Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
6.5 MEDIUM
CVE-2026-77819 — Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory.

langflow_oss | Remote | Path Traversal
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
6.5 MEDIUM
CVE-2026-77817 — Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.

langflow_oss | Remote | Information Disclosure
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
5.3 MEDIUM
CVE-2026-66912 — Stored Cross-Site Scripting in Zimbra

Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote at…

zimbra_collaboration | Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
5.3 MEDIUM
CVE-2026-66911 — Stored Cross-Site Scripting in Zimbra

Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it…

zimbra_collaboration | Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62131 — WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62018 — WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62017 — WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62016 — WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62015 — WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62014 — WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62013 — WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62012 — WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62011 — WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62010 — WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62009 — WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62008 — WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62006 — WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62005 — WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62004 — WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62003 — WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
Showing 20 of 17200 Results