By weakness (CWE)

CWE-284: related vulnerabilities

CVEs classified under CWE-284. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

304 published vulnerabilities · page 3 of 4

• CVE-2026-46979MEDIUM 6.5

  Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38 contains a vulnerability in its integration and interfaces component that allows high-privileged attackers to access the system over HTTPS and read or modify sensitive institutional data. The vulnerability requires the attacker to already hold elevated administrative credentials, but once authenticated, they can view or alter critical campus and community information without additional obstacles. This represents a data confidentiality and integrity risk rather than a system availability threat.

• CVE-2026-48955MEDIUM 6.5

  CVE-2026-48955 is a medium-severity access control flaw in Joomla that allows authenticated users to view workflow stage and transition details they should not be able to see. An attacker with a valid login—even with limited permissions—can bypass authorization checks to inspect sensitive workflow configuration and state information. This is not a remote unauthenticated attack, but rather a privilege escalation within the platform.

• CVE-2026-49411MEDIUM 6.5

  Deno, a JavaScript/TypeScript/WebAssembly runtime, had a permission-checking flaw in its Node.js compatibility layer for TCP connections. When code attempted to connect to a host that was supposed to be denied, Deno only checked permissions against the hostname as originally provided—not after that hostname resolved to an IP address. An attacker could bypass restrictions by using numeric representations of IP addresses (like decimal 2130706433 or hexadecimal 0x7f000001, both resolving to localhost) in node:net.connect() or node:http.request() calls, reaching destinations that should have been blocked. This was fixed in Deno 2.8.0.

• CVE-2026-49938MEDIUM 6.5

  CVE-2026-49938 is an access control flaw affecting Fortinet FortiPortal that allows authenticated users to access data or functions they should not have permission to reach. The vulnerability exists in FortiPortal versions 7.0 (all versions), 7.2.0 through 7.2.8, and 7.4.0 through 7.4.7. An attacker with valid credentials can exploit this to gain unauthorized visibility into sensitive information. This is not a remote unauthenticated attack—the threat actor must first obtain legitimate login credentials.

• CVE-2026-50892MEDIUM 6.5

  Nginx Proxy Manager version 2.14.0 contains a flaw in how it controls access to its Let's Encrypt certificate download feature. An authenticated user can bypass the intended access controls and retrieve TLS private keys that should remain confidential. This requires the attacker to already have valid credentials to the system, but once authenticated, they can extract sensitive cryptographic material via a specially crafted web request.

• CVE-2026-53520MEDIUM 6.5

  Nezha Monitoring, a self-hosted server and website monitoring tool, contains a privilege escalation flaw affecting versions 2.0.14 through 2.0.x. Any authenticated user can claim ownership of the monitoring dashboard's host configuration through a NAT-based mechanism, effectively taking control of all dashboard routing. This allows an internal attacker with valid credentials to hijack the monitoring infrastructure's core routing and potentially lock out legitimate administrators. The vulnerability has been resolved in version 2.1.0.

• CVE-2026-56050MEDIUM 6.5

  A security flaw in Themeisle's PPOM (Product Personalization Options Manager) plugin for WooCommerce allows attackers to bypass access controls and make unauthorized changes to protected data. The vulnerability affects all versions up to and including 33.0.18. Attackers can exploit misconfigured permission settings without authentication to modify site content or cause service disruptions, though they cannot read sensitive information directly.

• CVE-2026-56302MEDIUM 6.5

  Capgo versions before 12.128.2 expose a critical cloud storage misconfiguration where app icons are stored without any access controls. This means anyone on the internet—without needing to log in or provide credentials—can view, upload, and delete these icons. Attackers can weaponize this to wipe out all stored icons and harvest sensitive identifiers like app IDs and user IDs that are embedded in or associated with those files.

• CVE-2026-56335MEDIUM 6.5

  Capgo versions before 12.128.2 have a flaw that lets attackers with write-level API keys bypass security checks and directly modify protected channel settings in ways that should be prevented. An attacker could change sensitive flags like whether a channel is public or if it allows emulator connections, potentially exposing functionality or bypassing security controls that the application intended to enforce. The vulnerability exists because a database trigger that should prevent unauthorized changes has a null-check flaw that allows PostgREST requests with valid write credentials to slip through.

• CVE-2026-58523MEDIUM 6.5

  Microsoft Edge for Android contains an access control vulnerability that allows an attacker to bypass a security feature through network interaction. The vulnerability requires user interaction (such as clicking a malicious link) but does not require authentication. While an attacker cannot modify data or disrupt service, they can access confidential information the user would normally be restricted from viewing.

• CVE-2026-54015MEDIUM 6.4

  Open WebUI, a self-hosted AI platform, contains a vulnerability in how it manages access to saved prompt versions and history. Before version 0.9.6, the application checks that you own a prompt before letting you view its history, but fails to verify that individual history entries actually belong to that prompt. An attacker with legitimate access to any prompt they control can exploit this flaw to read or delete the saved version history of other users' private prompts, provided they can discover a history entry ID. The vulnerability requires authentication and knowledge of specific history entry identifiers, limiting its practical reach but making it a serious concern for multi-user deployments.

• CVE-2026-10152MEDIUM 6.3

  A flaw in TaleLin's lin-cms-spring-boot framework (version 0.2.1 and earlier) allows authenticated users to bypass access controls on the book endpoint. An attacker with valid login credentials can manipulate requests to perform actions they should not be permitted to execute, such as viewing, modifying, or deleting book records without proper authorization checks. Proof-of-concept code is publicly available, increasing the risk of active exploitation.

• CVE-2026-10172MEDIUM 6.3

  Bdtask Multi-Store Inventory Management System version 1.0 contains a file upload vulnerability that allows authenticated users to upload arbitrary files to the server without validation. An attacker with valid login credentials can exploit this flaw to upload malicious files, potentially leading to remote code execution or other attacks. Public exploit code is available, increasing the risk of widespread exploitation.

• CVE-2026-10205MEDIUM 6.3

  Metasoft MetaCRM version 6.4.0 contains an unrestricted file upload vulnerability in its logo upload functionality. An authenticated attacker can upload arbitrary files to the server, potentially leading to code execution or system compromise. The vulnerability affects a JSP file handling logo uploads and requires valid user credentials to exploit. Public exploit code exists for this issue.

• CVE-2026-10277MEDIUM 6.3

  A security flaw exists in the MCP Google Workspace integration's Gmail tool that allows authenticated users to bypass access controls and manipulate file storage operations. An attacker with valid login credentials can remotely exploit this vulnerability to gain unauthorized access to data or perform unintended modifications. The vulnerability affects the component up to commit 831790e7d5c2663325733d9f5579cc339a267c4c, and a patch has been released.

• CVE-2026-10806MEDIUM 6.3

  CVE-2026-10806 is a medium-severity file upload vulnerability in mjperpinosa stumasy affecting the add_post.php component. An authenticated attacker can manipulate the up_file_to_post parameter to upload files without proper restrictions, potentially allowing arbitrary file placement on the server. The vulnerability requires valid login credentials but can be exploited over the network. Exploit code has been publicly disclosed, increasing practical risk.

• CVE-2026-10807MEDIUM 6.3

  A file upload vulnerability exists in mjperpinosa stumasy that allows authenticated users to upload files without proper validation. By manipulating the profile image upload parameter in the application's profile management component, an attacker with login credentials can bypass upload restrictions and place arbitrary files on the server. The vulnerability requires authentication but poses meaningful risk to confidentiality, integrity, and availability of the affected system.

• CVE-2026-11187MEDIUM 6.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in the Glic component that allows an attacker to bypass navigation restrictions by tricking users into visiting a specially crafted webpage. The vulnerability requires user interaction (clicking a link or visiting the malicious page) and affects users across Windows, macOS, and Linux platforms. While the immediate impact is moderate, the ability to circumvent navigation safeguards could enable follow-on attacks or unauthorized content access.

• CVE-2026-11333MEDIUM 6.3

  A file upload vulnerability exists in tittuvarghese CollegeManagementSystem that allows authenticated users to upload arbitrary files through the Student Data Upload endpoint. An attacker with login credentials can bypass upload restrictions by manipulating the Student-Data-CSV parameter, potentially introducing malicious files into the system. The vulnerability has been publicly disclosed and exploit code is available, though the project maintainers have not yet responded to the disclosure.

• CVE-2026-11532MEDIUM 6.3

  A security flaw has been discovered in imvks786's student management system that weakens access controls on student records. An authenticated user with basic access can manipulate requests to the Student Record Handler component (/add.php) to gain unauthorized permissions or modify data they shouldn't be able to touch. The vulnerability requires login credentials but can be exploited remotely. Public disclosure of exploitation techniques has already occurred, increasing near-term risk.

• CVE-2026-13544MEDIUM 6.3

  Feehi CMS versions up to 2.1.1 contain an access control flaw in its API user endpoint that allows authenticated attackers to perform unauthorized actions. An attacker with valid login credentials can bypass intended restrictions and access, modify, or delete user data that should be protected. The vulnerability is remotely exploitable and a proof-of-concept has already been published, increasing the practical risk of exploitation.

• CVE-2026-14698MEDIUM 6.3

  SourceCodester's Syllabus-Aligned Learning Management and Examination System version 1.0 contains a file upload vulnerability that allows authenticated users to bypass upload restrictions. An attacker with login credentials can upload arbitrary files to the system, potentially leading to code execution, data theft, or system compromise. Public exploit code is available, increasing the risk of active exploitation.

• CVE-2026-14775MEDIUM 6.3

  A file upload vulnerability exists in SourceCodester's Online Examination & Learning Management System version 1.0. An authenticated attacker can bypass upload restrictions by manipulating the user_id parameter in the /process_lesson.php file, allowing them to upload malicious files to the system. The vulnerability requires valid login credentials but no special privileges. Exploit code is publicly available.

• CVE-2026-14776MEDIUM 6.3

  SourceCodester's Online Examination & Learning Management System version 1.0 contains a file upload vulnerability that allows authenticated users to upload files with unrestricted extensions. An attacker with login credentials can bypass filename validation in the upload_files.php script to upload potentially dangerous file types, including executable code. Public exploit code is available, increasing the practical risk of active exploitation.

• CVE-2026-14777MEDIUM 6.3

  A file upload vulnerability has been discovered in SourceCodester's Online Examination & Learning Management System version 1.0. An authenticated attacker can manipulate the /announcements.php file to upload files without proper restrictions. The vulnerability is accessible over the network and requires login credentials but no additional user interaction. Public exploit code is available, elevating the practical risk despite the CVSS score of 6.3.

• CVE-2026-15188MEDIUM 6.3

  A vulnerability in the django-job-portal application allows authenticated users to bypass access controls by manipulating the 'role' parameter in the Employee Dashboard endpoint. This could enable a logged-in employee to view, modify, or delete information they shouldn't have access to, such as salary data, performance reviews, or other employees' records. The flaw affects the EditEmployeeProfileAPIView function and requires an attacker to already have valid login credentials.

• CVE-2026-45157MEDIUM 6.3

  A vulnerability in Nextcloud Server allows a malicious user who has been granted access to a shared file to bypass intended restrictions and view temporary upload files during an ongoing chunked file transfer. The attacker leverages the share token—credentials normally intended only for accessing the shared file—to gain unauthorized access to the file upload staging area. This exposure occurs across specific versions of both the open-source Nextcloud Server and Nextcloud Enterprise Server.

• CVE-2026-46416MEDIUM 6.3

  Microsoft UFO, an open-source intelligent automation framework, has a flaw in how it manages WebSocket connections used for remote automation across devices and platforms. The vulnerability stems from improper reuse of a shared connection handler that processes authenticated user requests. When multiple users connect simultaneously, their connection contexts get mixed up—specifically, responses intended for one user can be delivered to another user who connected most recently. This allows an authenticated attacker to intercept and view responses that were meant for a different authenticated session, potentially exposing sensitive automation results or command outputs.

• CVE-2026-40713MEDIUM 6.1

  Dell ThinOS 10 devices running versions before 2602_10.0765 have a flaw that allows someone with physical access to the device—without needing to log in—to view sensitive information stored on it. This is a medium-severity issue because it requires hands-on access to the hardware, but once someone has that access, the controls meant to protect data don't work properly.

• CVE-2026-46770MEDIUM 6.1

  Oracle Application Development Framework (ADF), a core component of Oracle Fusion Middleware, contains a security flaw that allows an attacker to access or modify sensitive data without authentication. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. An attacker needs only network access and must trick a legitimate user into taking an action—such as clicking a malicious link—to trigger the vulnerability. Once successful, the attacker gains the ability to read or alter data within the ADF application, potentially affecting downstream systems that rely on it. This is not currently a known or active exploit in the wild, but it warrants prompt attention given the data-access implications.

• CVE-2026-46812MEDIUM 6.1

  Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain an authentication flaw that allows an unauthenticated network attacker to read or modify data within the application. The vulnerability requires a user to interact with a malicious request, but successful exploitation can affect not only Access Manager itself but potentially other connected systems. This is a medium-severity issue with network-accessible attack vectors and no special privileges required for initial access.

• CVE-2026-46768MEDIUM 6.0

  A denial-of-service vulnerability exists in Oracle VM VirtualBox 7.2.8 that allows a high-privileged user with local access to crash or hang the hypervisor. The issue resides in the VMSVGA device component and requires administrator-level credentials to trigger, but when exploited, can render the virtualization platform unavailable and potentially affect guest virtual machines. The vulnerability does not compromise data confidentiality or integrity—it is purely an availability threat.

• CVE-2026-46825MEDIUM 6.0

  CVE-2026-46825 is a medium-severity vulnerability in Oracle VM VirtualBox 7.2.8 affecting the VMSVGA device driver. A user with high system privileges can modify or delete critical data within VirtualBox or data accessible through it. The vulnerability requires local access and elevated privileges to exploit, but can impact not only VirtualBox itself but also systems and data it manages. Oracle has classified this as a scope-change issue, meaning an attacker could potentially affect resources beyond VirtualBox's immediate boundary.

• CVE-2026-48529MEDIUM 6.0

  GitHub MCP Server versions 0.22.0 through 1.1.1 contain a critical session isolation flaw when running in HTTP mode with lockdown mode enabled. The server caches GraphQL credentials from the first authenticated user and reuses those credentials for all subsequent users, meaning later users' lockdown-related queries execute under the initial user's permissions rather than their own. This breaks the intended access control boundary and allows users to inadvertently access resources they shouldn't see.

• CVE-2026-35067MEDIUM 5.7

  Dell PowerFlex Manager versions before 5.1.0.1 contain a flaw in how access is controlled that could allow someone already on your network with limited user privileges to gain higher-level administrative access or view sensitive data they shouldn't see. An attacker would need to be on the same network segment as the system and have at least basic user credentials to attempt this attack.

• CVE-2025-24165MEDIUM 5.5

  A permissions enforcement gap in macOS allows applications to trigger unexpected system shutdowns. The vulnerability stems from insufficient access controls that permit an app—without requiring special privileges or admin credentials—to initiate a termination condition. Apple addressed this by reinforcing permission checks across the affected operating system versions. The attack requires user interaction (such as running or interacting with a malicious app), but does not require the user to have special knowledge of the vulnerability.

• CVE-2025-43339MEDIUM 5.5

  A sandbox isolation weakness in macOS Tahoe allows a malicious app running with user privileges to read sensitive user data that should have been protected. The vulnerability does not allow the attacker to modify data or crash the system, only to view it. Apple has patched this in macOS Tahoe 26.1 by strengthening sandbox restrictions.

• CVE-2026-13914MEDIUM 5.5

  Google Chrome on macOS contains a vulnerability in its password handling that could allow a local attacker to read sensitive data from the browser's memory if the user interacts with a specially crafted file. The vulnerability affects Chrome versions before 150.0.7871.47 on Mac systems. An attacker would need local access to the affected system and require user interaction to trigger the vulnerability, but no special privileges are needed to exploit it.

• CVE-2026-20259MEDIUM 5.5

  A vulnerability in Splunk Enterprise and Splunk Cloud Platform allows authenticated users with the `edit_saved_search_owner` capability to reassign ownership of saved searches to any user, including those outside their normal scope of access. The affected endpoint lacks proper authorization checks, creating an avenue for privilege escalation or lateral movement within Splunk deployments. The vulnerability requires an authenticated attacker with a specific high-privilege role, limiting but not eliminating risk in environments where role delegation is common.

• CVE-2026-11466MEDIUM 5.4

  Zilliz's deep-searcher library contains an access control vulnerability in its collection routing logic. An authenticated attacker can manipulate function arguments to bypass intended restrictions, gaining unauthorized read access to data or causing service disruption. The issue affects versions up to 0.0.2, and exploit code is now publicly available, raising the risk of opportunistic attacks.

• CVE-2026-14614MEDIUM 5.4

  Keycloak administrators with limited permissions can bypass access controls to modify hidden client scopes—settings that control what data and permissions get added to security tokens. By exploiting this flaw, a restricted admin could inject unauthorized permissions into tokens issued to end-users, potentially granting other applications unintended access. This affects Keycloak installations using the Fine-Grained Admin Permissions v2 feature.

• CVE-2026-44783MEDIUM 5.4

  Discourse, a popular open-source discussion platform, contains a flaw in how it handles replies to whisper posts. The vulnerability allows authenticated users who are not members of groups configured to access whispers to inject messages into staff-only whisper channels. This means someone with a regular user account could post messages that appear alongside legitimate staff whispers, potentially disrupting internal conversations or spreading misinformation among staff members. The vulnerability affects versions released between early 2026 and April 2026, and has been patched in all active release branches.

• CVE-2026-44958MEDIUM 5.4

  Revive Adserver versions 6.0.6 and earlier contain a flaw that allows advertiser-level users to toggle banner advertisements on and off without proper authorization. An attacker with basic advertiser credentials can activate or deactivate banners belonging to other accounts or campaigns, disrupting ad delivery even if they lack permission to make such changes. The vulnerability stems from inadequate permission checks in the banner management interface.

• CVE-2026-48928MEDIUM 5.4

  Node.js has a flaw in how it validates hostnames during mutual TLS (mTLS) authentication. When applications use mTLS across multiple security contexts, the inconsistent hostname matching logic can allow an authenticated user to bypass trust policies they shouldn't have access to. The vulnerability requires the attacker to already have valid credentials, limiting the immediate blast radius, but the trust-policy bypass itself creates a privilege escalation or lateral movement path in zero-trust or multi-tenant environments.

• CVE-2026-56823MEDIUM 5.4

  AutoGPT, a workflow automation platform for managing AI agents, contains an access control vulnerability in its webhook management feature. An authenticated user can request information about any webhook in the system by guessing or iterating through webhook IDs, discovering whether webhooks exist and what OAuth provider they use. In some cases, an attacker can also trigger webhook delivery events on behalf of another user. The vulnerability requires authentication but allows horizontal privilege escalation—a user with legitimate access can probe other users' integrations.

• CVE-2026-9522MEDIUM 5.4

  Devolutions Server versions 2026.1.19 and earlier contain an access control weakness in the PAM (Privileged Access Management) account discovery feature. An authenticated user without admin rights can delete network discovery scan configurations that they shouldn't be able to modify. This means non-privileged users can disrupt the organization's ability to discover and inventory network accounts, potentially hindering PAM operations and compliance visibility.

• CVE-2024-27891MEDIUM 5.3

  Arista EOS devices that simultaneously use MACsec (a security protocol encrypting layer 2 traffic) and egress Access Control Lists (ACLs) on the same network interfaces may fail to enforce the intended ACL policies on outgoing traffic. This means packets that should be blocked by policy could be allowed to leave the device, or conversely, traffic that should be permitted might be incorrectly denied—effectively breaking the network's egress filtering controls.

• CVE-2025-46308MEDIUM 5.3

  Apple has addressed an authorization flaw affecting iOS, iPadOS, and macOS that could allow installed apps to access sensitive user information without proper permission checks. The vulnerability stems from inadequate state management in the platform's authorization framework. While the issue requires a malicious or compromised app to be present on a device, the potential for information disclosure makes this a meaningful security concern for users managing sensitive data. This is not currently known to be exploited in the wild, but the low barrier to exploitation (no user interaction required, network accessible) warrants timely patching.

• CVE-2026-10255MEDIUM 5.3

  A remote access control weakness exists in SourceCodester Pharmacy Sales and Inventory System version 1.0. An unauthenticated attacker can exploit the sell_statement function in the application's form controller to bypass authorization checks and gain unauthorized read access to sensitive pharmacy data. The vulnerability requires no special interaction from users and can be triggered over the network. Because exploit code has already been publicly disclosed, active exploitation risk is elevated.

• CVE-2026-11458MEDIUM 5.3

  A flaw in erzhongxmu JeeWMS allows unauthenticated attackers to access sensitive information through an exposed Boot Actuator Endpoint at /base-boot/actuator. The vulnerability requires no special conditions to exploit and can be triggered over the network. While the issue is rated MEDIUM severity and does not allow data modification or system disruption, the information disclosure risk warrants prompt remediation. Public exploit code is available, increasing the likelihood of opportunistic attacks.

• CVE-2026-12203MEDIUM 5.3

  HKUDS AI-Trader contains a flaw in its research export functionality that allows unauthenticated attackers to access sensitive information through the /api/research/agents.csv endpoint. An attacker can remotely exploit this vulnerability without user interaction to retrieve confidential data. The issue stems from insufficient access controls on the export feature. Public exploit code exists for this vulnerability. The vendor has addressed this by enforcing authentication and capability-based authorization on research export endpoints.

• CVE-2026-13933MEDIUM 5.3

  A vulnerability in Google Chrome versions before 150.0.7871.47 could allow an attacker who has already compromised Chrome's renderer process to read sensitive information from the browser's memory by tricking a user into visiting a malicious webpage. The attacker needs to have control of the renderer process first, limiting the scope of direct risk, but the ability to extract password-related data from memory represents a meaningful escalation once that foothold exists.

• CVE-2026-20909MEDIUM 5.3

  Gitea, a self-hosted Git service platform, contains a permission validation flaw in its time tracking feature. Versions before 1.25.5 allow unauthenticated or low-privileged users to view time entries that should be restricted to authorized personnel. An attacker can enumerate sensitive project timing data without proper authorization, potentially exposing work patterns, project schedules, or other operational details that should remain confidential within a repository.

• CVE-2026-41837MEDIUM 5.3

  Spring Data REST's filtering feature bypasses Jackson customizations when processing user-supplied filter parameters, potentially allowing attackers to access sensitive object properties that should be restricted. An unauthenticated attacker can craft malicious filter requests to extract unauthorized information from the application's data layer without modifying or disrupting service.

• CVE-2026-46842MEDIUM 5.3

  Oracle REST Data Services versions 24.2.0 through 26.1.0 contain a vulnerability that allows an unauthenticated attacker to modify, add, or delete data accessible through the service over the network. The vulnerability requires no special conditions to exploit and can be triggered via standard HTTPS connections. While an attacker cannot read data or crash the service, they can alter stored information, which poses a direct integrity risk to applications relying on ORDS for data access.

• CVE-2026-47200MEDIUM 5.3

  Nuxt, a popular Vue.js web development framework, has a vulnerability where certain server-side page components are exposed over HTTP without proper security checks when a feature called Component Islands is enabled. This exposure allows unauthorized access to sensitive functionality that should only be available to authenticated users or through protected routes. The vulnerability affects Nuxt versions 3.11.0 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5, as well as the related @nuxt/nitro-server package in the same version ranges.

• CVE-2026-9590MEDIUM 5.3

  Devolutions Server versions up to and including 2026.1.19 contain an access control weakness that allows authenticated users with permission to edit entries to modify asset information beyond their intended scope. An attacker with entry edit privileges can bypass the permission validation checks and alter assets they shouldn't be able to access, potentially compromising the integrity of credential and asset data within the server.

• CVE-2026-41984MEDIUM 5.2

  CVE-2026-41984 is a use-after-free (UAF) vulnerability discovered in a package management module. Use-after-free flaws occur when software attempts to access memory that has already been freed, potentially allowing an attacker to corrupt data or disrupt service. This particular issue requires high-level privileges to exploit and is unlikely to be triggered accidentally, but successful exploitation could compromise the integrity of the affected service.

• CVE-2026-41985MEDIUM 5.1

  CVE-2026-41985 is a medium-severity memory safety defect in a package management module that can be exploited to disrupt service availability and data integrity. The vulnerability requires local system access, elevated user privileges, and user interaction to trigger, which constrains its real-world attack surface but does not eliminate its risk in insider threat or multi-stage compromise scenarios.

• CVE-2026-42862MEDIUM 5.0

  Flowise, a popular drag-and-drop interface for building custom AI language model workflows, contains a security flaw that allows authenticated users to move tools between workspaces without proper authorization. When updating a tool, the application fails to validate who should have permission to change ownership fields like workspaceId. An attacker with legitimate access to one workspace can reassign tools to a different workspace, potentially exposing or stealing AI workflows, data pipelines, or proprietary configurations belonging to another team or customer. This breaks the isolation that multi-workspace Flowise deployments rely on to keep organizations separate.

• CVE-2026-48956MEDIUM 5.0

  Joomla! contains an access control weakness that allows authenticated users to view a list of installed modules through the frontend interface. While an attacker needs valid login credentials to exploit this, the improper permission check exposes internal system information that should remain hidden from regular users. This information disclosure could help an attacker plan more targeted attacks against the application.

• CVE-2026-48947MEDIUM 4.9

  CVE-2026-48947 is a medium-severity access control flaw in Joomla that allows privileged users to overwrite media files even when they lack explicit editing permissions. The vulnerability stems from an improper check during file operations, enabling privilege escalation within the application's permission model. While the issue requires an authenticated attacker with elevated privileges, it can lead to unauthorized modification of critical media assets.

• CVE-2026-49198MEDIUM 4.9

  CVE-2026-49198 is a medium-severity access control flaw in Acer Predator Connect W6X MQTT brokers that allows high-privileged users to subscribe to wildcard topics, inadvertently gaining visibility into all MQTT traffic flowing through the system. While the vulnerability requires authenticated access with elevated permissions, once exploited it enables an insider or compromised admin account to eavesdrop on sensitive IoT communication without additional authorization constraints. This is a confidentiality risk with no impact to system availability or integrity.

• CVE-2026-26145MEDIUM 4.8

  Azure Synapse contains an access control weakness that allows an already-authenticated user to gain elevated privileges through network interaction. An attacker with valid credentials can exploit improper permission enforcement to access capabilities or data they should not be able to reach, provided the victim performs a specific action. The vulnerability requires high effort to exploit and does not enable lateral movement to other systems or direct data modification.

• CVE-2026-41847MEDIUM 4.8

  Spring WebFlux applications using Kotlin Router DSL are vulnerable to a security bypass that could allow an attacker to circumvent intended access controls. The issue affects Spring Framework versions 5.3.0 through 5.3.48 and requires specific configuration conditions to exploit, making it a moderate-severity concern for teams running these versions in production.

• CVE-2026-11621MEDIUM 4.7

  Dcat-Admin versions up to 2.2.3-beta contain a file upload vulnerability in the User Setting Page. An authenticated administrator can upload arbitrary files by manipulating the image upload parameter in the editor component, potentially leading to code execution or data compromise. The vulnerability requires high-level privileges but poses a meaningful risk in multi-user admin environments.

• CVE-2026-46772MEDIUM 4.7

  Oracle's Application Development Framework (ADF), a core component of Fusion Middleware, contains a privilege-escalation vulnerability affecting versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with high-level administrative access and direct infrastructure access could exploit insufficient privilege controls to read sensitive application data or modify certain records. The attack is not trivial—it requires both elevated credentials and specific configuration conditions—but poses meaningful risk to organizations running vulnerable ADF instances, particularly those handling sensitive business data through ADF-based applications.

• CVE-2026-36180MEDIUM 4.6

  GNCC GP5 version 7.1.76 has a security weakness that allows an attacker with physical access to the machine to temporarily modify read-only system files and binaries during a single boot session. The vulnerability exploits bind-mount mechanisms—a Linux/Unix filesystem technique—to circumvent protections meant to keep critical system files locked down. While the attacker needs to be physically present and the changes only persist until reboot, this represents a meaningful integrity risk for systems in shared, controlled, or potentially hostile physical environments.

• CVE-2026-45284MEDIUM 4.6

  Nextcloud's OIDC (OpenID Connect) user authentication module contains a flaw that allows deleted LDAP users to continue authenticating to the system. When an organization uses both LDAP and OIDC for user management, deletion of a user from LDAP does not properly prevent that user from logging in via OIDC. This creates an unintended persistence of access for users who should no longer have system privileges. The issue affects Nextcloud versions 1.3.6 through 8.3.x and has been resolved in version 8.4.0.

• CVE-2026-11212MEDIUM 4.3

  A vulnerability in Google Chrome's developer tools (DevTools) fails to properly enforce security policies that should prevent extensions from accessing data across different websites. An attacker could trick a user into installing a malicious Chrome extension, which could then exploit this flaw to steal sensitive information from websites the user visits. The issue affects Chrome versions before 149.0.7827.53.

• CVE-2026-11252MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it enforces content policies that could allow an attacker to bypass certain access controls through a specially crafted web page. The vulnerability requires user interaction—an attacker would need to trick someone into visiting a malicious page—but does not leak sensitive data or crash the browser. Instead, it could allow unauthorized modification of content or settings the user intended to protect.

• CVE-2026-11257MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser implements navigation controls. An attacker can craft a malicious HTML page that, when visited by a user, bypasses the browser's built-in restrictions on where a page can navigate. This allows the attacker to redirect the user to unintended destinations or perform unwanted navigation actions, potentially leading to phishing, credential harvesting, or distribution of malware. The vulnerability requires user interaction (clicking or visiting the page) and affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11274MEDIUM 4.3

  A flaw in Google Chrome's DOM Distiller component on iOS allows attackers to bypass navigation restrictions through a specially crafted web page. The vulnerability requires user interaction to trigger—specifically, the victim must visit or interact with a malicious page. The impact is limited to breaking navigation boundaries; no data theft or system crashes are involved. Chrome versions prior to 149.0.7827.53 on iOS are affected.

• CVE-2026-11277MEDIUM 4.3

  A vulnerability in Chrome for iOS allows an attacker to bypass certain access controls through a specially crafted HTML page. The issue stems from insufficient enforcement of security policies in the iOS version of Chrome. An attacker would need to trick a user into visiting a malicious webpage, but no special user privileges are required and the attack is straightforward to execute. The primary risk is unauthorized modification of data or application behavior—not data theft or system crashes.

• CVE-2026-11302MEDIUM 4.3

  A security flaw in Google Chrome for iOS allows attackers to bypass access controls through a specially crafted web page. The vulnerability requires user interaction—a person must visit the malicious page—but does not require any special privileges or system access to attempt exploitation. While Chromium's internal assessment classified this as low severity, the CVSS score of 4.3 reflects moderate concern, primarily because it can lead to unauthorized actions or changes within the browser's trust model, though it does not expose sensitive data or crash the application.

• CVE-2026-11890MEDIUM 4.3

  Devolutions Server versions 2026.2.5 and 2026.1.21 contain an access control flaw that allows any authenticated user to view account discovery scan results they should not have permission to access. An attacker with valid credentials to the server can retrieve sensitive account information gathered during automated discovery scans, potentially exposing credentials or account details that should be restricted to authorized administrators.

• CVE-2026-12212MEDIUM 4.3

  A flaw in hcengineering's Huly Platform versions up to 0.7.0 allows authenticated users to access sensitive mailbox secrets they should not be able to read. The vulnerability resides in the RPC interface used to manage account operations and stems from weak access controls on a specific function. An attacker with valid credentials can exploit this remotely to view confidential data. Public disclosure has already occurred, and the vendor has not responded to early notification attempts.

• CVE-2026-14003MEDIUM 4.3

  A flaw in how Google Chrome enforces security policies for extensions allows a malicious extension to access and leak data from websites you visit across different origins—essentially reading information it shouldn't have access to. An attacker would need to trick you into installing a malicious extension first, but once installed, the extension can quietly exfiltrate sensitive cross-origin data without additional user interaction. This affects Chrome versions before 150.0.7871.47.

• CVE-2026-14034MEDIUM 4.3

  CVE-2026-14034 is a navigation-bypass vulnerability in Google Chrome's WebXR implementation on Android. An attacker can craft a malicious HTML page that, when visited by a user, circumvents browser navigation restrictions. While the underlying Chromium severity is rated Low, the CVSS score of 4.3 reflects the requirement for user interaction and limited direct impact. The vulnerability does not enable data theft or system crashes but does allow unauthorized page navigation, which could facilitate phishing or redirect attacks.

• CVE-2026-14052MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw that allows attackers to bypass file system access restrictions through a specially crafted web page. An attacker would need to trick a user into visiting a malicious site, but once there, the vulnerability could allow unauthorized file operations that would normally be blocked by the browser's security policies.

• CVE-2026-14613MEDIUM 4.3

  Keycloak's administrative interface contains an authorization flaw in its Fine-Grained Admin Permissions v2 system. When this feature is enabled, administrators granted permission to view specific roles can inadvertently see all groups linked to those roles, regardless of whether they have been granted access to those groups. This bypasses intended access controls and exposes group information—including internal identifiers and custom configurations—to administrators who should be restricted from viewing it. The vulnerability requires administrative credentials to exploit, limiting immediate risk, but undermines the security model for organizations using Keycloak to enforce role-based administrative separation.

• CVE-2026-15329MEDIUM 4.3

  CowAgent, an open-source AI agent framework, contains a vulnerability in its Browser Tool component that can leak sensitive information to authenticated users. The flaw exists in the navigation function and requires an attacker to already have login credentials. While the technical bar to exploit this is low and a proof-of-concept has been publicly released, the impact is limited to information disclosure affecting only the confidentiality of data, not its integrity or availability.

• CVE-2026-34912MEDIUM 4.3

  Revive Adserver contains a flaw that allows users with basic system access to improperly link advertising banners or campaigns to advertising zones they don't own. Specifically, a low-privileged user can modify zone-include.php or use the API to associate their zones with banners or campaigns managed by other user accounts on the same server. This breaks the expected ownership model, potentially allowing unauthorized modification of advertising relationships across accounts. The vendor has added validation logic to prevent this cross-account linking.

• CVE-2026-34913MEDIUM 4.3

  Revive Adserver versions 6.0.6 and earlier contain a flaw that allows account users with limited permissions to improperly link tracking tools to advertising campaigns they do not own. The vulnerability stems from inadequate permission checks in the campaign-trackers.php file. An attacker with basic user credentials could reassign trackers across different advertiser accounts, creating ownership confusion and potentially manipulating reporting or tracking data. Patched versions validate that campaigns can only be associated with trackers belonging to the same advertiser, restoring proper access boundaries.

• CVE-2026-35162MEDIUM 4.3

  Dell PowerFlex Manager versions before 5.1.0.1 have an access control flaw that allows low-privilege remote users to trigger denial-of-service conditions. While the attacker needs valid credentials, the barrier to exploitation is relatively low, and the impact centers on service availability rather than data compromise.

• CVE-2026-41123MEDIUM 4.3

  Dell PowerProtect Data Domain contains a flaw in its role-based access control (RBAC) system that allows a low-privileged remote user to modify or tamper with information they shouldn't be able to access. While an attacker cannot read sensitive data or disrupt service availability through this vulnerability, the ability to alter information represents a meaningful integrity risk—particularly critical for a backup and data protection appliance where data trustworthiness is paramount.

• CVE-2026-41160MEDIUM 4.3

  EspoCRM contains a logic flaw that allows lower-privileged users to pin notes they don't have permission to edit. The vulnerability stems from a timing issue in the API backend: the system modifies the note in the database before checking whether the user is actually authorized to do so. Even though the server returns an error message afterward, the damage is already done—the note remains pinned. This affects EspoCRM versions before 9.3.5.

• CVE-2026-44957MEDIUM 4.3

  Revive Adserver versions 6.0.6 and earlier contain a flaw in their XML-RPC API that fails to properly verify user permissions when reassigning entities to different parent entities. An attacker with low-level API access cannot exploit this vulnerability alone; they would need either a separate critical vulnerability (CVE-2026-34917) or a custom third-party extension to reach the vulnerable code. When those conditions align, an attacker could reassign entities without authorization, creating inconsistent ownership relationships that may allow lateral privilege expansion or data manipulation.

• CVE-2026-45264MEDIUM 4.3

  Nextcloud versions spanning 17.0.0 through 21.0.3 contain a permission bypass vulnerability that allows users with read and create access—but explicitly not update access—to rename files within team folders. This unintended capability undermines the granular permission model Nextcloud enforces, potentially enabling unauthorized modification of file metadata and organizational disruption. The issue affects a broad version range and has been patched across all active release lines.

• CVE-2026-45776MEDIUM 4.3

  OpenXDMoD is an open-source framework used by HPC (high-performance computing) centers to collect and monitor system performance metrics. Versions before 11.0.3 contain a session-handling flaw that allows an authenticated attacker to manipulate authorization checks. If an installation includes the optional Job Performance (SUPReMM) module, an attacker could view other users' job efficiency data they shouldn't have access to. The vulnerability requires an existing login but does not require admin privileges.

• CVE-2026-50739MEDIUM 4.3

  A flaw in Revive Adserver allows low-privileged users to associate their tracking tools with advertising campaigns owned by other managers on the same server. This happens because a security fix applied to one direction of the linking process was not extended to the reverse operation, creating an inconsistency that attackers can exploit. The vulnerability affects Revive Adserver version 6.0.7 and earlier.

• CVE-2026-50744MEDIUM 4.3

  Revive Adserver 6.0.7 contains a flaw in its XML-RPC authentication system. When an administrator login attempt is made via the ox.login API method, the server returns an error message—as intended—but inadvertently creates a valid session ID and sends it back in the HTTP response headers anyway. An attacker with basic API access can intercept this session ID and use it to bypass the admin-only restriction, gaining unrestricted access to sensitive API functions without needing actual admin credentials.

• CVE-2026-56217MEDIUM 4.3

  Capgo versions before 12.128.2 contain a vulnerability that lets attackers with API access weaken the security of app updates. Specifically, attackers can bypass organization policies that require app updates to be encrypted by directly manipulating the database to remove encryption keys, allowing them to force apps to accept unencrypted updates. This is a policy-enforcement gap rather than a fundamental cryptographic break, but it does undermine intentional security controls that teams put in place.

• CVE-2026-56334MEDIUM 4.3

  Capgo versions before 12.128.2 are missing a critical access control rule in their database that allows build status updates to be saved. Without this rule, when API keys or anonymous users attempt to update the status of build requests, those updates don't get persisted to the database. This leaves build jobs stuck in a 'pending' state indefinitely, with no error details recorded, making it impossible to know why builds are failing or what went wrong.

• CVE-2026-12460MEDIUM 4.2

  Google Chrome versions prior to 149.0.7827.155 contain a weakness in how the browser enforces file system access policies. An attacker who has already compromised Chrome's renderer process (the part that executes web content) can exploit this flaw by serving a specially crafted PDF file to bypass Site Isolation—Chrome's security feature that isolates web content from different sites. The vulnerability requires both an existing renderer compromise and user interaction, limiting its standalone exploitability but reflecting a real protection gap once a renderer is already under attacker control.

• CVE-2026-46771MEDIUM 4.1

  CVE-2026-46771 is a localized privilege-escalation vulnerability in Oracle Application Development Framework (ADF) that allows a highly privileged attacker already logged into the infrastructure to access sensitive application data. The attacker must be an administrative user on the machine running ADF, and even then exploiting it requires specific conditions to be met. The primary risk is unauthorized disclosure of data within ADF systems—the vulnerability does not enable attackers to modify or delete data, nor does it allow takeover of the ADF service itself.

• CVE-2025-15619LOW 3.5

  HCL Connections has a broken access control flaw that creates a narrow but real window for unauthorized viewing of sensitive data. An authenticated attacker can, under specific conditions and with user interaction, bypass intended access restrictions and view information they shouldn't be able to access. The vulnerability is not network-exploitable without valid login credentials, and the exposure is limited to a single defined scenario rather than widespread data exposure.

• CVE-2026-45266LOW 3.5

  A flaw in Nextcloud allows any authenticated user to remotely mute other participants' microphones during calls, but only when the deployment lacks a High-performance Backend configuration. This is a low-severity integrity issue that affects call participants' ability to communicate via audio.

• CVE-2026-11459LOW 3.3

  SecureAge CatchPulse versions up to 10.9.3 contain a vulnerability in the saappctl.sys driver that can leak sensitive information to authenticated local users. An attacker with a valid local account on the affected system can trigger the IOCTL handler to access data they shouldn't normally see. The vulnerability has been publicly disclosed and active exploitation is possible, though it requires legitimate access to the target machine.

• CVE-2026-48936LOW 3.3

  Node.js 26 contains a weakness in its Permission API that allows a local attacker to start a server using a Unix domain socket even when the `--allow-net` permission flag has not been granted. This bypasses the intended access control mechanism, potentially allowing unauthorized network binding on the local system. The vulnerability requires local access and is limited in scope—it does not expose confidentiality or availability, but it does undermine the integrity of the permission model by enabling unintended network operations.