit campaigns are likely. The advisory states no official patch is available, and it recommends updating the theme if a fix exists or using Patchstack's mitigation rule until one does. Technical summary The flaw is PHP Object Injection, caused by deserialization of untrusted data, and the advisory says it allows object injection. The required privilege is unauthenticated, and the advisory does not describe the specific request or parameter used to reach the flaw. The affected versions are listed as from n/a through 1.1.1, and the advisory gives no fixed version because the patched version is not stated and no official patch is available. No workaround beyond the Patchstack mitigation rule is described, and no detection guidance, indicators of compromise, or exploitation-in-the-wild confirmation is given. The advisory does not state a CVSS vector string, only a score of 9.8. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Patchstack Axiomthemes Hallelujah NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-66569	Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. AxiomthemesAxiomthemes Kicker	NVD	Oct 10 20:16 UTC
CVE-2026-66569Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. From the advisory Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Axiomthemes Kicker NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-66568	Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. AxiomthemesAxiomthemes Original	NVD	Oct 10 20:16 UTC
CVE-2026-66568Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. From the advisory Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Axiomthemes Original NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-66565	Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. AxiomthemesAxiomthemes FC United	NVD	Oct 10 20:16 UTC
CVE-2026-66565Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. From the advisory Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Axiomthemes FC United NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	High	8.1	CVE-2026-42704	Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. AxiomthemesAxiomthemes Kids Care	NVD	Oct 10 20:16 UTC
CVE-2026-42704Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. From the advisory Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Axiomthemes Kids Care NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-93945	Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0. AxiomthemesAxiomthemes Balance	NVD	Oct 10 08:17 UTC
CVE-2026-93945Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0. From the advisory Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Axiomthemes Balance NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-93927	Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0. AxiomthemesAxiomthemes Veto	NVD	Oct 10 08:17 UTC
CVE-2026-93927Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0. From the advisory Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Axiomthemes Veto NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects