Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 03:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

151-75% vs 7-day avg of 598

2 critical, 41 high, 61 medium, 27 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Critical	9.8	CVE-2026-112859	Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16. ThemeREX Group, WordPressThemeREX Group Little Birdies, WordPress Little Birdies Theme	NVD	Oct 23 13:17 UTC
CVE-2026-112859Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16. Executive summary A PHP Object Injection flaw in the Little Birdies WordPress theme, published by ThemeREX Group, affects all versions up to and including 1.3.16. The advisory rates it 9.8 CVSS and high priority, and says it is expected to be exploited in mass campaigns. It states that no official patch is available, and the recommended immediate action is to update the theme if a fix exists, or to ask a hosting provider or web developer for help while a mitigation rule is used. Technical summary The flaw is an insecure deserialization of untrusted data (PHP Object Injection, OWASP A3: Injection) in the Little Birdies theme. The advisory states it requires no privileges (unauthenticated access). Affected versions are listed as from n/a through 1.3.16 and <= 1.3.16. No patched version is stated, and the advisory says no official patch is available. Patchstack has issued a mitigation rule that blocks attacks until an official patch is released, which is the only workaround described. The advisory does not state specific detection indicators, and it does not say whether exploitation in the wild has been observed beyond the expectation that it will be exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group WordPress ThemeREX Group Little Birdies WordPress Little Birdies Theme NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112856	Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10. ThemeREX Group, PatchstackThemeREX Group Vagabonds	NVD	Oct 23 13:17 UTC
CVE-2026-112856Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10. Executive summary A deserialization flaw in the Vagabonds WordPress theme by ThemeREX Group affects versions up to and including 1.3.10. The advisory rates it as high priority with a CVSS score of 9.8 and says it is expected to be exploited in mass campaigns. The advisory says no official patch is available, and the recommended immediate action is to mitigate or update the theme, or ask a hosting provider or web developer for help. Technical summary The flaw is PHP Object Injection, caused by deserialization of untrusted data, and is classed under OWASP A3: Injection. The advisory says it requires no authentication (unauthenticated access) and gives a CVSS 9.8 severity. The affected versions are listed as from n/a through 1.3.10, and the advisory states no official patched version is available. Patchstack has issued a mitigation rule to block attacks, but the advisory does not describe its details or any manual workaround. Specific exploit mechanics, vulnerable code paths, and detection indicators are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group Patchstack ThemeREX Group Vagabonds NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.1	CVE-2026-112852	Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12. ThemeREX GroupThemeREX Group Helion	NVD	Oct 23 13:17 UTC
CVE-2026-112852Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12. Executive summary A deserialization flaw in the Helion WordPress theme from ThemeREX Group affects all versions through 1.1.12. Patchstack rates it high priority with a CVSS score of 8.1 and says it is expected to be exploited. The advisory says no official patch is available yet, and it recommends updating the theme once a fix exists, or asking a hosting provider or web developer for help if that is not possible. Technical summary The flaw is a PHP Object Injection caused by deserialization of untrusted data, which lets attackers manipulate how the site processes data to run harmful actions on the server. Patchstack lists the required privilege as unauthenticated, so no login is needed according to the advisory. The vulnerable versions are stated as from n/a through 1.1.12 and <= 1.1.12, and no patched version is stated because no official patch is available. Patchstack says it has issued a mitigation rule that blocks attacks until an official patch is applied, but the advisory does not describe that rule's details. The advisory does not state a specific workaround beyond updating, detection guidance, or whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Helion NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112851	Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9. ThemeREX Group, PatchstackThemeREX Group HotLock	NVD	Oct 23 13:17 UTC
CVE-2026-112851Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9. Executive summary A deserialization flaw in the HotLock WordPress theme by ThemeREX Group affects versions up to and including 1.3.9. The advisory rates it as high priority with a CVSS score of 9.8 and says it is expected to be exploited, so it could let an unauthenticated attacker take control of affected websites. No official patch is stated as available, so the advisory recommends mitigating the issue immediately, such as with the Patchstack mitigation rule. Technical summary The vulnerability is a PHP Object Injection caused by deserialization of untrusted data, classified under OWASP A3: Injection. The advisory states that required privilege is unauthenticated, and that an attacker can manipulate how the site processes data to run harmful actions on the server. Affected versions are stated as from n/a through 1.3.9 and <= 1.3.9. No official patched version is stated; the advisory says no official patch is available. Patchstack has issued a mitigation rule to block attacks, and the advisory recommends updating the affected theme if possible, or asking a hosting provider or developer for help. No specific detection guidance, exploitation evidence beyond the expectation of exploitation, or other workarounds are stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group Patchstack ThemeREX Group HotLock NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112846	Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14. ThemeREX Group, PatchstackThemeREX Group Save Life	NVD	Oct 23 13:17 UTC
