# CVEs published 2026-10-04

64 CVEs were published on October 4, 2026: 13 critical, 13 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2026-105171](https://cve.now/CVE-2026-105171.md): kishor-23 food-waste-management-system Role Attribute admin.php authorization (CVSS 5.3, kishor-23 food-waste-management-system)
- [CVE-2026-105170](https://cve.now/CVE-2026-105170.md): kishor-23 food-waste-management-system Admin Signup signup.php missing authentication (CVSS 6.9, kishor-23 food-waste-management-system)
- [CVE-2026-105169](https://cve.now/CVE-2026-105169.md): kishor-23 food-waste-management-system Take Order delivery.php sql injection (CVSS 6.9, kishor-23 food-waste-management-system)
- [CVE-2026-105168](https://cve.now/CVE-2026-105168.md): kishor-23 food-waste-management-system Order Assignment Block admin.php sql injection (CVSS 5.3, kishor-23 food-waste-management-system)
- [CVE-2026-105167](https://cve.now/CVE-2026-105167.md): kishor-23 food-waste-management-system donate.php sql injection (CVSS 6.9, kishor-23 food-waste-management-system)
- [CVE-2026-105222](https://cve.now/CVE-2026-105222.md): alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl\_verify\_peer (CVSS 9.1, alexpechkarev google-maps)
- [CVE-2026-105221](https://cve.now/CVE-2026-105221.md): Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification (CVSS 9.1, defunkt gist)
- [CVE-2026-105220](https://cve.now/CVE-2026-105220.md): Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files (CVSS 8.5, klembot twinejs)
- [CVE-2026-105166](https://cve.now/CVE-2026-105166.md): kishor-23 food-waste-management-system Food Donation Form fooddonateform.php insert sql injection (CVSS 6.9, kishor-23 food-waste-management-system)
- [CVE-2026-105165](https://cve.now/CVE-2026-105165.md): devopspolis secrets-replicator AssumeRole handler.py process\_single\_secret permission assignment (CVSS 5.3, devopspolis secrets-replicator)
- [CVE-2026-105164](https://cve.now/CVE-2026-105164.md): NASA cFS cfe\_fs\_api.c CFE\_FS\_ParseInputFileNameEx out-of-bounds (CVSS 5.1, NASA cFS)
- [CVE-2026-105163](https://cve.now/CVE-2026-105163.md): crossplane crossplane-runtime ImageConfig client.go Get toctou (CVSS 6.9, crossplane-runtime · github.com/crossplane/crossplane-runti…)
- [CVE-2026-105219](https://cve.now/CVE-2026-105219.md): Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser (CVSS 8.7, mwilliamson mammoth.js)
- [CVE-2026-105218](https://cve.now/CVE-2026-105218.md): gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client (CVSS 9.1, go-pay gopay)
- [CVE-2026-105217](https://cve.now/CVE-2026-105217.md): Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php (CVSS 2.3, cockpit-hq cockpit)
- [CVE-2026-105216](https://cve.now/CVE-2026-105216.md): go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper (CVSS 9.1, go-micro)
- [CVE-2026-105161](https://cve.now/CVE-2026-105161.md): invariant-systems-ai aiir Policy Gate signature verification (CVSS 6.9, invariant-systems-ai aiir)
- [CVE-2026-105086](https://cve.now/CVE-2026-105086.md): WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title (CVSS 9.3, WWBN AVideo)
- [CVE-2026-104402](https://cve.now/CVE-2026-104402.md): WordPress Mindio Magic MCP plugin \<= 0.5.6 - Sensitive Data Exposure vulnerability (CVSS 4.3, farvisun Mindio Magic MCP)
- [CVE-2026-105224](https://cve.now/CVE-2026-105224.md): YesWiki before 4.6.7 Stored XSS via Bazar valeur Action (CVSS 5.1, yeswiki)
- [CVE-2026-105089](https://cve.now/CVE-2026-105089.md): WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates (CVSS 9.3, WWBN AVideo)
- [CVE-2026-105158](https://cve.now/CVE-2026-105158.md): RainyGao DocSys Database Management BaseController.java BaseController.createDBForMysql sql injection (CVSS 6.9, RainyGao DocSys)
- [CVE-2026-105215](https://cve.now/CVE-2026-105215.md): ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback (CVSS 9.3, zitadel)
- [CVE-2026-105214](https://cve.now/CVE-2026-105214.md): Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification (CVSS 2.3, zitadel)
- [CVE-2026-105213](https://cve.now/CVE-2026-105213.md): ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations (CVSS 8.8, zitadel)
- [CVE-2026-105212](https://cve.now/CVE-2026-105212.md): ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment (CVSS 8.7, zitadel)
- [CVE-2026-105211](https://cve.now/CVE-2026-105211.md): ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode (CVSS 9.2, zitadel)
- [CVE-2026-105210](https://cve.now/CVE-2026-105210.md): ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers (CVSS 8.8, zitadel)
- [CVE-2026-105209](https://cve.now/CVE-2026-105209.md): ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment (CVSS 9.3, zitadel)
- [CVE-2026-105208](https://cve.now/CVE-2026-105208.md): ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens (CVSS 8.7, zitadel)
- [CVE-2026-105207](https://cve.now/CVE-2026-105207.md): ZITADEL before 4.17.3 Account Takeover via External IdP Linking (CVSS 9.3, zitadel)
- [CVE-2026-105206](https://cve.now/CVE-2026-105206.md): ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service (CVSS 5.3, zitadel)
- [CVE-2026-105205](https://cve.now/CVE-2026-105205.md): SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo (CVSS 6.9, siyuan-note siyuan)
- [CVE-2026-105157](https://cve.now/CVE-2026-105157.md): RainyGao DocSys Document Controller doGetTmpFile.do DocController.doGetTmp path traversal (CVSS 5.3, RainyGao DocSys)
- [CVE-2026-105156](https://cve.now/CVE-2026-105156.md): YzmCMS MD5 system.func.php password weak password hash (CVSS 6.3, YzmCMS)
- [CVE-2026-105149](https://cve.now/CVE-2026-105149.md): mooSocial all-products sql injection (CVSS 6.9, mooSocial)
- [CVE-2026-105148](https://cve.now/CVE-2026-105148.md): SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery (CVSS 6.9, SciPhi-AI R2R)
- [CVE-2026-105147](https://cve.now/CVE-2026-105147.md): SciPhi-AI R2R JWT Secret hard-coded credentials (CVSS 6.9, SciPhi-AI R2R)
- [CVE-2026-105146](https://cve.now/CVE-2026-105146.md): Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection (CVSS 5.1, Comsenz Discuz!)
- [CVE-2026-97307](https://cve.now/CVE-2026-97307.md): WordPress Cost Calculator Builder plugin \<= 4.0.17 - Sensitive Data Exposure vulnerability (CVSS 7.5, StylemixThemes Cost Calculator Builder)
- [CVE-2026-105145](https://cve.now/CVE-2026-105145.md): Weaviate Verba generate\_stream Endpoint util.py get\_environment information disclosure (CVSS 6.9, Weaviate Verba)
- [CVE-2026-103355](https://cve.now/CVE-2026-103355.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.20 - SQL Injection vulnerability (CVSS 9.3, Unlimited Elements For Elementor)
- [CVE-2026-103344](https://cve.now/CVE-2026-103344.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.20 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Unlimited Elements For Elementor)
- [CVE-2026-105144](https://cve.now/CVE-2026-105144.md): Drogon Static File Router StaticFileRouter.cc route path traversal (CVSS 6.9, Drogon)
- [CVE-2026-105141](https://cve.now/CVE-2026-105141.md): topoteretes cognee JWT Signing Key get\_api\_auth\_backend.py get\_user\_id\_by\_email hard-coded credentials (CVSS 5.3, topoteretes cognee)
- [CVE-2026-105137](https://cve.now/CVE-2026-105137.md): Laradock Build Process Dockerfile code download (CVSS 2.3, Laradock)
- [CVE-2026-103062](https://cve.now/CVE-2026-103062.md): WordPress TranslatePress plugin \<= 3.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Cozmoslabs TranslatePress)
- [CVE-2026-97276](https://cve.now/CVE-2026-97276.md): WordPress WP Statistics plugin \<= 14.16.14 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, VeronaLabs WP Statistics)
- [CVE-2026-103354](https://cve.now/CVE-2026-103354.md): WordPress Gutenberg Blocks by Kadence Blocks plugin \<= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks)
- [CVE-2026-105135](https://cve.now/CVE-2026-105135.md): InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection (CVSS 10.0, InternLM MindSearch)
- [CVE-2026-97332](https://cve.now/CVE-2026-97332.md): User Private Files \< 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite) (CVSS 5.3, User Private Files)
- [CVE-2026-93549](https://cve.now/CVE-2026-93549.md): CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass (CVSS 8.8, CoCart)
- [CVE-2026-86817](https://cve.now/CVE-2026-86817.md): Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback (CVSS 4.9, Five Star Business Profile and Schema)
- [CVE-2026-104119](https://cve.now/CVE-2026-104119.md): Simple Shopping Cart \< 5.2.6 - Admin+ Stored XSS via PayPal API Credentials (CVSS 3.5, Simple Shopping Cart)
- [CVE-2026-104118](https://cve.now/CVE-2026-104118.md): Razorpay for WooCommerce \< 4.8.8 - Unauthenticated Order Shipping Modification via IDOR (CVSS 5.3, Razorpay for WooCommerce)
- [CVE-2026-17005](https://cve.now/CVE-2026-17005.md): Horizontal Scrolling Announcements \<= 2.6 - Contributor+ Stored XSS via Style Field (CVSS 6.8, Horizontal scrolling announcements)
- [CVE-2026-105134](https://cve.now/CVE-2026-105134.md): Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection (CVSS 10.0, KEV, AhsayCBS)
- [CVE-2026-105133](https://cve.now/CVE-2026-105133.md): Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication (CVSS 6.9, KEV, AhsayCBS)
- [CVE-2026-105099](https://cve.now/CVE-2026-105099.md): Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting (CVSS 5.1, Omega Solution CoinEx Crypto)
- [CVE-2026-105098](https://cve.now/CVE-2026-105098.md): Omega Solution CoinEx Crypto Support Ticket API customer information disclosure (CVSS 5.3, Omega Solution CoinEx Crypto)
- [CVE-2026-88779](https://cve.now/CVE-2026-88779.md): Memory overflow vulnerability leading to Denial of Service (CVSS 8.7, KEV, NetScaler ADC · NetScaler Gateway)
- [CVE-2026-105097](https://cve.now/CVE-2026-105097.md): Omega Solution CoinEx Crypto Customer Information API customer-currency authorization (CVSS 5.3, Omega Solution CoinEx Crypto)
- [CVE-2026-105131](https://cve.now/CVE-2026-105131.md): mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint (CVSS 5.3, mayswind ezBookkeeping)
- [CVE-2026-105096](https://cve.now/CVE-2026-105096.md): Omega Solution CoinEx Crypto Customer Profile API customer authorization (CVSS 5.3, Omega Solution CoinEx Crypto)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.