CVEs published October 4, 2026
64 CVEs were published on October 4, 2026: 13 critical, 13 high. 3 are now in CISA KEV.
- Published
- 64
- Critical
- 13
- High
- 13
- Medium
- 34
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 33
Most affected products
- zitadel
- 10
- kishor-23 food-waste-management-system
- 6
- Omega Solution CoinEx Crypto
- 4
- AhsayCBS
- 2
- RainyGao DocSys
- 2
- SciPhi-AI R2R
- 2
- Unlimited Elements For Elementor
- 2
- WWBN AVideo
- 2
- alexpechkarev google-maps
- 1
- CoCart
- 1
Critical 13
- CVE-2026-105222alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peeralexpechkarev google-maps
- CVE-2026-105221Gist RubyGem before 6.1.0 Disabled TLS Certificate Verificationdefunkt gist
- CVE-2026-105218gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Clientgo-pay gopay
- CVE-2026-105216go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helpergo-micro
- CVE-2026-105086WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video TitleWWBN AVideo
- CVE-2026-105089WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 TemplatesWWBN AVideo
- CVE-2026-105215ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callbackzitadel
- CVE-2026-105211ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCodezitadel
- CVE-2026-105209ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollmentzitadel
- CVE-2026-105207ZITADEL before 4.17.3 Account Takeover via External IdP Linkingzitadel
- CVE-2026-103355WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerabilityUnlimited Elements For Elementor
- CVE-2026-105135InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injectionInternLM MindSearch
- CVE-2026-105134Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injectionAhsayCBS
High 13
- CVE-2026-105220Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Filesklembot twinejs
- CVE-2026-105219Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokenisermwilliamson mammoth.js
- CVE-2026-105213ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizationszitadel
- CVE-2026-105212ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollmentzitadel
- CVE-2026-105210ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlerszitadel
- CVE-2026-105208ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokenszitadel
- CVE-2026-97307WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerabilityStylemixThemes Cost Calculator Builder
- CVE-2026-103344WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerabilityUnlimited Elements For Elementor
- CVE-2026-103062WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerabilityCozmoslabs TranslatePress
- CVE-2026-97276WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerabilityVeronaLabs WP Statistics
- CVE-2026-103354WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerabilityLiquid Web / StellarWP Gutenberg Blocks by Kadence Blocks
- CVE-2026-93549CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication BypassCoCart
- CVE-2026-88779Memory overflow vulnerability leading to Denial of ServiceNetScaler ADC · NetScaler Gateway
Medium, low and unrated 38
- CVE-2026-105171kishor-23 food-waste-management-system Role Attribute admin.php authorizationkishor-23 food-waste-management-system
- CVE-2026-105170kishor-23 food-waste-management-system Admin Signup signup.php missing authenticationkishor-23 food-waste-management-system
- CVE-2026-105169kishor-23 food-waste-management-system Take Order delivery.php sql injectionkishor-23 food-waste-management-system
- CVE-2026-105168kishor-23 food-waste-management-system Order Assignment Block admin.php sql injectionkishor-23 food-waste-management-system
- CVE-2026-105167kishor-23 food-waste-management-system donate.php sql injectionkishor-23 food-waste-management-system
- CVE-2026-105166kishor-23 food-waste-management-system Food Donation Form fooddonateform.php insert sql injectionkishor-23 food-waste-management-system
- CVE-2026-105165devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignmentdevopspolis secrets-replicator
- CVE-2026-105164NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-boundsNASA cFS
- CVE-2026-105163crossplane crossplane-runtime ImageConfig client.go Get toctoucrossplane-runtime · github.com/crossplane/crossplane-runti…
- CVE-2026-105217Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.phpcockpit-hq cockpit
- CVE-2026-105161invariant-systems-ai aiir Policy Gate signature verificationinvariant-systems-ai aiir
- CVE-2026-104402WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerabilityfarvisun Mindio Magic MCP
- CVE-2026-105224YesWiki before 4.6.7 Stored XSS via Bazar valeur Actionyeswiki
- CVE-2026-105158RainyGao DocSys Database Management BaseController.java BaseController.createDBForMysql sql injectionRainyGao DocSys
- CVE-2026-105214Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verificationzitadel
- CVE-2026-105206ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Servicezitadel
- CVE-2026-105205SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfosiyuan-note siyuan
- CVE-2026-105157RainyGao DocSys Document Controller doGetTmpFile.do DocController.doGetTmp path traversalRainyGao DocSys
- CVE-2026-105156YzmCMS MD5 system.func.php password weak password hashYzmCMS
- CVE-2026-105149mooSocial all-products sql injectionmooSocial
- CVE-2026-105148SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgerySciPhi-AI R2R
- CVE-2026-105147SciPhi-AI R2R JWT Secret hard-coded credentialsSciPhi-AI R2R
- CVE-2026-105146Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injectionComsenz Discuz!
- CVE-2026-105145Weaviate Verba generate_stream Endpoint util.py get_environment information disclosureWeaviate Verba
- CVE-2026-105144Drogon Static File Router StaticFileRouter.cc route path traversalDrogon
- CVE-2026-105141topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentialstopoteretes cognee
- CVE-2026-105137Laradock Build Process Dockerfile code downloadLaradock
- CVE-2026-97332User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)User Private Files
- CVE-2026-86817Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default CallbackFive Star Business Profile and Schema
- CVE-2026-104119Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API CredentialsSimple Shopping Cart
- CVE-2026-104118Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDORRazorpay for WooCommerce
- CVE-2026-17005Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style FieldHorizontal scrolling announcements
- CVE-2026-105133Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authenticationAhsayCBS
- CVE-2026-105099Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scriptingOmega Solution CoinEx Crypto
- CVE-2026-105098Omega Solution CoinEx Crypto Support Ticket API customer information disclosureOmega Solution CoinEx Crypto
- CVE-2026-105097Omega Solution CoinEx Crypto Customer Information API customer-currency authorizationOmega Solution CoinEx Crypto
- CVE-2026-105131mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpointmayswind ezBookkeeping
- CVE-2026-105096Omega Solution CoinEx Crypto Customer Profile API customer authorizationOmega Solution CoinEx Crypto