Security Box Score — October 4, 2026

CISA adds 1 to KEV; 64 CVEs published, led by zitadel (10).

64 CVEs published October 4, 2026: 13 critical, 13 high, 27 medium, 11 low; 1 in the KEV catalog at press time; 4 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 39 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	971	50959	—	—
KEV catalog size	1734

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

3334 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	0	6205	530	2640	726	1	15	6	0.1	7.8	.0019	-188 ▼
microsoft	1	2902	201	1993	692	16	290	31	1.1	7.8	.0047	-8 ▼
google	11	2842	358	1102	1247	131	80	9	0.3	7.5	.0026	-27 ▼
red hat	21	920	54	388	425	53	2	0	0.0	6.8	.0035	-12 ▼
apple	0	564	67	166	317	14	89	9	1.6	6.5	.0019	0
suse	0	53	8	27	16	2	0	0	0.0	7.5	.0036	-9 ▼
canonical	2	52	16	12	19	5	0	0	0.0	7.8	.0022	+2 ▲
freebsd	0	48	2	36	7	3	0	0	0.0	7.8	.0016	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	0	182	54	72	55	1	60	17	9.3	7.8	.0046	-11 ▼
ubiquiti	0	65	36	28	1	0	3	3	4.6	9.1	.0050	0
palo alto networks	0	46	1	4	26	15	13	2	4.3	4.7	.0022	0
fortinet	1	42	12	10	17	3	30	8	19.0	7.2	.0040	+1 ▲
netgear	0	34	0	0	27	7	0	0	0.0	4.3	.0027	0
f5	0	26	7	14	4	1	5	2	7.7	8.7	.0050	-7 ▼
ivanti	0	24	6	16	2	0	25	5	20.8	8.8	.0152	0
sonicwall	0	19	7	8	4	0	19	4	21.1	8.3	.0050	-5 ▼

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	97	804	165	365	249	18	33	2	0.2	7.5	.0057	+89 ▲
mozilla	0	379	122	169	87	0	9	0	0.0	8.8	.0031	-34 ▼
gitlab	1	105	8	24	62	11	5	3	2.9	5.3	.0035	+1 ▲
drupal	0	94	11	9	66	8	4	1	1.1	5.7	.0027	-26 ▼
github	0	23	2	11	10	0	0	0	0.0	7.4	.0054	-3 ▼
docker	0	12	1	8	3	0	0	0	0.0	8.4	.0017	0
wordpress	0	6	1	4	1	0	3	3	50.0	8.7	.0392	0
eclipse	0	2	2	0	0	0	0	0	0.0	9.3	.0050	0

Enterprise Applications
Vendor	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	2905	581	1660	563	101	28	4	0.1	7.8	.0036	0
ibm	1023	196	473	336	18	6	1	0.1	7.5	.0037	-70 ▼
adobe	830	82	364	375	9	21	5	0.6	7.5	.0036	-2 ▼
progress	66	15	40	11	0	6	1	1.5	8.1	.0045	-2 ▼
zohocorp	42	6	29	7	0	0	0	0.0	8.3	.0117	-1 ▼
solarwinds	26	18	5	3	0	10	4	15.4	9.1	.0067	0
veeam	19	6	10	3	0	1	0	0.0	8.6	.0042	0
servicenow	10	7	3	0	0	2	0	0.0	9.4	.0036	0

Industrial & Embedded
Vendor	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
d-link	74	22	28	12	12	3	8.5	.0164	-3 ▼
siemens	52	6	33	10	3	0	7.3	.0026	-1 ▼
synology	46	5	10	25	6	0	5.6	.0032	0
rockwell automation	43	5	32	6	0	0	8.6	.0029	-18 ▼
advantech	20	2	17	1	0	0	8.6	.0071	0
schneider electric	18	2	11	5	0	0	8.5	.0044	-4 ▼
hitachi energy	12	2	4	6	0	0	7.0	.0025	-4 ▼
abb	11	1	6	4	0	0	7.2	.0018	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
dell	0	378	34	170	152	22	2	1	0.3	7.2	.0027	-19 ▼
nvidia	0	301	25	206	70	0	0	0	0.0	7.8	.0019	-30 ▼
sourcecodester	2	239	0	0	143	96	0	0	0.0	5.5	.0042	+1 ▲
openclaw	0	223	4	114	84	21	0	0	0.0	7.1	.0031	0
spring	0	170	13	60	83	14	0	0	0.0	6.5	.0033	0
mongodb	0	169	6	99	60	4	1	0	0.0	7.1	.0038	-10 ▼
hewlett packard enterprise (hpe)	0	166	22	80	55	9	1	1	0.6	7.2	.0042	-86 ▼
itsourcecode	5	158	0	0	37	121	0	0	0.0	2.1	.0033	-1 ▼

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-85706	.9296	99.8	10.0
CVE-2026-87902	.4550	98.8	8.1
CVE-2026-76461	.2827	98.1	9.8
CVE-2026-93616	.1965	97.3	9.8
CVE-2026-76460	.1403	96.5	10.0
CVE-2026-86218	.1293	96.2	10.0
CVE-2026-85102	.0755	94.3	9.8
CVE-2026-12269	.0699	94.0	8.8
CVE-2026-67276	.0645	93.5	9.2
CVE-2026-86060	.0639	93.5	9.2

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-85706	10.0	.9296	KEV
CVE-2026-76460	10.0	.1403	KEV
CVE-2026-86218	10.0	.1293	KEV
CVE-2026-75650	10.0	.0395	KEV
CVE-2026-82004	10.0	.0325
CVE-2026-86152	10.0	.0288
CVE-2026-85978	10.0	.0144
CVE-2026-73369	10.0	.0125
CVE-2026-75699	10.0	.0125
CVE-2026-75703	10.0	.0125

Most disclosures (vendor)
Vendor	CVEs
linux	1927
microsoft	994
google	635
oracle	634
ibm	334
apache	284
red hat	252
apple	247
adobe	222
dell	188

Most KEV additions (YTD)
Vendor	KEV
microsoft	31
cisco	17
apple	9
google	9
fortinet	8
linux	6
adobe	5
ivanti	5
berriai	4
checkpoint	4

Most-affected ecosystems
Ecosystem	Advisories
Maven	120
NuGet	24
Packagist	24
npm	23
PyPI	13
crates.io	10
Go	9
RubyGems	4

Fastest to KEV
CVE	Vendor	Days
CVE-2026-58704	Google	0
CVE-2026-75650	Adobe	0
CVE-2026-86950	Apple	0
CVE-2026-87491	Google	0
CVE-2026-88779	NetScaler	0
CVE-2026-93952	Arista Networks	0
CVE-2026-102489	Zammad GmbH	1
CVE-2026-102490	Zammad GmbH	1
CVE-2026-84869	ConnectWise	2
CVE-2026-86218	N-able	2

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1782
CVE-2021-27102	n/a	2021-11-17	1782
CVE-2021-27101	n/a	2021-11-17	1782
CVE-2021-27103	n/a	2021-11-17	1782
CVE-2021-21017	Adobe	2021-11-17	1782
CVE-2021-28550	Adobe	2021-11-17	1782
CVE-2021-42013	Apache Software Foundation	2021-11-17	1782
CVE-2021-41773	Apache Software Foundation	2021-11-17	1782
CVE-2021-30858	Apple	2021-11-17	1782
CVE-2021-30860	Apple	2021-11-17	1782

Transactions

ADDED TO KEV — CVE-2026-88779 (NetScaler ADC). Remediation due October 7, 2026.

DUE DATE PASSED — CVE-2026-76504 (Cisco Catalyst SD-WAN Manager). CISA remediation deadline was October 3, 2026; still in catalog.

PATCH SHIPPED — Red Hat Enterprise Linux 9: 3 CVEs (CVE-2026-90947, CVE-2026-90948, CVE-2026-97185). Fix versions published.

PATCH SHIPPED — CVE-2026-39601 (WPdevelop Booking Calendar). Fixed in Booking Calendar 11.9.

PATCH SHIPPED — CVE-2026-92248 (GNOME GIMP). Fixed in Red Hat Enterprise Linux 9 2:3.0.4-4.el9_8.14.

