Threat level Severe
Contact
Critical 9.8
CVE-2026-62052

ThemeREX Tipsy — unsafe deserialization.

Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

WeaknessCWE-502: Unsafe deserialization
Published Updated Source NVD
Read vendor advisoryView on NVD
CVSS 3.1
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploit chance, 30 days
0.4%
Higher than 31% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory

What happened

Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

What to do

  1. 01Check whether you run ThemeREX Tipsy, and which version.
  2. 02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

  1. Published to NVD
  2. NVD record updated

Also actively exploited

CVE-2026-764188.6Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCVE-2026-1146259.9Arista VeloCloud OrchestratorCVE-2026-1114979.8Google Brotli
Vendor
ThemeREX66 CVEs in 30 days
All ThemeREX CVEs

Other CVEs from ThemeREX

40+ more CVEs

All ThemeREX CVEs
9.8ThemeREX Royal Event — unsafe deserialization.EPSS 0.4%9.8ThemeREX Good Homes — unsafe deserialization.EPSS 0.4%9.8ThemeREX Gunslinger — unsafe deserialization.EPSS 0.4%9.8ThemeREX Edge Decor — unsafe deserialization.EPSS 0.4%9.8ThemeREX EmojiNation — unsafe deserialization.EPSS 0.4%9.8ThemeREX Gamezone — unsafe deserialization.EPSS 0.4%