CVE Vulnerabilities - 4 October 2026

InternLM MindSearch remote code execution via Planner Agent

CVE-2026-105135

The Planner Agent in InternLM MindSearch can run crafted input that causes the system to execute any code it wants, and this can be triggered from outside the network. Attackers could take control of ...

9.3

Ahsay CBS lets remote attacker run commands

CVE-2026-105134

The Ahsay Cloud Backup Suite contains a flaw in its Replication Receiver feature that lets a remote attacker send specially crafted data and cause the system to run arbitrary operating system commands...

9.3 KEV

ZITADEL lets attackers hijack accounts via external login

CVE-2026-105207 GHSA-g8gj-gq47-xgf4

Versions of ZITADEL from 3.0.0 up to 4.17.2 can link a user’s account to an outside identity provider without checking who is making the change. An attacker who knows a user’s login name can attach th...

9.3

ZITADEL allows cross‑org account takeover via passkey enrollment

CVE-2026-105209 GHSA-pq2q-2c6r-75c4

Versions of ZITADEL before 3.4.15 and 4.17.1 let a user with write permission in one organization obtain a password‑less enrollment code for a user in a different organization on the same server. This...

9.3

Unlimited Elements for Elementor plugin allows database query attack

CVE-2026-103355

The free Unlimited Elements for Elementor plugin (versions up to 2.0.20) can be tricked into running unauthorized database commands. This could let an attacker view or change data behind your website ...

9.3

ZITADEL can let attackers create fake accounts linked to real users

CVE-2026-105215 GHSA-738m-7888-jfv8

If you use ZITADEL versions before 4.16.2, an attacker can trick the login page into setting up an account that appears to belong to a legitimate external identity provider. When the real user later l...

9.3

CoCart plugin lets attackers add admin accounts via API

CVE-2026-93549

The CoCart WordPress add‑on (versions 4.9.0 through 4.9.6) fails to limit its API authentication check, turning off WordPress’s built‑in protection for all API calls. This lets a malicious user exploi...

8.8

W cms lets editors upload and execute malicious PHP files

CVE-2026-105123

The W content management system up to version 3.18.0 allows users with editor rights to place files anywhere on the server by abusing the media upload function. By uploading a specially named PHP file...

8.7

AVideo video trailer can run code in browsers

CVE-2026-105089 GHSA-6wfr-c7fw-4xvw

The AVideo platform (up to version 29.2.0) lets anyone who can upload videos add a malicious trailer link. That link is shown on pages without proper safety checks, so when other users view the page t...

9.3

AVideo video titles can run malicious code

CVE-2026-105086 GHSA-q62w-927x-vhhf

In AVideo versions 12.4 through 29.2.0, users who can upload videos can place hidden code in the video title. That code is stored and later runs when anyone views pages such as trending, gallery, embe...

9.3

ZITADEL lets deactivated organization users sign in

CVE-2026-105213 GHSA-558c-v5wc-9w4q

If you run ZITADEL version earlier than 4.17.1, the system checks only the individual user, not whether the whole organization has been disabled. This means people from a shut‑down organization can st...

8.8

ZITADEL lets attackers add MFA without password

CVE-2026-105210 GHSA-72q5-mv5c-vxv4

Versions of ZITADEL before 4.17.1 (and 3.x before 3.4.15) allow an unauthenticated user to add new multi‑factor authentication methods using only a known login name. This could let an attacker replace...

8.8

ZITADEL lets attackers hijack accounts using OTP codes

CVE-2026-105211 GHSA-3gwm-5wx8-4gm6

If you use ZITADEL version earlier than 4.17.1, a flaw in its login process can let an unauthenticated person obtain the one‑time passwords sent by email or text. With those codes, the attacker can lo...

9.2

Docker CLI could allow attackers to run code

ROOT-APP-GOBINARY-CVE-2025-15558 CVE-2025-15558 GHSA-p436-gjf2-799p BIT-docker-cli-2025-15558

The Docker command‑line interface package has a flaw that could let an attacker execute unauthorized commands on the host where Docker runs. This risk is removed in the latest updated versions of the ...

7.0

Twine 2 Desktop can run malicious code from imported files

CVE-2026-105220

Twine 2 Desktop versions up to 2.12.0 allow story files to execute code when they are opened in the editor. An attacker could create a specially crafted story file that runs a batch script on the user...

8.5

ZITADEL allows session hijacking through forged login tokens

CVE-2026-105208 GHSA-jh3m-cr2x-qp88

ZITADEL versions before 4.17.3 let a logged‑in user modify their own login token so it can be used for another person's external login. This can let an attacker guess a token, race the request, and ta...

8.7

Mammoth.js allows crafted .docx to freeze server

CVE-2026-105219

Mammoth.js versions before 1.12.3 can be tricked by a specially crafted Word document that contains a malformed style map. This can cause the server running Node.js to become unresponsive, potentially...

8.7

ZITADEL allows attackers to hijack accounts via passkey enrollment

CVE-2026-105212 GHSA-45f2-5q3r-xgg6

Versions of ZITADEL before 3.4.14 and 4.16.2 let anyone who knows a user’s login name add a fake passkey during an initial login step that has not yet verified the password. This lets the attacker log...

8.7

Cost Calculator Builder plugin may leak private data

CVE-2026-97307

The Cost Calculator Builder plugin for WordPress (versions up to 4.0.17) can unintentionally include confidential information when it sends data to other systems. This could let attackers see details ...

7.5

Citrix NetScaler can crash, causing service outage

CVE-2026-88779

The Citrix NetScaler ADC and Gateway devices may stop working because of a flaw that lets attackers overload memory. This can lead to a denial of service, meaning users cannot access applications. App...

8.7 KEV

Google Maps Laravel package may expose API key

CVE-2026-105222

The alexpechkarev/google-maps package for Laravel does not check the security certificate when it talks to Google Maps. This lets a network attacker intercept the request, see the API key in the URL, ...

9.1

defunkt/gist RubyGem lets HTTPS traffic be intercepted

CVE-2026-105221 UBUNTU-CVE-2026-105221

Versions of the defunkt/gist Ruby library older than 6.1.0 do not verify the security certificates used for HTTPS connections. This means a malicious actor on the network could read or change data sen...

8.6

gopay before 1.5.119 can be tricked by fake certificates

CVE-2026-105218

The GoPay library versions earlier than 1.5.119 do not check the authenticity of the security certificates when connecting to payment services. This lets an attacker pretend to be the payment provider...

9.1

go-micro before 6.0 lets attackers spoof services

CVE-2026-105216

Versions of go-micro earlier than 6.0 do not properly check TLS certificates, so a network attacker can pretend to be a legitimate service. This can let the attacker read or change data sent between s...

9.1

LaraDashboard lets admin become superadmin

CVE-2026-105126 GHSA-555v-6rfr-r969

If you use LaraDashboard version earlier than 1.4.8, an admin who can edit roles can change their own role to superadmin or give themselves permission to log in as any user. This can let them install ...

8.6