Yesterday's Results

How to read these box scores · glossary

64 CVEs published. 25 box scores, 39 table rows — nothing truncated.

CVE-2026-88779HIGH

NetScaler ADC — Memory overflow vulnerability leading to Denial of Service

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0028   18.2   YES

AFFECTED
  Product  Versions     Fixed
  ADC      unspecified  —
  Gateway  unspecified  —

TIMELINE
  Sep 10  Reserved by CNA
  Oct 4   Added to CISA KEV, due Oct 7
  Oct 4   Published (CNA: NetScaler)

CWE-119 · CNA: NetScaler · CVSS v4.0 · 3 references · NVD status: Undergoing Analysis · KEV due October 7, 2026

CVE-2026-105134CRITICAL

Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0184   78.3     —

AFFECTED
  Product   Versions  Fixed
  AhsayCBS  10.3.0 –  10.3.4

TIMELINE
  Oct 3   Reserved by CNA
  Oct 4   Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-105135CRITICAL

InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0077   54.1     —

AFFECTED
  Product     Versions  Fixed
  MindSearch  0.1.0 –   —

TIMELINE
  Oct 3   Reserved by CNA
  Oct 4   Published (CNA: VulDB)

CWE-74, CWE-94 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-105144MEDIUM

n/a Drogon — Drogon Static File Router StaticFileRouter.cc route path traversal

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0054   43.4     —

AFFECTED
  Product  Versions    Fixed
  Drogon   1.9.13-1 –  —

TIMELINE
  Oct 3   Reserved by CNA
  Oct 4   Published (CNA: VulDB)

CWE-22 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Received

CVE-2026-105133MEDIUM

Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0038   30.0     —

AFFECTED
  Product   Versions  Fixed
  AhsayCBS  10.3.0 –  10.3.4

TIMELINE
  Oct 3   Reserved by CNA
  Oct 4   Published (CNA: VulDB)

CWE-287 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-105141MEDIUM

topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    5.3   .0034   24.8     —

AFFECTED
  Product  Versions  Fixed
  cognee   1.5.0 –   1.6.0

TIMELINE
  Oct 3   Reserved by CNA
  Oct 4   Published (CNA: VulDB)

CWE-259, CWE-798 · CNA: VulDB · CVSS v4.0 · 9 references · NVD status: Received

CVE-2026-105097LOW

Omega Solution CoinEx Crypto Customer Information API customer-currency authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   N   N    2.1   .0029   19.9     —

AFFECTED
  Product        Versions  Fixed
  CoinEx Crypto  2025 –    —

TIMELINE
  Oct 3   Reserved by CNA
  Oct 4   Published (CNA: VulDB)

CWE-285, CWE-639 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-105096LOW

Omega Solution CoinEx Crypto Customer Profile API customer authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0029   19.1     —

AFFECTED
  Product        Versions  Fixed
  CoinEx Crypto  2025 –    —

TIMELINE
  Oct 3   Reserved by CNA
  Oct 4   Published (CNA: VulDB)

CWE-285, CWE-639 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-105098LOW

Omega Solution CoinEx Crypto Support Ticket API customer information disclosure

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   N   N    2.1   .0028   18.5     —

AFFECTED
  Product        Versions  Fixed
  CoinEx Crypto  2025 –    —

TIMELINE
  Oct 3   Reserved by CNA
  Oct 4   Published (CNA: VulDB)

CWE-200, CWE-284 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-103355CRITICAL

Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) — WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  N  L    9.3   .0025   14.8     —

AFFECTED
  Product                                                             Versions     Fixed
  Unlimited Elements For Elementor (Free Widgets, Addons, Templates)  unspecified  2.0.21

TIMELINE
  Sep 30  Reserved by CNA
  Oct 4   Published (CNA: Patchstack)

CWE-89 · CNA: Patchstack · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-105131MEDIUM

mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   N    5.3   .0020    8.7     —

AFFECTED
  Product        Versions  Fixed
  ezBookkeeping  1.2.0 –   —

TIMELINE
  Oct 3   Reserved by CNA
  Oct 4   Published (CNA: VulnCheck)

CWE-863 · CNA: VulnCheck · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-105099LOW

Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   P   N   L   N    2.0   .0019    7.9     —

AFFECTED
  Product        Versions  Fixed
  CoinEx Crypto  2025 –    —

TIMELINE
  Oct 3   Reserved by CNA
  Oct 4   Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-17005MEDIUM

Unknown Horizontal scrolling announcements — Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   R  U  H  H  H    6.8   .0015    3.7     —

AFFECTED
  Product                             Versions     Fixed
  Horizontal scrolling announcements  unspecified  —

TIMELINE
  Jul 24  Reserved by CNA
  Oct 4   Published (CNA: WPScan)

CWE-79 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-104119LOW

Unknown Simple Shopping Cart — Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   R  U  L  L  N    3.5   .0015    3.7     —

AFFECTED
  Product               Versions     Fixed
  Simple Shopping Cart  unspecified  —

TIMELINE
  Oct 1   Reserved by CNA
  Oct 4   Published (CNA: WPScan)

CWE-79 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-97276HIGH

VeronaLabs WP Statistics — WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  L  L  L    7.1   .0015    3.3     —

AFFECTED
  Product        Versions     Fixed
  WP Statistics  unspecified  14.16.15

TIMELINE
  Sep 24  Reserved by CNA
  Oct 4   Published (CNA: Patchstack)

CWE-79 · CNA: Patchstack · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-103062HIGH

Cozmoslabs TranslatePress — WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  L  L  L    7.1   .0015    3.3     —

AFFECTED
  Product         Versions     Fixed
  TranslatePress  unspecified  3.3.7

TIMELINE
  Sep 30  Reserved by CNA
  Oct 4   Published (CNA: Patchstack)

CWE-79 · CNA: Patchstack · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-103344HIGH

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  L  L  L    7.1   .0015    3.3     —

AFFECTED
  Product                                                             Versions     Fixed
  Unlimited Elements For Elementor (Free Widgets, Addons, Templates)  unspecified  2.0.21

TIMELINE
  Sep 30  Reserved by CNA
  Oct 4   Published (CNA: Patchstack)

CWE-79 · CNA: Patchstack · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-103354HIGH

Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks — WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  L  L  L    7.1   .0015    3.3     —

AFFECTED
  Product                             Versions     Fixed
  Gutenberg Blocks by Kadence Blocks  unspecified  3.7.12

TIMELINE
  Sep 30  Reserved by CNA
  Oct 4   Published (CNA: Patchstack)

CWE-79 · CNA: Patchstack · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-86817MEDIUM

Unknown Five Star Business Profile and Schema — Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  N  N    4.9   .0014    2.8     —

AFFECTED
  Product                                Versions  Fixed
  Five Star Business Profile and Schema  2.3.20 –  —

TIMELINE
  Sep 8   Reserved by CNA
  Oct 4   Published (CNA: WPScan)

CWE-200 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-97332MEDIUM

Unknown User Private Files — User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  N  N    5.3   .0014    2.6     —

AFFECTED
  Product             Versions     Fixed
  User Private Files  unspecified  —

TIMELINE
  Sep 24  Reserved by CNA
  Oct 4   Published (CNA: WPScan)

CWE-284 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-104118MEDIUM

Unknown Razorpay for WooCommerce — Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  L  N    5.3   .0014    2.6     —

AFFECTED
  Product                   Versions     Fixed
  Razorpay for WooCommerce  unspecified  —

TIMELINE
  Oct 1   Reserved by CNA
  Oct 4   Published (CNA: WPScan)

CWE-639 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-105137LOW

n/a Laradock — Laradock Build Process Dockerfile code download

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   N   P   L   L   L    1.3   .0013    2.2     —

AFFECTED
  Product   Versions  Fixed
  Laradock  20.0 –    —

TIMELINE
  Oct 3   Reserved by CNA
  Oct 4   Published (CNA: VulDB)

CWE-494 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-93549HIGH

Unknown CoCart — CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0011    1.3     —

AFFECTED
  Product  Versions  Fixed
  CoCart   4.9.0 –   —

TIMELINE
  Sep 18  Reserved by CNA
  Oct 4   Published (CNA: WPScan)

CWE-352 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-105086CRITICAL

WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   L   P   H   H   N    9.3      —      —     —

AFFECTED
  Product  Versions  Fixed
  AVideo   12.4 –    —

TIMELINE
  Oct 3   Reserved by CNA
  Oct 4   Published (CNA: VulnCheck)

CWE-79 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-105089CRITICAL

WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   L   P   H   H   N    9.3      —      —     —

AFFECTED
  Product  Versions     Fixed
  AVideo   unspecified  —

TIMELINE
  Oct 3   Reserved by CNA
  Oct 4   Published (CNA: VulnCheck)

CWE-79 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-105207	9.3	—	zitadel	zitadel	CWE-306	ZITADEL before 4.17.3 Account Takeover via External IdP Linking
CVE-2026-105209	9.3	—	zitadel	zitadel	CWE-862	ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Pass…
CVE-2026-105215	9.3	—	zitadel	zitadel	CWE-290	ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback
CVE-2026-105211	9.2	—	zitadel	zitadel	CWE-200	ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode
CVE-2026-105216	9.1	—	micro	go-micro	CWE-295	go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config He…
CVE-2026-105218	9.1	—	go-pay	gopay	CWE-295	gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client
CVE-2026-105221	9.1	—	defunkt	gist	CWE-295	Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification
CVE-2026-105222	9.1	—	alexpechkarev	google-maps	CWE-295	alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification…
CVE-2026-105210	8.8	—	zitadel	zitadel	CWE-287	ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers
CVE-2026-105213	8.8	—	zitadel	zitadel	CWE-287	ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Orga…
CVE-2026-105208	8.7	—	zitadel	zitadel	CWE-649	ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens
CVE-2026-105212	8.7	—	zitadel	zitadel	CWE-287	ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment
CVE-2026-105219	8.7	—	mwilliamson	mammoth.js	CWE-1333	Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser
CVE-2026-105220	8.5	—	klembot	twinejs	CWE-79	Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files
CVE-2026-97307	7.5	—	StylemixThemes	Cost Calculator Builder	CWE-201	WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure …
CVE-2026-105161	6.9	—	invariant-systems-ai	aiir	CWE-345	invariant-systems-ai aiir Policy Gate signature verification
CVE-2026-105163	6.9	—	crossplane	crossplane-runtime	CWE-362	crossplane crossplane-runtime ImageConfig client.go Get toctou
CVE-2026-105169	6.9	—	kishor-23	food-waste-management-system	CWE-89	kishor-23 food-waste-management-system Take Order delivery.php sql injection
CVE-2026-105170	6.9	—	kishor-23	food-waste-management-system	CWE-306	kishor-23 food-waste-management-system Admin Signup signup.php missing authen…
CVE-2026-105205	6.9	—	siyuan-note	siyuan	CWE-200	SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getD…
CVE-2026-105145	5.5	—	Weaviate	Verba	CWE-200	Weaviate Verba generate_stream Endpoint util.py get_environment information d…
CVE-2026-105147	5.5	—	SciPhi-AI	R2R	CWE-259	SciPhi-AI R2R JWT Secret hard-coded credentials
CVE-2026-105148	5.5	—	SciPhi-AI	R2R	CWE-918	SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request fo…
CVE-2026-105149	5.5	—	n/a	mooSocial	CWE-74	mooSocial all-products sql injection
CVE-2026-105158	5.5	—	RainyGao	DocSys	CWE-74	RainyGao DocSys Database Management BaseController.java BaseController.create…
CVE-2026-105166	5.5	—	kishor-23	food-waste-management-system	CWE-74	kishor-23 food-waste-management-system Food Donation Form fooddonateform.php …
CVE-2026-105167	5.5	—	kishor-23	food-waste-management-system	CWE-74	kishor-23 food-waste-management-system donate.php sql injection
CVE-2026-105165	5.3	—	devopspolis	secrets-replicator	CWE-275	devopspolis secrets-replicator AssumeRole handler.py process_single_secret pe…
CVE-2026-105168	5.3	—	kishor-23	food-waste-management-system	CWE-89	kishor-23 food-waste-management-system Order Assignment Block admin.php sql i…
CVE-2026-105171	5.3	—	kishor-23	food-waste-management-system	CWE-639	kishor-23 food-waste-management-system Role Attribute admin.php authorization
CVE-2026-105206	5.3	—	zitadel	zitadel	CWE-863	ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration vi…
CVE-2026-105164	5.1	—	NASA	cFS	CWE-119	NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds
CVE-2026-105224	5.1	—	YesWiki	yeswiki	CWE-79	YesWiki before 4.6.7 Stored XSS via Bazar valeur Action
CVE-2026-104402	4.3	—	farvisun	Mindio Magic MCP	CWE-201	WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerab…
CVE-2026-105156	2.9	—	n/a	YzmCMS	CWE-326	YzmCMS MD5 system.func.php password weak password hash
CVE-2026-105214	2.3	—	zitadel	zitadel	CWE-918	Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification
CVE-2026-105217	2.3	—	cockpit-hq	cockpit	CWE-295	Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php
CVE-2026-105157	2.1	—	RainyGao	DocSys	CWE-22	RainyGao DocSys Document Controller doGetTmpFile.do DocController.doGetTmp pa…
CVE-2026-105146	2.0	—	Comsenz	Discuz!	CWE-74	Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-10-04 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.