CVE-2026-2806
Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
PUBLISHED
- Vendor
- Mozilla, Mozilla
- Product
- Thunderbird, Firefox
- Provider severity
- CRITICAL
- Conflicts
- 1
Data & Insights
CVE Explorer
Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Exact snapshot results
353,537 CVE records
CVE-2026-28059
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Dermatology Clinic dermatology-clinic allows PHP Local File Inclusion.This issue affects Dermatology Clinic: from n/a through <= 1.4.3.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Dermatology Clinic
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28058
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Dixon dixon allows PHP Local File Inclusion.This issue affects Dixon: from n/a through <= 1.4.2.1.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Dixon
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28057
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Mandala mandala allows PHP Local File Inclusion.This issue affects Mandala: from n/a through <= 2.8.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Mandala
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28056
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX MCKinney's Politics mckinney-politics allows PHP Local File Inclusion.This issue affects MCKinney's Politics: from n/a through <= 1.2.8.
PUBLISHED
- Vendor
- ThemeREX
- Product
- MCKinney's Politics
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28055
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX M.Williamson williamson allows PHP Local File Inclusion.This issue affects M.Williamson: from n/a through <= 1.2.11.
PUBLISHED
- Vendor
- ThemeREX
- Product
- M.Williamson
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28054
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Legal Stone legal-stone allows PHP Local File Inclusion.This issue affects Legal Stone: from n/a through <= 1.2.11.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Legal Stone
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28053
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Miller christine-miller allows PHP Local File Inclusion.This issue affects Miller: from n/a through <= 1.3.3.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Miller
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28052
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Peter Mason petermason allows PHP Local File Inclusion.This issue affects Peter Mason: from n/a through <= 1.4.5.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Peter Mason
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28051
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Yacht Rental yacht-rental allows PHP Local File Inclusion.This issue affects Yacht Rental: from n/a through <= 2.6.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Yacht Rental
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28050
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Beacon beacon allows PHP Local File Inclusion.This issue affects Beacon: from n/a through <= 2.24.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Beacon
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-2805
Invalid pointer in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
PUBLISHED
- Vendor
- Mozilla, Mozilla
- Product
- Firefox, Thunderbird
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-28049
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Police Department police-department allows PHP Local File Inclusion.This issue affects Police Department: from n/a through <= 2.17.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Police Department
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28048
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech FlashMart flashmart allows PHP Local File Inclusion.This issue affects FlashMart: from n/a through <= 2.0.15.
PUBLISHED
- Vendor
- magentech
- Product
- FlashMart
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28047
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Victo victo allows PHP Local File Inclusion.This issue affects Victo: from n/a through <= 1.4.16.
PUBLISHED
- Vendor
- magentech
- Product
- Victo
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28046
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Law Office law-office allows PHP Local File Inclusion.This issue affects Law Office: from n/a through <= 3.3.0.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Law Office
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28045
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX N7 | Golf Club Sports & Events n7-golf-club allows PHP Local File Inclusion.This issue affects N7 | Golf Club Sports & Events: from n/a through <= 2.16.0.
PUBLISHED
- Vendor
- ThemeREX
- Product
- N7 | Golf Club Sports & Events
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28044
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media WP Rocket allows Stored XSS.This issue affects WP Rocket: from n/a through 3.19.4.
PUBLISHED
- Vendor
- WP Media
- Product
- WP Rocket
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-28043
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Healer - Doctor, Clinic & Medical WordPress Theme healer allows PHP Local File Inclusion.This issue affects Healer - Doctor, Clinic & Medical WordPress Theme: from n/a through <= 1.0.0.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Healer - Doctor, Clinic & Medical WordPress Theme
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-28042
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Listify listify allows Reflected XSS.This issue affects Listify: from n/a through <= 3.2.5.
PUBLISHED
- Vendor
- Astoundify
- Product
- Listify
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28041
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Grit grit allows PHP Local File Inclusion.This issue affects Grit: from n/a through <= 1.0.1.
PUBLISHED
- Vendor
- AncoraThemes
- Product
- Grit
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28040
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Stored XSS.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.0.0.
PUBLISHED
- Vendor
- Magepeople inc.
- Product
- Taxi Booking Manager for WooCommerce
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-2804
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
PUBLISHED
- Vendor
- Mozilla, Mozilla
- Product
- Firefox, Thunderbird
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-28039
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpDataTables wpDataTables wpdatatables allows PHP Local File Inclusion.This issue affects wpDataTables: from n/a through <= 6.5.0.1.
