{
  "feed_version": "1.0",
  "title": "ARETIQ Daily Vulnerability Bulletin",
  "description": "Curated daily digest of high-priority vulnerabilities.",
  "home_page_url": "https://aretiq.ai/bulletins/",
  "feed_url": "https://aretiq.ai/feed/bulletins.json",
  "date": "2026-10-10",
  "generated_at": "2026-10-10T20:51:55.361012+00:00",
  "total_cves": 10,
  "groups": 10,
  "items": [
    {
      "vendor": "miniorange",
      "product": "miniorange_otp_verification",
      "cve_count": 1,
      "cve_ids": [
        "CVE-2026-106610"
      ],
      "cpes": [
        {
          "cpe": "cpe:2.3:a:miniorange:miniorange_otp_verification:*:*:*:*:*:*:*:*",
          "versions": "< 5.5.8"
        }
      ],
      "max_cvss": 9.8,
      "cvss_version": "3.1",
      "aas_score": 12.24,
      "severity": "CRITICAL",
      "summary": "Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7..",
      "references": [
        "https://patchstack.com/database/wordpress/plugin/miniorange-otp-verification/vulnerability/wordpress-miniorange-otp-verification-plugin-5-5-7-privilege-escalation-vulnerability?_s_id=cve"
      ]
    },
    {
      "vendor": "floci-io",
      "product": "floci",
      "cve_count": 1,
      "cve_ids": [
        "CVE-2026-108598"
      ],
      "cpes": [
        {
          "cpe": "cpe:2.3:a:floci-io:floci:*:*:*:*:*:*:*:*",
          "versions": ">= 1.1.0, < 2.2.0"
        }
      ],
      "max_cvss": 9.3,
      "cvss_version": "4.0",
      "aas_score": 11.08,
      "severity": "HIGH",
      "summary": "Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates.",
      "references": [
        "https://github.com/floci-io/floci",
        "https://github.com/floci-io/floci/blob/560b3e4aae61cea3ac7d4d51843bdffd0e3085fd/src/main/java/io/github/hectorvent/floci/services/apigateway/VtlTemplateEngine.java#L74-L114",
        "https://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4",
        "https://github.com/floci-io/floci/releases/tag/2.2.0",
        "https://github.com/floci-io/floci/security/advisories/GHSA-3p4c-wp7w-mgjx"
      ]
    },
    {
      "vendor": "inilerm",
      "product": "advanced_ip_blocker",
      "cve_count": 1,
      "cve_ids": [
        "CVE-2026-104732"
      ],
      "cpes": [
        {
          "cpe": "cpe:2.3:a:inilerm:advanced_ip_blocker:*:*:*:*:*:*:*:*",
          "versions": "< 8.13.14"
        }
      ],
      "max_cvss": 9.8,
      "cvss_version": "3.1",
      "aas_score": 10.94,
      "severity": "HIGH",
      "summary": "The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because `handle_login_action()` performs no server-side check \u2014 via transient, session marker, or equivalent \u2014 that a requester completed step-1 password authentication before processing a step-2 TOTP submission for the POSTed `user_id`; compounding this, an error branch in the function unconditionally mints a fresh `advaipbl-2fa-interim-{user_id}` nonce and delivers it in a `Location` header to any unauthenticated caller, after which `display_2fa_login_form_step_2()` renders a valid `advaipbl-2fa-verify-{user_id}` nonce in HTML \u2014 both nonces computed against a fixed `uid=0` empty-session context and therefore fully reusable by the attacker across subsequent requests.",
      "references": [
        "https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-2fa-manager.php#L71",
        "https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L519",
        "https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L6875",
        "https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L6912",
        "https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L7022"
      ]
    },
    {
      "vendor": "sergey",
      "product": "aiwu",
      "cve_count": 1,
      "cve_ids": [
        "CVE-2026-39801"
      ],
      "cpes": [
        {
          "cpe": "cpe:2.3:a:sergey:aiwu:*:*:*:*:*:*:*:*",
          "versions": null
        }
      ],
      "max_cvss": 9.8,
      "cvss_version": "3.1",
      "aas_score": 10.94,
      "severity": "HIGH",
      "summary": "Subscriber Privilege Escalation in AIWU <= 1.5.9 versions..",
      "references": [
        "https://patchstack.com/database/wordpress/plugin/ai-copilot-content-generator/vulnerability/wordpress-aiwu-plugin-1-5-9-privilege-escalation-vulnerability?_s_id=cve"
      ]
    },
    {
      "vendor": "pluggabl",
      "product": "booster_for_woocommerce",
      "cve_count": 1,
      "cve_ids": [
        "CVE-2026-42718"
      ],
      "cpes": [
        {
          "cpe": "cpe:2.3:a:pluggabl:booster_for_woocommerce:*:*:*:*:*:*:*:*",
          "versions": "< 8.4.1"
        }
      ],
      "max_cvss": 9.8,
      "cvss_version": "3.1",
      "aas_score": 10.1,
      "severity": "HIGH",
      "summary": "Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions..",
      "references": [
        "https://patchstack.com/database/wordpress/plugin/woocommerce-jetpack/vulnerability/wordpress-booster-for-woocommerce-plugin-8-4-0-php-object-injection-vulnerability?_s_id=cve"
      ]
    },
    {
      "vendor": "creativethemeshq",
      "product": "blocksy_companion",
      "cve_count": 1,
      "cve_ids": [
        "CVE-2026-107645"
      ],
      "cpes": [
        {
          "cpe": "cpe:2.3:a:creativethemeshq:blocksy_companion:*:*:*:*:*:*:*:*",
          "versions": "< 2.1.59"
        }
      ],
      "max_cvss": 9.1,
      "cvss_version": "3.1",
      "aas_score": 9.9,
      "severity": "HIGH",
      "summary": "The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then trusting an attacker-supplied $_POST['role'] value when invoking wc_create_new_customer() and wc_set_customer_auth_cookie().",
      "references": [
        "https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.58/framework/features/account-auth.php#L181",
        "https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.58/framework/features/account-auth.php#L24",
        "https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.58/framework/features/account-auth.php#L241",
        "https://plugins.trac.wordpress.org/changeset/3735192/blocksy-companion/tags/2.1.59/framework/features/account-auth.php?old=3723693&old_path=blocksy-companion%2Ftags%2F2.1.58%2Fframework%2Ffeatures%2Faccount-auth.php",
        "https://www.wordfence.com/threat-intel/vulnerabilities/id/7757f41d-c1f1-4df1-8048-b1c78a897548?source=cve"
      ]
    },
    {
      "vendor": "themefusion",
      "product": "avada_(fusion)_builder",
      "cve_count": 1,
      "cve_ids": [
        "CVE-2026-97670"
      ],
      "cpes": [
        {
          "cpe": "cpe:2.3:a:themefusion:avada_fusion_builder:*:*:*:*:*:*:*:*",
          "versions": "< 7.16.2"
        }
      ],
      "max_cvss": 9.1,
      "cvss_version": "3.1",
      "aas_score": 9.4,
      "severity": "HIGH",
      "summary": "The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1.",
      "references": [
        "https://avada.com/blog/version-7-16-2-security-update/",
        "https://www.wordfence.com/threat-intel/vulnerabilities/id/e2c00795-c49b-4b0a-8f0a-4ed18c966c6b?source=cve"
      ]
    },
    {
      "vendor": "themeisle",
      "product": "ppom_\u2013_product_addons_&_custom_fields_for_woocommerce",
      "cve_count": 1,
      "cve_ids": [
        "CVE-2026-104801"
      ],
      "cpes": [
        {
          "cpe": "cpe:2.3:a:themeisle:ppom_product_addons_custom_fields_for_woocommerce:*:*:*:*:*:*:*:*",
          "versions": "< 34.0.11"
        }
      ],
      "max_cvss": 9.1,
      "cvss_version": "3.1",
      "aas_score": 9.4,
      "severity": "HIGH",
      "summary": "The PPOM \u2013 Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).",
      "references": [
        "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/Files/Handler.php#L738",
        "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/Support/Helpers.php#L224",
        "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/WooCommerce/Cart/CartHandler.php#L369",
        "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/tags/34.0.10/src/WooCommerce/Order/OrderHandler.php#L287",
        "https://plugins.trac.wordpress.org/changeset/3733313/woocommerce-product-addon/trunk/src/WooCommerce/Order/OrderHandler.php"
      ]
    },
    {
      "vendor": "chenhg5",
      "product": "cc-connect",
      "cve_count": 1,
      "cve_ids": [
        "CVE-2026-108549"
      ],
      "cpes": [
        {
          "cpe": "cpe:2.3:a:chenhg5:cc-connect:*:*:*:*:*:*:*:*",
          "versions": null
        }
      ],
      "max_cvss": 9.2,
      "cvss_version": "4.0",
      "aas_score": 9.32,
      "severity": "HIGH",
      "summary": "cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured.",
      "references": [
        "https://github.com/chenhg5/cc-connect",
        "https://github.com/chenhg5/cc-connect/blob/v1.5.0/platform/max/max.go#L287-L305",
        "https://github.com/chenhg5/cc-connect/issues/1968",
        "https://www.vulncheck.com/advisories/cc-connect-through-1.5.0-missing-authentication-via-max-webhook-sender-spoofing"
      ]
    },
    {
      "vendor": "jetbrains",
      "product": "exposed",
      "cve_count": 1,
      "cve_ids": [
        "CVE-2026-108474"
      ],
      "cpes": [
        {
          "cpe": "cpe:2.3:a:jetbrains:exposed:*:*:*:*:*:*:*:*",
          "versions": null
        }
      ],
      "max_cvss": 9.8,
      "cvss_version": "3.1",
      "aas_score": 9.1,
      "severity": "HIGH",
      "summary": "In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions.",
      "references": [
        "https://www.jetbrains.com/privacy-security/issues-fixed/"
      ]
    }
  ],
  "upgrades": [
    {
      "cve_id": "CVE-2026-104334",
      "vendor": "langflow",
      "product": "langflow",
      "old_level": "exploitable",
      "new_level": "functional",
      "old_aas": 13.4,
      "new_aas": 15.4,
      "original_bulletin": "2026-10-07"
    },
    {
      "cve_id": "CVE-2026-106382",
      "vendor": "google",
      "product": "chrome",
      "old_level": "exploitable",
      "new_level": "functional",
      "old_aas": 11.4,
      "new_aas": 13.4,
      "original_bulletin": "2026-10-06"
    }
  ]
}