Explore CVE records

HighPublished 23 Oct 2026, 20:00 WIB

CVE-2026-112850

WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:46 WIB

Official record

CritPublished 23 Oct 2026, 20:00 WIB

CVE-2026-112854

WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.

Excerpt language: en.

CritPublished 23 Oct 2026, 20:00 WIB

CVE-2026-112847

WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:46 WIB

Official record

CritPublished 23 Oct 2026, 20:00 WIB

CVE-2026-112846

WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:47 WIB

Official record

CritPublished 23 Oct 2026, 20:00 WIB

CVE-2026-112851

WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:47 WIB

Official record

HighPublished 23 Oct 2026, 20:00 WIB

CVE-2026-112852

WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:47 WIB

Official record

CritPublished 23 Oct 2026, 20:00 WIB

CVE-2026-112853

WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:59 WIB

Official record

CritPublished 23 Oct 2026, 20:00 WIB

CVE-2026-112856

WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:47 WIB

Official record

CritPublished 23 Oct 2026, 20:00 WIB

CVE-2026-112857

WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:59 WIB

Official record

CritPublished 23 Oct 2026, 20:00 WIB

CVE-2026-112858

WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:47 WIB

Official record

CritPublished 23 Oct 2026, 20:00 WIB

CVE-2026-112859

WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:47 WIB

Official record

CritPublished 23 Oct 2026, 20:00 WIB

CVE-2026-112855

WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:47 WIB

Official record

HighPublished 23 Oct 2026, 20:00 WIB

CVE-2026-112863

WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:46 WIB

Official record

LowPublished 23 Oct 2026, 19:55 WIB

CVE-2026-115730

i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translation…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:19 WIB

Official record

HighPublished 23 Oct 2026, 19:55 WIB

CVE-2026-115729

@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata resp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:55 WIB

Official record

HighPublished 23 Oct 2026, 19:55 WIB

CVE-2026-115728

@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 02:58 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:45 WIB

CVE-2026-99087

dm-integrity: fix NULL pointer dereference when the 'R' flag is used

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the user activates the device in the 'R' mode, a crash in dm_integrity_resume happens because the function attem…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:45 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:45 WIB

CVE-2026-99086

dm-integrity: validate the superblock on resume

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dm_integrity_resume() re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructor validates the sup…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:45 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:45 WIB

CVE-2026-99085

sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in sched_cpu_wait_empty() until nothing else is left, and the only thing that wakes it is balance_pus…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:45 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:45 WIB

CVE-2026-99084

readdir: take no inode lock on an immutable directory

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iterate_dir() takes the directory's i_rwsem shared and holds it across ->iterate_shared(). For a directory that never has an entry and is never removed the lock keeps nothing still, it only orders…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:45 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage