Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-60205 | 9.8 critical | 1.0% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1. | 15 Oct |
| CVE-2026-62013 | 9.8 critical | — | themerex, edge decor | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | 17 h ago |
| CVE-2026-62018 | 9.8 critical | — | themerex, gunslinger | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | 17 h ago |
| CVE-2026-62008 | 9.8 critical | — | themerex, orpheus | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | 17 h ago |
| CVE-2026-62002 | 9.8 critical | — | themerex, meals & wheels | Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | 17 h ago |
| CVE-2026-54859 | 9.8 critical | — | themerex, preservation | Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. | 17 h ago |
| CVE-2026-54858 | 9.8 critical | — | themerex, printy | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | 20 h ago |
| CVE-2026-62001 | 9.8 critical | — | themerex, marcell | Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. | 20 h ago |
| CVE-2026-62006 | 9.8 critical | — | themerex, nuts | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | 20 h ago |
| CVE-2026-62012 | 9.8 critical | — | themerex, coinpress | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | 20 h ago |
| CVE-2026-62017 | 9.8 critical | — | themerex, good homes | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | 20 h ago |
| CVE-2026-62016 | 9.8 critical | — | themerex, gamic | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | 22 h ago |
| CVE-2026-62015 | 9.8 critical | — | themerex, gamezone | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | 22 h ago |
| CVE-2026-62014 | 9.8 critical | — | themerex, emojination | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | 22 h ago |
| CVE-2026-62011 | 9.8 critical | — | themerex, bonbon | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | 22 h ago |
| CVE-2026-62010 | 9.8 critical | — | themerex, avventure | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | 22 h ago |
| CVE-2026-62009 | 9.8 critical | — | themerex, filmax | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | 22 h ago |
| CVE-2026-62005 | 9.8 critical | — | themerex, muzicon | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | 22 h ago |
| CVE-2026-62004 | 9.8 critical | — | themerex, motorix | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | 22 h ago |
| CVE-2026-62003 | 9.8 critical | — | themerex, mission | Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | 22 h ago |
| CVE-2026-61998 | 9.8 critical | — | themerex, le truffe | Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | 22 h ago |
| CVE-2026-61997 | 9.8 critical | — | themerex, legal stone | Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | 22 h ago |
| CVE-2026-54860 | 9.8 critical | — | themerex, ozisti | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | 22 h ago |
| CVE-2026-54857 | 9.8 critical | — | themerex, quirky | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | 22 h ago |
| CVE-2026-54856 | 9.8 critical | — | themerex, rexcoin | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | 22 h ago |
| CVE-2026-112859 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16. | Sat 24 Oct |
| CVE-2026-112856 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10. | Sat 24 Oct |
| CVE-2026-112851 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9. | Sat 24 Oct |
| CVE-2026-112847 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13. | Sat 24 Oct |
| CVE-2026-112846 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14. | Sat 24 Oct |
| CVE-2026-62045 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0. | 13 Oct |
| CVE-2026-62046 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12. | 13 Oct |
| CVE-2026-93929 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16. | 13 Oct |
| CVE-2026-93930 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0. | 13 Oct |
| CVE-2026-93931 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0. | 13 Oct |
| CVE-2026-93932 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12. | 13 Oct |
| CVE-2026-93933 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4. | 13 Oct |
| CVE-2026-93934 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13. | 13 Oct |
| CVE-2026-93935 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15. | 13 Oct |
| CVE-2026-93936 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4. | 13 Oct |
| CVE-2026-93937 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0. | 13 Oct |
| CVE-2026-93938 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7. | 13 Oct |
| CVE-2026-93940 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0. | 13 Oct |
| CVE-2026-93941 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2. | 13 Oct |
| CVE-2026-93942 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0. | 13 Oct |
| CVE-2026-93943 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0. | 13 Oct |
| CVE-2026-93944 | 9.8 critical | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15. | 13 Oct |
| CVE-2026-112852 | 8.1 high | 0.00% | no CPE yet | Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12. | Sat 24 Oct |
| CVE-2026-57742 | 7.1 high | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2. | 13 Oct |
| CVE-2026-94063 | 7.1 high | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12. | 9 Oct |
50 of 50
Download these 50 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.