PUBLISHED
- Vendor
- wpDataTables
- Product
- wpDataTables
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28038
Missing Authorization vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through <= 3.21.1.
PUBLISHED
- Vendor
- Brainstorm_Force
- Product
- Ultimate Addons for WPBakery Page Builder
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-28037
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON eventon allows Reflected XSS.This issue affects EventON: from n/a through <= 4.9.12.
PUBLISHED
- Vendor
- ashanjay
- Product
- EventON
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28036
Server-Side Request Forgery (SSRF) vulnerability in SkatDesign Ratatouille ratatouille allows Server Side Request Forgery.This issue affects Ratatouille: from n/a through <= 1.2.6.
PUBLISHED
- Vendor
- SkatDesign
- Product
- Ratatouille
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-28035
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Printy printy allows PHP Local File Inclusion.This issue affects Printy: from n/a through <= 1.8.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Printy
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28034
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Progress progress allows PHP Local File Inclusion.This issue affects Progress: from n/a through <= 1.2.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Progress
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28033
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Edifice edifice allows PHP Local File Inclusion.This issue affects Edifice: from n/a through <= 1.8.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Edifice
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28032
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Tuning tuning allows PHP Local File Inclusion.This issue affects Tuning: from n/a through <= 1.3.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Tuning
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28031
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Invetex invetex allows PHP Local File Inclusion.This issue affects Invetex: from n/a through <= 2.18.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Invetex
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28030
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Bonbon bonbon allows PHP Local File Inclusion.This issue affects Bonbon: from n/a through <= 1.6.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Bonbon
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-2803
Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
PUBLISHED
- Vendor
- Mozilla, Mozilla
- Product
- Firefox, Thunderbird
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-28029
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX EmojiNation emojination allows PHP Local File Inclusion.This issue affects EmojiNation: from n/a through <= 1.0.12.
PUBLISHED
- Vendor
- ThemeREX
- Product
- EmojiNation
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28028
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX MoneyFlow moneyflow allows PHP Local File Inclusion.This issue affects MoneyFlow: from n/a through <= 1.0.
PUBLISHED
- Vendor
- ThemeREX
- Product
- MoneyFlow
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28027
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Kayon kayon allows PHP Local File Inclusion.This issue affects Kayon: from n/a through <= 1.3.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Kayon
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28026
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Motorix motorix allows PHP Local File Inclusion.This issue affects Motorix: from n/a through <= 1.6.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Motorix
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28025
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Stargaze stargaze allows PHP Local File Inclusion.This issue affects Stargaze: from n/a through <= 1.5.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Stargaze
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28024
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Helion helion allows PHP Local File Inclusion.This issue affects Helion: from n/a through <= 1.1.12.
PUBLISHED
- Vendor
- axiomthemes
- Product
- Helion
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28023
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Nuts nuts allows PHP Local File Inclusion.This issue affects Nuts: from n/a through <= 1.10.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Nuts
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28022
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Foodie foodie allows PHP Local File Inclusion.This issue affects Foodie: from n/a through <= 1.14.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Foodie
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28021
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Craftis craftis allows PHP Local File Inclusion.This issue affects Craftis: from n/a through <= 1.2.8.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Craftis
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28020
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Chroma chroma allows PHP Local File Inclusion.This issue affects Chroma: from n/a through <= 1.11.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Chroma
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-2802
Race condition in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
PUBLISHED
- Vendor
- Mozilla, Mozilla
- Product
- Firefox, Thunderbird
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-28019
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Manoir manoir allows PHP Local File Inclusion.This issue affects Manoir: from n/a through <= 1.11.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Manoir
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28018
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Global Logistics globallogistics allows PHP Local File Inclusion.This issue affects Global Logistics: from n/a through <= 3.20.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Global Logistics
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28017
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Green Thumb greenthumb allows PHP Local File Inclusion.This issue affects Green Thumb: from n/a through <= 1.1.12.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Green Thumb
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28016
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Luxury Wine luxury-wine allows PHP Local File Inclusion.This issue affects Luxury Wine: from n/a through <= 1.1.14.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Luxury Wine
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28015
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX ShiftCV shift-cv allows PHP Local File Inclusion.This issue affects ShiftCV: from n/a through <= 3.0.14.
PUBLISHED
- Vendor
- ThemeREX
- Product
- ShiftCV
- Provider severity
- HIGH
- Conflicts
- 0