Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-62131 RCE | WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability | 9.8 CRITICAL | Zoho Flow Zoho Flow | NVD, CVE.org | |
| CVE-2026-62017 RCE | WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Good Homes | NVD, CVE.org | |
| CVE-2026-62016 RCE | WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Gamic | NVD, CVE.org | |
| CVE-2026-62014 RCE | WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX EmojiNation | NVD, CVE.org | |
| CVE-2026-62015 RCE | WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Gamezone | NVD, CVE.org | |
| CVE-2026-62013 RCE | WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Edge Decor | NVD, CVE.org | |
| CVE-2026-62012 RCE | WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Coinpress | NVD, CVE.org | |
| CVE-2026-62010 RCE | WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Avventure | NVD, CVE.org | |
| CVE-2026-62011 RCE | WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Bonbon | NVD, CVE.org | |
| CVE-2026-62009 RCE | WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Filmax | NVD, CVE.org | |
| CVE-2026-62008 RCE | WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Orpheus | NVD, CVE.org | |
| CVE-2026-62005 RCE | WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Muzicon | NVD, CVE.org | |
| CVE-2026-62006 RCE | WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Nuts | NVD, CVE.org | |
| CVE-2026-62004 RCE | WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Motorix | NVD, CVE.org | |
| CVE-2026-62003 RCE | WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Mission | NVD, CVE.org | |
| CVE-2026-62001 RCE | WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Marcell | NVD, CVE.org | |
| CVE-2026-62002 RCE | WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Meals & Wheels | NVD, CVE.org | |
| CVE-2026-61998 RCE | WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Le Truffe | NVD, CVE.org | |
| CVE-2026-61997 RCE | WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Legal Stone | NVD, CVE.org | |
| CVE-2026-61996 Lộ dữ liệu | WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability | 8.5 HIGH | favethemes MLS On The Fly | NVD, CVE.org | |
| CVE-2026-61992 RCE | WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability | 9.8 CRITICAL | Von Eyal Fitoussi GEO my WordPress | NVD, CVE.org | |
| CVE-2026-61991 RCE | WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability | 10.0 CRITICAL | Ajax Load More AjaxLoadMore Cache | NVD, CVE.org | |
| CVE-2026-54860 RCE | WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Ozisti | NVD, CVE.org | |
| CVE-2026-54859 RCE | WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Preservation | NVD, CVE.org | |
| CVE-2026-54858 RCE | WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Printy | NVD, CVE.org | |
| CVE-2026-54856 RCE | WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX RexCoin | NVD, CVE.org | |
| CVE-2026-54857 RCE | WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Quirky | NVD, CVE.org | |
| CVE-2026-85899 RCE Truy cập trái phép | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | 8.1 HIGH | Microsoft Microsoft Edge (Chromium-based) | NVD, CVE.org | |
| CVE-2026-96203 RCE Truy cập trái phép | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | 8.8 HIGH | Microsoft Microsoft Edge (Chromium-based) | NVD, CVE.org | |
| CVE-2026-96192 RCE | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 8.8 HIGH | Microsoft Microsoft Edge (Chromium-based), microsoft edge | NVD, CVE.org | |
| CVE-2026-18894 RCE | Langflow OSS is affected by multiple vulnerabilities | 9.8 CRITICAL | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-101288 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-104317 RCE | Langflow OSS is affected by multiple vulnerabilities | 9.8 CRITICAL | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-104324 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-104328 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-104339 RCE | Langflow OSS is affected by multiple vulnerabilities | 9.8 CRITICAL | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-107326 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-107327 RCE Truy cập trái phép | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-107328 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-107329 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-110186 RCE | Langflow OSS is affected by multiple vulnerabilities | 9.8 CRITICAL | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-110193 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-110196 RCE Truy cập trái phép | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-110309 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-96198 RCE | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 8.8 HIGH | Microsoft Microsoft Edge (Chromium-based) | NVD, CVE.org | |
| CVE-2026-96199 RCE | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 8.8 HIGH | Microsoft Microsoft Edge (Chromium-based) | NVD, CVE.org | |
| CVE-2026-85897 RCE | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 8.8 HIGH | Microsoft Microsoft Edge (Chromium-based) | NVD, CVE.org | |
| CVE-2026-85890 RCE | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 8.8 HIGH | Microsoft Microsoft Edge (Chromium-based) | NVD, CVE.org | |
| CVE-2026-93570 Lộ dữ liệu | XML External Entity injection in Szafir and Szafir Weryfikująca | 8.2 HIGH | Krajowa Izba Rozliczeniowa Szafir, Krajowa Izba Rozliczeniowa Szafir Weryfikująca | NVD, CVE.org | |
| CVE-2026-115709 Lộ dữ liệu | Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss | 8.2 HIGH | Elastic Elastic Cloud Enterprise | NVD, CVE.org |