CVE-2026-112846Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14. Executive summary A deserialization flaw in the Save Life WordPress theme from ThemeREX Group lets attackers inject objects into the site, and the advisory rates it as highly dangerous with a CVSS score of 9.8. Versions 1.2.14 and earlier are affected. The advisory says no official patch is available, so the recommended immediate step is to update the theme if a fix exists, or to use the mitigation rule Patchstack has issued until an official patch can be tested and applied. Technical summary The vulnerability is a PHP Object Injection caused by deserialization of untrusted data, classified under OWASP A3: Injection. The advisory states it can be exploited without authentication (required privilege: Unauthenticated) and that it affects Save Life from n/a through 1.2.14, with vulnerable versions listed as <= 1.2.14. The advisory says no official patch is available and does not state a patched version. Patchstack has issued a mitigation rule that blocks attacks until an official patch is available. The advisory does not state exploitation in the wild as confirmed, though it says exploitation is expected and that similar flaws are used in mass-exploit campaigns. Detection guidance beyond the Patchstack mitigation rule is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group Patchstack ThemeREX Group Save Life NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.1	CVE-2026-57742	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids... ThemeREX GroupThemeREX Group Kids Planet	NVD	Oct 10 20:16 UTC
CVE-2026-57742Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids... From the advisory Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects ThemeREX Group ThemeREX Group Kids Planet NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-93944	Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15. ThemeREX GroupThemeREX Group Camelia	NVD	Oct 10 08:17 UTC
CVE-2026-93944Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Camelia NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-93943	Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0. ThemeREX GroupThemeREX Group Convex	NVD	Oct 10 08:17 UTC
CVE-2026-93943Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Convex NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-93942	Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0. ThemeREX GroupThemeREX Group Dwell	NVD	Oct 10 08:17 UTC
CVE-2026-93942Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Dwell NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-93941	Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2. ThemeREX GroupThemeREX Group Edema	NVD	Oct 10 08:17 UTC
CVE-2026-93941Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Edema NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-93940	Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0. ThemeREX GroupThemeREX Group Greeny	NVD	Oct 10 08:17 UTC
CVE-2026-93940Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Greeny NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-93938	Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7. ThemeREX GroupThemeREX Group Hogwords	NVD	Oct 10 08:17 UTC
CVE-2026-93938Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Hogwords NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-93937	Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0. ThemeREX GroupThemeREX Group Hygia	NVD	Oct 10 08:17 UTC
CVE-2026-93937Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Hygia NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-93936	Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4. ThemeREX GroupThemeREX Group IPharm	NVD	Oct 10 08:17 UTC
CVE-2026-93936Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group IPharm NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-93935	Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15. ThemeREX GroupThemeREX Group Let's Play	NVD	Oct 10 08:17 UTC
CVE-2026-93935Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Let's Play NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-93934	Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13. ThemeREX GroupThemeREX Group Partiso	NVD	Oct 10 08:17 UTC
CVE-2026-93934Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Partiso NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-93933	Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4. ThemeREX GroupThemeREX Group Rosalinda	NVD	Oct 10 08:17 UTC
CVE-2026-93933Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Rosalinda NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-93932	Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12. ThemeREX GroupThemeREX Group Smart Casa	NVD	Oct 10 08:17 UTC
CVE-2026-93932Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Smart Casa NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-93931	Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0. ThemeREX GroupThemeREX Group Smash	NVD	Oct 10 08:17 UTC
CVE-2026-93931Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Smash NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-93930	Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0. ThemeREX GroupThemeREX Group Tantra	NVD	Oct 10 08:17 UTC
CVE-2026-93930Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Tantra NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-93929	Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16. ThemeREX GroupThemeREX Group Travesia	NVD	Oct 10 08:17 UTC
CVE-2026-93929Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Travesia NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-62046	Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12. ThemeREX GroupThemeREX Group Gutentype	NVD	Oct 10 08:17 UTC
CVE-2026-62046Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Gutentype NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Critical	9.8	CVE-2026-62045	Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0. ThemeREX GroupThemeREX Group Booklovers	NVD	Oct 10 08:17 UTC
CVE-2026-62045Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0. From the advisory Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Booklovers NIST National Vulnerability DatabasePublished Oct 10, 2026 08:17 UTC Read the advisory
	Medium	6.5	CVE-2026-102798	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue... ThemeREX GroupThemeREX Group ThemeREX Addons	NVD	Oct 2 13:17 UTC
CVE-2026-102798Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue... From the advisory Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L Affects ThemeREX Group ThemeREX Group ThemeREX Addons NIST National Vulnerability DatabasePublished Oct 2, 2026 13:17 UTC Read the advisory
	Medium	6.4	CVE-2026-102797	Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a... ThemeREX GroupThemeREX Group ThemeREX Addons	NVD	Oct 2 13:17 UTC
CVE-2026-102797Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a... From the advisory Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Affects ThemeREX Group ThemeREX Group ThemeREX Addons NIST National Vulnerability DatabasePublished Oct 2, 2026 13:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited