Skip to content
OpenAdvisories

Archive

4 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /4 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.4
    CVE-2026-105221 Public exploit

    Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

    The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify G…

    defunkt gist gist Ubuntu
  • Critical 9.3
    CVE-2026-103355 Public exploit

    WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue …

    Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
  • Medium 5.3
    CVE-2026-97332 Public exploit

    User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)

    The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated …

    Web / CMS
  • Critical 10.0
    CVE-2026-105134 Exploited Public exploit Scanner template EPSS 82%

    Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

    A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os comma…

    Ahsay AhsayCBS
    KEV Oct 14, 2026
  • High 7.3
    CVE-2026-105133 Exploited Public exploit Scanner template EPSS 84%

    Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

    A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper auth…

    Ahsay AhsayCBS
    KEV Oct 14, 2026