7 vulnerabilities across 4 products scored HIGH or above on October 04, 2026.

  • 🟠 HIGH: 7

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-76504 (cisco/catalyst_sd-wan_manager) — F1: exploitable → functional, AAS: 10.9 → 13.4 (HIGH → CRITICAL). Originally in 2026-09-30 bulletin.
  • [UPGRADED] CVE-2026-100752 (ordasoft.com/real_estate_manager_(free)_extension_for_joomla) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-09-28 bulletin.

🟠 [HIGH] wwbn/avideo

2 CVEs | CVSS 4.0: 9.3 | AAS 10.5

  • cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* (>= 12.4)

WWBN AVideo through version 29.2.0 is affected by 2 vulnerabilities rated HIGH with a CVSS 4.0 score of 9.3, including multiple stored cross-site scripting flaws. Attackers with upload permissions can inject malicious JavaScript through crafted video trailer URLs, which are rendered without proper sanitization in YouPHPFlix2 templates and channel playlists, enabling script execution in the browsers of anyone viewing the affected content.

Organizations running self-hosted AVideo instances should apply the patch referenced in the vendor commit immediately. Any deployment where untrusted users have upload permissions is particularly at risk and should be prioritized for remediation.

Vendor Advisory

🟠 [HIGH] unlimited_elements/unlimited_elements_for_elementor_(free_widgets,_addons,_templates)

1 CVE | CVSS 3.1: 9.3 | AAS 10.1

  • cpe:2.3:a:unlimited_elements:unlimited_elements_for_elementor:*:*:*:*:*:*:*:* (< 2.0.21)

Unlimited Elements for Elementor, a widely used free WordPress plugin providing widgets, addons, and templates, is affected by 1 vulnerability rated HIGH with a CVSS 3.1 score of 9.3. The flaw is a blind SQL injection that impacts all versions through 2.0.20, potentially allowing attackers to extract sensitive data from the WordPress database without requiring privileged access.

WordPress site administrators using this plugin should update beyond version 2.0.20 immediately and review database logs for signs of exploitation. Given the popularity of Elementor-based plugins across WordPress sites, teams responsible for any WordPress deployments should verify whether this plugin is installed in their environment.

Vendor Advisory

🟠 [HIGH] zitadel/zitadel

3 CVEs | CVSS 4.0: 9.3 | AAS 9.9

  • cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*

ZITADEL, an open-source identity and access management platform, is affected by 3 vulnerabilities rated HIGH with a CVSS 4.0 score of 9.3, including multiple authentication bypass flaws. The most severe issue allows unauthenticated attackers to forge external identity provider fields during account registration, pre-creating accounts bound to a victim’s external IdP identity so that the victim’s legitimate login is silently hijacked into an attacker-controlled session.

Organizations running ZITADEL versions before 3.4.14 or 4.x before 4.16.2 should upgrade immediately and audit existing accounts for any unauthorized external identity bindings. Any deployment relying on ZITADEL for federated authentication is directly at risk and should prioritize this patch.

Vendor Advisory

🟠 [HIGH] micro/go-micro

1 CVE | CVSS 4.0: 9.1 | AAS 9.4

  • cpe:2.3:a:micro:go-micro:*:*:*:*:*:*:*:* (< 6.0.0)

Go-Micro, a popular Go framework for distributed systems and microservices, is affected by 1 vulnerability rated HIGH with a CVSS 4.0 score of 9.1. All versions before 6.0.0 ship with TLS certificate verification disabled by default, allowing man-in-the-middle attackers to impersonate services and intercept or modify traffic across gRPC transport, HTTP and RabbitMQ brokers, and Consul or etcd registries, including any authentication tokens and credentials in transit.

Teams running Go-Micro in any environment where network traffic crosses untrusted segments should upgrade to version 6.0.0 or later immediately. Given that this framework underpins service-to-service communication, the blast radius of exploitation could extend across an entire microservices deployment.

Vendor Advisory