CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Deserialization of Untrusted Data vulnerability in the Dwell theme by ThemeREX Group allows Object Injection. This issue affects Dwell from n/a through 1.16.0.
Deserialization of Untrusted Data vulnerability in the Edema theme by ThemeREX Group allows Object Injection. This issue affects Edema from n/a through 1.2.2.2.
Deserialization of Untrusted Data vulnerability in the Greeny theme by ThemeREX Group allows Object Injection. This issue affects Greeny from n/a through 2.10.0.
Deserialization of Untrusted Data vulnerability in the Hogwords theme by ThemeREX Group allows Object Injection. This issue affects Hogwords from n/a through 1.2.7.
Deserialization of Untrusted Data vulnerability in the Hygia theme by ThemeREX Group allows Object Injection. This issue affects Hygia from n/a through 1.21.0.
Deserialization of Untrusted Data vulnerability in the IPharm theme by ThemeREX Group allows Object Injection. This issue affects IPharm from n/a through 1.2.4.
Deserialization of Untrusted Data vulnerability in the Let's Play theme by ThemeREX Group allows Object Injection. This issue affects Let's Play from n/a through 1.1.15.
The Partiso WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.1.13.
The Rosalinda WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.2.4.
The Smart Casa WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.0.12.
The Smash WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.12.0.
The Tantra WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 2.9.0.
The Travesia WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.1.16.
The Veto WordPress theme by Axiomthemes contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 1.6.0.
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler. The vulnerability is due to authorizing access based on a non-secret email address instead of the WooCommerce order_key.
The Gutentype WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 2.1.12.
The Booklovers WordPress theme by ThemeREX Group contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 2.13.0.
ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. Access control for methods within the framework is insufficient, allowing an attacker to read device-related information.
The YITH WooCommerce Affiliates plugin for WordPress is vulnerable to deserialization of untrusted data, allowing object injection. This affects all versions up to and including 3.31.0.
The WPCOM Member plugin for WordPress (versions up to and including 1.7.27) contains an authentication bypass in its social-login callback handler. Missing nonce validation, OAuth state verification, and per-visitor session namespace isolation allow an unauthenticated attacker to inject a forged session entry and log in as any WordPress user, including administrators, if their bound openid/unionid is known.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS