newsThe portal itself — self-promo until real sponsors land
Subscribe, build a custom feed, or pitch a sponsorship at hello@acadenix.com
Latest intel// live feed
25 results//sorted by published//last sync 2026-07-05 08:01Z
Subscribe to news →
CVE-2026-27079 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Amfissa amfissa allows PHP Local File Inclusion.This issue affects Amfissa: from n/a through <= 1.1. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2026-27078 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Emaurri emaurri allows PHP Local File Inclusion.This issue affects Emaurri: from n/a through <= 1.0.1. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2026-27077 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes MultiOffice multioffice allows PHP Local File Inclusion.This issue affects MultiOffice: from n/a through <= 1.2. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2026-27076 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes LuxeDrive luxedrive allows PHP Local File Inclusion.This issue affects LuxeDrive: from n/a through <= 1.0. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2026-27075 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Belfort belfort allows PHP Local File Inclusion.This issue affects Belfort: from n/a through <= 1.0. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2026-27071 — Authorization: Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security
Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 3.0.7. CVSSv3.1 9.1 (CRITICAL) · EPSS 16th percentile
9.1
CVSS v3.1
96
Edit Score
CVE-2026-27051 — Incorrect: Privilege Assignment vulnerability in uxper Golo golo allows Privilege Escalation.This issue affects Golo
Incorrect Privilege Assignment vulnerability in uxper Golo golo allows Privilege Escalation.This issue affects Golo: from n/a through <= 1.7.0. CVSSv3.1 9.8 (CRITICAL) · EPSS 17th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2026-27049 — Authentication: Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobica Core jobica-core
Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobica Core jobica-core allows Authentication Abuse.This issue affects Jobica Core: from n/a through <= 1.4.2. CVSSv3.1 9.8 (CRITICAL) · EPSS 21th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2026-27048 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes The Aisle Core theaisle-core allows PHP Local File Inclusion.This issue affects The Aisle Core: from n/a through <= 2.0.5. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2026-27047 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Curly Core curly-core allows PHP Local File Inclusion.This issue affects Curly Core: from n/a through <= 2.1.6. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2026-27045 — Deserialization: of Untrusted Data vulnerability in sbthemes WooCommerce Infinite Scroll sb-woocommerce-infinite-scroll allows Object Injection.This
Deserialization of Untrusted Data vulnerability in sbthemes WooCommerce Infinite Scroll sb-woocommerce-infinite-scroll allows Object Injection.This issue affects WooCommerce Infinite Scroll: from n/a through <= 1.6.2. CVSSv3.1 8.8 (HIGH) · EPSS 17th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2026-27044 — Control: Improper Control of Generation of Code ('Code Injection') vulnerability in TotalSuite Total Poll Lite
Improper Control of Generation of Code ('Code Injection') vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Remote Code Inclusion.This issue affects Total Poll Lite: from n/a through <= 4.12.0. CVSSv3.1 9.9 (CRITICAL) · EPSS 17th percentile
9.9
CVSS v3.1
100
Edit Score
CVE-2026-27040 — Limitation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AA-Team
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AA-Team WZone woozone allows Path Traversal.This issue affects WZone: from n/a through <= 14.0.31. CVSSv3.1 8.8 (HIGH) · EPSS 16th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2026-27039 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone woozone allows Blind SQL Injection.This issue affects WZone: from n/a through <= 14.0.31. CVSSv3.1 8.5 (HIGH) · EPSS 10th percentile
8.5
CVSS v3.1
93
Edit Score
CVE-2026-25464 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah jannah allows PHP Local File Inclusion.This issue affects Jannah: from n/a through <= 7.6.4. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2026-25458 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Moments moments allows PHP Local File Inclusion.This issue affects Moments: from n/a through <= 2.2. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2026-25457 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Mixtape mixtape allows PHP Local File Inclusion.This issue affects Mixtape: from n/a through <= 2.1. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2026-25447 — Control: Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler
Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler widget-wrangler allows Code Injection.This issue affects Widget Wrangler: from n/a through <= 2.3.9. CVSSv3.1 9.1 (CRITICAL) · EPSS 18th percentile
9.1
CVSS v3.1
96
Edit Score
CVE-2026-25429 — Deserialization: of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue
Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1. CVSSv3.1 9.8 (CRITICAL) · EPSS 17th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2026-25414 — Incorrect: Privilege Assignment vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Privilege Escalation.This issue affects
Incorrect Privilege Assignment vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Privilege Escalation.This issue affects WPBookit Pro: from n/a through <= 1.6.18. CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2026-25413 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows
Unrestricted Upload of File with Dangerous Type vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Using Malicious Files.This issue affects WPBookit Pro: from n/a through <= 1.6.18. CVSSv3.1 9.9 (CRITICAL) · EPSS 15th percentile
9.9
CVSS v3.1
100
Edit Score
CVE-2026-25406 — Authentication: Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor LMS Pro: from n/a through <= 3.9.4. CVSSv3.1 8.1 (HIGH) · EPSS 18th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2026-25400 — Deserialization: of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects
Deserialization of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects Apicona: from n/a through <= 24.1.0. CVSSv3.1 8.8 (HIGH) · EPSS 17th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2026-25382 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes IdealAuto idealauto allows PHP Local File Inclusion.This issue affects IdealAuto: from n/a through < 3.8.6. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2026-25381 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes LoveDate lovedate allows PHP Local File Inclusion.This issue affects LoveDate: from n/a through < 3.8.6. CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile
8.1
CVSS v3.1
91
Edit Score