CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Deserialization of Untrusted Data vulnerability in the Camelia theme by ThemeREX Group allows Object Injection. This issue affects Camelia from n/a through 1.2.15.
Deserialization of Untrusted Data vulnerability in the Convex theme by ThemeREX Group allows Object Injection. This issue affects Convex from n/a through 1.16.0.
Deserialization of Untrusted Data vulnerability in the Dwell theme by ThemeREX Group allows Object Injection. This issue affects Dwell from n/a through 1.16.0.
Deserialization of Untrusted Data vulnerability in the Edema theme by ThemeREX Group allows Object Injection. This issue affects Edema from n/a through 1.2.2.2.
Deserialization of Untrusted Data vulnerability in the Greeny theme by ThemeREX Group allows Object Injection. This issue affects Greeny from n/a through 2.10.0.
Deserialization of Untrusted Data vulnerability in the Hogwords theme by ThemeREX Group allows Object Injection. This issue affects Hogwords from n/a through 1.2.7.
Deserialization of Untrusted Data vulnerability in the Hygia theme by ThemeREX Group allows Object Injection. This issue affects Hygia from n/a through 1.21.0.
Deserialization of Untrusted Data vulnerability in the IPharm theme by ThemeREX Group allows Object Injection. This issue affects IPharm from n/a through 1.2.4.
Deserialization of Untrusted Data vulnerability in the Let's Play theme by ThemeREX Group allows Object Injection. This issue affects Let's Play from n/a through 1.1.15.
The Partiso WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.1.13.
The Rosalinda WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.2.4.
The Smart Casa WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.0.12.
The Smash WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.12.0.
The Tantra WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 2.9.0.
The Travesia WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.1.16.
The Veto WordPress theme by Axiomthemes contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.6.0.
The Gutentype WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 2.1.12.
The Booklovers WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 2.13.0.
The WPCOM Member plugin for WordPress (versions up to and including 1.7.27) contains an authentication bypass in its social-login callback handler. Missing nonce validation, OAuth state verification, and per-visitor session namespace isolation allow an unauthenticated attacker to inject a forged session entry and log in as any WordPress user, including administrators, if their bound openid/unionid is known.
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to and including 34.0.10. Unauthenticated attackers can delete arbitrary files on the server, potentially leading to remote code execution, and relocated files are publicly accessible in the wp-content/uploads/ppom_files/confirmed/ directory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS