CVE Vulnerabilities - 4 October 2026

The Planner Agent in InternLM MindSearch can run crafted input that causes the system to execute any code it wants, and this can be triggered from outside the network. Attackers could take control of ...

The Ahsay Cloud Backup Suite contains a flaw in its Replication Receiver feature that lets a remote attacker send specially crafted data and cause the system to run arbitrary operating system commands...

Versions of ZITADEL from 3.0.0 up to 4.17.2 can link a user’s account to an outside identity provider without checking who is making the change. An attacker who knows a user’s login name can attach th...

Versions of ZITADEL before 3.4.15 and 4.17.1 let a user with write permission in one organization obtain a password‑less enrollment code for a user in a different organization on the same server. This...

The free Unlimited Elements for Elementor plugin (versions up to 2.0.20) can be tricked into running unauthorized database commands. This could let an attacker view or change data behind your website ...

If you use ZITADEL versions before 4.16.2, an attacker can trick the login page into setting up an account that appears to belong to a legitimate external identity provider. When the real user later l...

The AVideo platform (up to version 29.2.0) lets anyone who can upload videos add a malicious trailer link. That link is shown on pages without proper safety checks, so when other users view the page t...

In AVideo versions 12.4 through 29.2.0, users who can upload videos can place hidden code in the video title. That code is stored and later runs when anyone views pages such as trending, gallery, embe...

If you use ZITADEL version earlier than 4.17.1, a flaw in its login process can let an unauthenticated person obtain the one‑time passwords sent by email or text. With those codes, the attacker can lo...

The alexpechkarev/google-maps package for Laravel does not check the security certificate when it talks to Google Maps. This lets a network attacker intercept the request, see the API key in the URL, ...

The GoPay library versions earlier than 1.5.119 do not check the authenticity of the security certificates when connecting to payment services. This lets an attacker pretend to be the payment provider...

Versions of go-micro earlier than 6.0 do not properly check TLS certificates, so a network attacker can pretend to be a legitimate service. This can let the attacker read or change data sent between s...