# Latest vulnerabilities

The newest published CVEs, updated every day, with severity, exploit status and whether a fix is available yet.


- [CVE-2026-61991](https://insights.sbomify.com/CVE-2026-61991/): WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2026-84295](https://insights.sbomify.com/CVE-2026-84295/): Improper Authentication in Progress WS_FTP Server (critical 10.0)
- [CVE-2026-107327](https://insights.sbomify.com/CVE-2026-107327/): Langflow OSS is affected by multiple vulnerabilities (critical 9.9)
- [CVE-2026-107328](https://insights.sbomify.com/CVE-2026-107328/): Langflow OSS is affected by multiple vulnerabilities (critical 9.9)
- [CVE-2026-107329](https://insights.sbomify.com/CVE-2026-107329/): Langflow OSS is affected by multiple vulnerabilities (critical 9.9)
- [CVE-2026-113617](https://insights.sbomify.com/CVE-2026-113617/): Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal (critical 9.9)
- [CVE-2026-90868](https://insights.sbomify.com/CVE-2026-90868/): OS Command Injection in Progress WS_FTP Server (critical 9.9)
- [CVE-2026-104339](https://insights.sbomify.com/CVE-2026-104339/): Langflow OSS is affected by multiple vulnerabilities (critical 9.8)
- [CVE-2026-107058](https://insights.sbomify.com/CVE-2026-107058/): An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service (critical 9.8)
- [CVE-2026-109516](https://insights.sbomify.com/CVE-2026-109516/): The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions (critical 9.8)
- [CVE-2026-110186](https://insights.sbomify.com/CVE-2026-110186/): Langflow OSS is affected by multiple vulnerabilities (critical 9.8)
- [CVE-2026-113616](https://insights.sbomify.com/CVE-2026-113616/): LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset (critical 9.8)
- [CVE-2026-115245](https://insights.sbomify.com/CVE-2026-115245/): Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-42922](https://insights.sbomify.com/CVE-2026-42922/): A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). (critical 9.8)
- [CVE-2026-54856](https://insights.sbomify.com/CVE-2026-54856/): WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-54857](https://insights.sbomify.com/CVE-2026-54857/): WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-54858](https://insights.sbomify.com/CVE-2026-54858/): WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-54859](https://insights.sbomify.com/CVE-2026-54859/): WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-54860](https://insights.sbomify.com/CVE-2026-54860/): WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-61992](https://insights.sbomify.com/CVE-2026-61992/): WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-61997](https://insights.sbomify.com/CVE-2026-61997/): WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-61998](https://insights.sbomify.com/CVE-2026-61998/): WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62001](https://insights.sbomify.com/CVE-2026-62001/): WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62002](https://insights.sbomify.com/CVE-2026-62002/): WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62003](https://insights.sbomify.com/CVE-2026-62003/): WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62004](https://insights.sbomify.com/CVE-2026-62004/): WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62005](https://insights.sbomify.com/CVE-2026-62005/): WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62006](https://insights.sbomify.com/CVE-2026-62006/): WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62008](https://insights.sbomify.com/CVE-2026-62008/): WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62009](https://insights.sbomify.com/CVE-2026-62009/): WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62010](https://insights.sbomify.com/CVE-2026-62010/): WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62011](https://insights.sbomify.com/CVE-2026-62011/): WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62012](https://insights.sbomify.com/CVE-2026-62012/): WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62013](https://insights.sbomify.com/CVE-2026-62013/): WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62014](https://insights.sbomify.com/CVE-2026-62014/): WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62015](https://insights.sbomify.com/CVE-2026-62015/): WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62016](https://insights.sbomify.com/CVE-2026-62016/): WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62017](https://insights.sbomify.com/CVE-2026-62017/): WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62018](https://insights.sbomify.com/CVE-2026-62018/): WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62131](https://insights.sbomify.com/CVE-2026-62131/): WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/latest/