Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 07:05 UTC

Critical in the last 24 hours

1602 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

164-72% vs 7-day avg of 596

3 critical, 57 high, 70 medium, 29 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Critical	9.8	CVE-2026-112847	Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13. ThemeRexThemeRex ZenSoul	NVD	Oct 23 13:17 UTC
CVE-2026-112847Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13. Executive summary A deserialization flaw in the ZenSoul WordPress theme, made by ThemeREX, lets outside attackers inject objects into the site. The advisory rates it 9.8 on CVSS and says it is expected to be exploited in mass attack campaigns. The recommended action is to update the theme, but the advisory states no official patch is available, so it suggests using a mitigation rule or asking a hosting provider or developer for help. Technical summary The flaw is a PHP Object Injection caused by deserialization of untrusted data, and the advisory states it requires no authentication (required privilege: Unauthenticated). The vulnerable versions are listed as from n/a through 1.13 and as less than or equal to 1.13. No fixed version is stated, and the advisory says no official patch is available. Patchstack has issued a mitigation rule that blocks attacks until an official patch can be tested and applied. The advisory does not state a specific workaround beyond that mitigation rule, and it gives no detection guidance or indicators of compromise. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex ZenSoul NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-81797	Unauthenticated PHP Object Injection in Buzz Stone \| Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. ThemeRexThemeRex Buzz Stone \| Magazine & Viral Blog WordPress Theme	NVD	Oct 10 20:16 UTC
CVE-2026-81797Unauthenticated PHP Object Injection in Buzz Stone \| Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. From the advisory Unauthenticated PHP Object Injection in Buzz Stone \| Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Buzz Stone \| Magazine & Viral Blog WordPress Theme NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-78535	Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. ThemeRexThemeRex Photolia	NVD	Oct 10 20:16 UTC
CVE-2026-78535Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. From the advisory Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Photolia NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-78531	Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. ThemeRexThemeRex Jacqueline	NVD	Oct 10 20:16 UTC
CVE-2026-78531Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. From the advisory Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Jacqueline NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-78529	Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. ThemeRexThemeRex Alliance	NVD	Oct 10 20:16 UTC
CVE-2026-78529Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. From the advisory Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Alliance NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-66564	Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. ThemeRexThemeRex ShiftCV	NVD	Oct 10 20:16 UTC
CVE-2026-66564Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. From the advisory Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex ShiftCV NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-66563	Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. ThemeRexThemeRex Windsor	NVD	Oct 10 20:16 UTC
CVE-2026-66563Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. From the advisory Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Windsor NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-66483	Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. ThemeRexThemeRex Education Center	NVD	Oct 10 20:16 UTC
CVE-2026-66483Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. From the advisory Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Education Center NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-62125	Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions. ThemeRexThemeRex Asia Garden	NVD	Oct 10 20:16 UTC
CVE-2026-62125Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions. From the advisory Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Asia Garden NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-62124	Unauthenticated PHP Object Injection in N7 \| Golf Club Sports & Events <= 2.21 versions. ThemeRexThemeRex N7 \| Golf Club Sports & Events	NVD	Oct 10 20:16 UTC
CVE-2026-62124Unauthenticated PHP Object Injection in N7 \| Golf Club Sports & Events <= 2.21 versions. From the advisory Unauthenticated PHP Object Injection in N7 \| Golf Club Sports & Events <= 2.21 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex N7 \| Golf Club Sports & Events NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-62123	Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. ThemeRexThemeRex Invetex	NVD	Oct 10 20:16 UTC
CVE-2026-62123Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. From the advisory Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Invetex NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-62120	Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. ThemeRexThemeRex Law Office	NVD	Oct 10 20:16 UTC
CVE-2026-62120Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. From the advisory Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Law Office NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-62090	Unauthenticated PHP Object Injection in WineShop <= 3.20 versions. ThemeRexThemeRex WineShop	NVD	Oct 10 20:16 UTC
CVE-2026-62090Unauthenticated PHP Object Injection in WineShop <= 3.20 versions. From the advisory Unauthenticated PHP Object Injection in WineShop <= 3.20 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex WineShop NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-62087	Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions. ThemeRexThemeRex Equadio	NVD	Oct 10 20:16 UTC
CVE-2026-62087Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions. From the advisory Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Equadio NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-62086	Unauthenticated PHP Object Injection in Juno <= 2.25 versions. ThemeRexThemeRex Juno	NVD	Oct 10 20:16 UTC
CVE-2026-62086Unauthenticated PHP Object Injection in Juno <= 2.25 versions. From the advisory Unauthenticated PHP Object Injection in Juno <= 2.25 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Juno NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	High	8.1	CVE-2026-62074	Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. ThemeRexThemeRex Ozeum	NVD	Oct 10 20:16 UTC
CVE-2026-62074Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. From the advisory Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Ozeum NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-62054	Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions. ThemeRexThemeRex Yacht Rental	NVD	Oct 10 20:16 UTC
CVE-2026-62054Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions. From the advisory Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Yacht Rental NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-62053	Unauthenticated PHP Object Injection in Wine House <= 3.20 versions. ThemeRexThemeRex Wine House	NVD	Oct 10 20:16 UTC
CVE-2026-62053Unauthenticated PHP Object Injection in Wine House <= 3.20 versions. From the advisory Unauthenticated PHP Object Injection in Wine House <= 3.20 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Wine House NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-62052	Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions. ThemeRexThemeRex Tipsy	NVD	Oct 10 20:16 UTC
CVE-2026-62052Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions. From the advisory Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Tipsy NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-62051	Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions. ThemeRexThemeRex Stargaze	NVD	Oct 10 20:16 UTC
CVE-2026-62051Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions. From the advisory Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Stargaze NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	Critical	9.8	CVE-2026-62050	Unauthenticated PHP Object Injection in Splendour <= 1.23 versions. ThemeRexThemeRex Splendour	NVD	Oct 10 20:16 UTC
CVE-2026-62050Unauthenticated PHP Object Injection in Splendour <= 1.23 versions. From the advisory Unauthenticated PHP Object Injection in Splendour <= 1.23 versions. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex Splendour NIST National Vulnerability DatabasePublished Oct 10, 2026 20:16 UTC Read the advisory
	High	7.1	CVE-2026-94063	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue... ThemeRexThemeRex Education Center	NVD	Oct 9 14:17 UTC
CVE-2026-94063Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue... From the advisory Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects ThemeRex ThemeRex Education Center NIST National Vulnerability DatabasePublished Oct 9, 2026 14:17 UTC Read the advisory
	Medium	6.5	CVE-2026-97236	Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. ThemeRexThemeREX Addons	NVD	Sep 30 13:17 UTC
CVE-2026-97236Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. From the advisory Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L Affects ThemeRex ThemeREX Addons NIST National Vulnerability DatabasePublished Sep 30, 2026 13:17 UTC Read the advisory
	High	7.1	CVE-2026-97235	Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. ThemeRexThemeREX Addons	NVD	Sep 30 13:17 UTC
CVE-2026-97235Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. From the advisory Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects ThemeRex ThemeREX Addons NIST National Vulnerability DatabasePublished Sep 30, 2026 13:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited