CVE Vulnerabilities - 4 October 2026

The Customer Profile API in Omega Solution CoinEx Crypto can be tricked by changing the ID parameter, letting attackers bypass login checks. This can be done from anywhere on the internet, and the fla...

Versions of Laradock up to 20.4 contain a Dockerfile step that fetches code without checking its integrity, which could let a remote attacker supply malicious files. While exploiting this requires sig...

The admin medal management page in Discuz! X5 can be tricked into running unintended database commands when a specially crafted request is sent. This could let an attacker change or delete information...

The Document Controller feature in RainyGao DocSys (versions up to 2.02.85) can be tricked into reading files from anywhere on the server by supplying a specially crafted file name. This could let an ...

The Support Ticket API in Omega Solution CoinEx Crypto 2025 can be tricked into revealing private ticket information when an attacker changes certain request values. This can be done from anywhere on ...

The Customer Information API in Omega CoinEx Crypto 2025 can be tricked by changing the ID value in the /customer-currency/ request, allowing users to bypass normal access checks. The flaw can be expl...

YzmCMS versions up to 7.6 use a simple MD5 method to store passwords, making them faster to crack. This weak hashing can be abused by attackers who can send specially crafted data to the system. Apply...

The Simple Shopping Cart plugin for WordPress (versions before 5.2.6) fails to properly clean up data entered on its settings page. This lets users with admin rights place hidden code that runs whenev...

The ticket attachment feature in CoinEx Crypto can be tricked into running malicious code when a specially crafted file is uploaded. This could let an attacker display unwanted content or steal inform...

Versions of Cockpit CMS from 2.12.0 up to 2.14.0 skip checking the security certificate when the scheduled task (cron.php) restarts a web worker. This lets a network attacker who can intercept the con...

Versions of Zitadel older than 4.16.2 let a malicious user trick the system into contacting internal addresses when it checks an organization’s domain. This can be used to discover or scan services in...