By severity

High-severity vulnerabilities

CVEs rated High by CVSS, with SEC.co remediation and prioritization guidance.

2297 published vulnerabilities · page 23 of 23

• CVE-2026-45437HIGH 7.1

  The Product Filter Widget for Elementor—a popular WordPress page builder plugin—contains an unauthenticated cross-site scripting (XSS) vulnerability in versions 1.0.6 and earlier. An attacker can inject malicious scripts into the widget's filter functionality without requiring authentication, which execute in the browsers of site visitors. The vulnerability is triggered when a user interacts with the affected filter, potentially compromising visitor sessions, stealing credentials, or redirecting users to malicious sites.

• CVE-2026-45542HIGH 7.1

  A heap buffer overflow vulnerability exists in Espressif's IoT Development Framework (ESP-IDF) affecting the Security Scheme 2 (SRP6a) component used during initial device provisioning and session setup. When a device receives a provisioning request with a specially crafted username field, the security handler copies the user-supplied length into a smaller buffer than intended, corrupting heap memory and potentially causing the device to crash or behave unpredictably. An attacker within network range of the target device can trigger this without authentication.

• CVE-2026-45649HIGH 7.1

  A flaw in Microsoft Office apps on Android devices allows someone with local access to spoof or impersonate document content without requiring special permissions or user interaction beyond launching the app. An attacker with physical or logical access to the device could manipulate what appears in Word, Excel, or PowerPoint documents, potentially tricking the device owner or others into trusting falsified information. The vulnerability affects the access control layer that should prevent unauthorized modification of displayed document content.

• CVE-2026-45722HIGH 7.1

  A vulnerability in Nextcloud's Tables app allows authenticated users to inject malicious SQL code through the ORDER BY clause of database queries. While this type of SQL injection is more limited than typical variants—attackers can extract only small amounts of data per request or cause database delays—it still poses a meaningful confidentiality and availability risk. The flaw affects Nextcloud Tables versions 0.9.0 through 0.9.6 and 1.0.0 through 1.0.1. Nextcloud has released patches that organizations should apply promptly.

• CVE-2026-46130HIGH 7.1

  A bug in the Linux kernel's dm-verity-fec (forward error correction) component can cause it to read data from outside the intended memory buffer. This occurs when parity bytes used to verify disk integrity are split across storage blocks in a specific way. Under certain non-default configurations and low-memory conditions, the code attempts to access more data than is available, leading to potential information disclosure or system instability. The issue only manifests with particular combinations of error correction parameters and buffer allocation scenarios.

• CVE-2026-46140HIGH 7.1

  A flaw in the Linux kernel's Bluetooth driver (btmtk) fails to verify that incoming firmware responses contain sufficient data before reading from them. If a Bluetooth device sends a truncated or malformed response, the kernel code will read beyond the valid data boundaries, potentially exposing sensitive kernel memory. A local attacker with Bluetooth access could exploit this to leak information or crash the system.

• CVE-2026-46149HIGH 7.1

  A vulnerability in the Linux kernel's SCSI target subsystem allows a local attacker with low privileges to read sensitive kernel memory and potentially crash the system. The issue occurs in the configfs interface where storage path group membership information is displayed. When a storage fabric's name is unusually long, the kernel writes more data than expected to a temporary buffer, and then copies that overrun data to a user-readable sysfs file. On systems with fortify checks enabled, this causes a kernel panic; on others, it leaks kernel memory to unprivileged users.

• CVE-2026-46150HIGH 7.1

  A flaw in the Linux kernel's fanotify file monitoring subsystem can allow a local user with minimal privileges to bypass permission checks on file access events. The vulnerability stems from a logic error where the kernel incorrectly returns false for marks belonging to unrelated monitoring groups, causing permission event validation to be skipped. An attacker with local access could exploit this to circumvent intended file access restrictions.

• CVE-2026-46175HIGH 7.1

  A flaw in the Linux kernel's F2FS (Flash-Friendly File System) garbage collection process can cause the system to incorrectly track file metadata during node block migration. When the garbage collector moves data blocks, it fails to properly clear internal markers that indicate whether data has been explicitly synced by a user. This confusion causes file system consistency checks (fsck) to report false inconsistencies, potentially leading to data integrity warnings or failures. The issue is triggered by specific sequences of file creation, deletion, and garbage collection operations, particularly when the system experiences power loss after garbage collection but before a checkpoint is written.

• CVE-2026-46190HIGH 7.1

  A memory access flaw exists in the Linux kernel's SPI NOR flash debugging code. When displaying flash chip parameters through the debugfs interface, the kernel incorrectly calculates the size of an internal lookup table, treating the table's byte-size instead of its element count. This can cause the kernel to read memory beyond the intended bounds when processing certain flag values. An unprivileged local user could exploit this to crash the system or potentially leak sensitive kernel memory.

• CVE-2026-46191HIGH 7.1

  CVE-2026-46191 is a memory access vulnerability in the Linux kernel's framebuffer console (fbcon) subsystem. When the kernel attempts to rotate the console display and the memory reallocation fails, it continues using an undersized font buffer. If a user then prints characters with high numeric codes to the rotated console, the kernel will write beyond the buffer's boundaries, potentially corrupting kernel memory. An attacker with local system access can trigger this by printing specific characters after inducing a console rotation failure.

• CVE-2026-46199HIGH 7.1

  A flaw in the Linux kernel's AMD GPU video codec (VCN4) driver allows a local attacker to read memory beyond the intended boundaries of a buffer when processing decode messages. An authenticated user with local access can exploit this to access sensitive kernel memory, potentially exposing confidential data or triggering a system crash. The vulnerability requires local access and valid user privileges, limiting its reach but making it a concern for multi-user systems and containerized environments.

• CVE-2026-46203HIGH 7.1

  A flaw in the Linux kernel's Cadence QuadSPI controller driver can cause the system to access hardware registers without proper power management during driver shutdown. When the driver is unloaded, it attempts to disable the controller without ensuring the hardware is powered up first, potentially causing system instability or data corruption. This is a local issue requiring user-level access to trigger.

• CVE-2026-46204HIGH 7.1

  A bounds-checking vulnerability exists in the Linux kernel's AMD GPU video codec (VCN4) instruction buffer parser. When the kernel processes instruction buffers from user space, it can read beyond allocated memory if malicious or malformed data is provided. A local attacker with basic user privileges can trigger out-of-bounds reads, potentially exposing sensitive kernel memory or causing a denial of service. The fix involves rewriting the parser to use proper bounds-checking functions.

• CVE-2026-46218HIGH 7.1

  A vulnerability exists in the Linux kernel's AMD GPU driver where video codec processing code (used for UVD, VCE, and VCN hardware) accesses memory buffers without verifying those buffers are large enough. An attacker with local access could exploit this to read sensitive kernel memory or cause a system crash. The fix adds proper bounds checking before these memory accesses and corrects an integer type to prevent overflow conditions that could bypass the checks.

• CVE-2026-46230HIGH 7.1

  A boundary-checking flaw in the Linux kernel's AMD GPU video codec driver (VCN3) allows a local user with moderate privileges to read memory beyond allocated buffer boundaries when the driver processes video decoding messages. This out-of-bounds read could expose sensitive kernel memory or crash the system. The vulnerability requires local access and existing user-level permissions to trigger.

• CVE-2026-46243HIGH 7.1

  A Linux kernel vulnerability allows unprivileged local users to manipulate CIFS (Common Internet File System) authentication credentials by creating spoofed credential requests. The vulnerability exists because the kernel's SMB client accepts cifs.spnego key descriptions that contain sensitive fields—like process ID, user ID, and credential UID—regardless of whether those fields come from the kernel itself or from untrusted userspace. An attacker with local access can forge these fields to impersonate legitimate credential requests, potentially gaining unauthorized access to network resources or intercepting authentication flows. The fix restricts acceptance of cifs.spnego keys only when they originate from the kernel's own credential handler.

• CVE-2026-46293HIGH 7.1

  A Linux kernel vulnerability exists in the Microchip PolarFire SoC clock controller driver where the software attempts to write data to memory locations outside the bounds of an allocated array during clock output registration. Specifically, when the driver registers the last two clock outputs, it accesses array indices that were never allocated, corrupting adjacent memory. This occurs because the code defines space for two PLLs and their outputs but fails to properly offset the array indices when handling DLL (Delay-Locked Loop) outputs that the driver doesn't actually support. An attacker with local access can exploit this to read sensitive kernel memory or cause a denial of service.

• CVE-2026-46321HIGH 7.1

  A memory leak vulnerability exists in the Linux kernel's TUN device driver. When a frame shorter than the Ethernet header minimum is rejected, the kernel fails to release allocated memory pages. An attacker with local access to /dev/net/tun and /dev/vhost-net can exploit this by repeatedly sending undersized frames through a vhost-net backend, exhausting system memory and potentially causing the host to crash.

• CVE-2026-46322HIGH 7.1

  A memory leak exists in the Linux kernel's TUN network device driver. When the kernel attempts to construct a network packet (skb) from XDP program data and that construction fails, it doesn't properly release a memory page that was allocated earlier in the process. This causes a small chunk of memory to leak each time this failure occurs. In batch processing scenarios—common in virtual networking—multiple failures can accumulate, gradually consuming system memory and potentially degrading performance or availability.

• CVE-2026-46657HIGH 7.1

  Bludit, a content management system, contains a flaw in how it handles user account deactivation. When an administrator disables a user account, the system fails to clear the authentication tokens stored locally. This means a user who previously selected "Remember Me" can continue accessing the system even after their account has been disabled by an administrator. The vulnerability requires the attacker to have had legitimate access before being deactivated, but once disabled, they can maintain that access indefinitely unless the underlying token data is manually cleared.

• CVE-2026-46914HIGH 7.1

  A flaw in Oracle Solaris 11.4's filesystem component allows an authenticated user on the local system to read sensitive data or crash the operating system. An attacker with standard user privileges can exploit this without needing to interact with the system graphically—it happens automatically through the vulnerable code path. The vulnerability is rated HIGH severity and poses a real risk to organizations running Solaris infrastructure, particularly those handling sensitive data or requiring high availability.

• CVE-2026-46932HIGH 7.1

  A flaw in Oracle Enterprise Asset Management allows someone with low-level network access to view sensitive data or cause service disruptions. An authenticated user (even with minimal privileges) can send specially crafted HTTP requests to the application to either read confidential information or partially disable the service. The vulnerability affects versions 12.2.3 through 12.2.15 and does not require user interaction—an attacker simply needs valid login credentials and network connectivity to the system.

• CVE-2026-47120HIGH 7.1

  Nezha Monitoring, a self-hosted monitoring tool, contains an authorization bypass flaw affecting versions 1.4.0 through 2.0.7. A user with RoleMember privileges can trigger cron tasks (scheduled automation jobs) owned by other users without proper permission checks. While the attacker cannot see the tasks' contents or modify them, they can force execution, potentially disrupting monitoring workflows or triggering unintended automated actions. The vulnerability requires authenticated access and has been fixed in version 2.0.8.

• CVE-2026-47288HIGH 7.1

  CVE-2026-47288 is a high-severity integer overflow vulnerability in Windows Kerberos authentication that allows an authenticated attacker on an adjacent network to execute arbitrary code with system-level privileges. The flaw resides in how Kerberos handles certain numeric calculations, causing a wraparound condition that can be exploited to bypass security checks and inject malicious code. An attacker must already have valid credentials and network proximity to the target, which limits the immediate blast radius but makes this a serious concern for domain environments where lateral movement is a known threat model.

• CVE-2026-4776HIGH 7.1

  Mautic, a popular marketing automation platform, contains an SQL injection flaw in its API that allows authenticated users to execute unauthorized database queries. The vulnerability stems from incomplete filtering of nested query parameters in the contact filtering API—an attacker with valid API credentials can craft specially formed requests to bypass safety checks and inject SQL commands directly into database queries. This could lead to unauthorized data access or limited system disruption, though the attacker must already have valid API authentication.

• CVE-2026-48119HIGH 7.1

  Nezha Monitoring, a self-hosted server and website monitoring tool, contains a vulnerability that allows authenticated agents to falsify monitoring results for services owned by other users. An attacker with valid agent credentials can forge service health data, creating false alerts or hiding actual service problems. The vulnerability affects versions 0.20.0 through 2.0.11 and is resolved in version 2.0.12.

• CVE-2026-48209HIGH 7.1

  OTRS ticket management systems contain a reflected cross-site scripting (XSS) vulnerability in how they handle user input during ticket operations. An attacker can craft a malicious URL containing JavaScript code and trick an authenticated agent into clicking it. When opened, the script executes within the agent's browser session, potentially allowing the attacker to steal session tokens, modify tickets, or perform actions on behalf of that agent. The attack requires social engineering to deliver the link but does not require the attacker to have direct system access.

• CVE-2026-48507HIGH 7.1

  Snipe-IT, a popular IT asset and license management system, has a privilege escalation flaw that lets low-privileged users with basic editing permissions lock all administrators out of the system. A user granted only the `users.edit` permission can disable admin accounts by toggling login flags and blocking password reset options, effectively taking control of the instance. The vulnerability affects all versions before 8.6.0 and is fixed in that release.

• CVE-2026-48569HIGH 7.1

  A flaw in Visual Studio Code's input handling allows a local attacker to circumvent a security mechanism without requiring elevated privileges or special user setup. The attacker must interact with the application through the user interface, but once triggered, the exploit can affect system-wide settings and processes beyond the application's normal scope. This is a local-attack surface issue that could allow an unauthorized actor to modify or access protected features.

• CVE-2026-48759HIGH 7.1

  TypeBot, a chatbot builder platform, contains an authorization flaw in versions 3.15.2 and earlier that allows authenticated users to modify or delete theme templates belonging to workspaces they don't have access to. The vulnerability stems from incomplete permission checks: while the application verifies that a user belongs to a workspace before processing a request, the underlying database queries fail to confirm the user has authority over the specific theme template being modified or deleted. An attacker with any TypeBot account can exploit this to tamper with or destroy another organization's chatbot themes, potentially disrupting service availability and integrity.

• CVE-2026-48827HIGH 7.1

  Apache MINA SSHD's sshd-git module contains a path traversal vulnerability that allows SSH-authenticated users to access git repositories and perform git operations (upload-pack, receive-pack, and others) outside the configured git server root directory. An attacker with valid SSH credentials can escape the intended directory boundary and potentially read or modify repositories they should not have access to. This affects only applications explicitly using the sshd-git component; standard SSHD deployments without sshd-git are unaffected.

• CVE-2026-48839HIGH 7.1

  A cross-site scripting (XSS) vulnerability exists in VeronaLabs WP Statistics plugin versions up to 14.16.6. The flaw allows attackers to inject malicious scripts that execute in a user's browser when they interact with a compromised page. Unlike traditional XSS attacks that rely on server-side injection, this variant operates at the DOM (Document Object Model) level, meaning the vulnerability stems from how the plugin processes user input on the client side. An attacker could craft a malicious link or embed code that, when visited by a site administrator or editor, steals session tokens, modifies page content, or performs actions on their behalf.

• CVE-2026-48865HIGH 7.1

  ThimPress LearnPress, a popular WordPress learning management plugin, contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. An attacker can craft a malicious URL and trick a user into clicking it, causing the victim's browser to execute arbitrary JavaScript in the context of the LearnPress application. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the user.

• CVE-2026-48867HIGH 7.1

  Quiz and Survey Master, a WordPress plugin, contains an unauthenticated cross-site scripting (XSS) vulnerability affecting versions 11.1.2 and earlier. An attacker can inject malicious scripts into web pages without requiring any authentication, potentially allowing them to steal user credentials, deface content, or redirect visitors to malicious sites. The vulnerability requires user interaction (such as clicking a link) to trigger the attack, but the widespread deployment of this plugin on WordPress sites makes it a notable risk.

• CVE-2026-48871HIGH 7.1

  A reflected cross-site scripting (XSS) vulnerability exists in MW WP Form plugin versions 5.1.3 and earlier. An attacker can craft a malicious link that, when clicked by a user visiting the site, injects arbitrary JavaScript into the page. The vulnerability requires user interaction—the victim must click the crafted link—but once triggered, the injected script runs with the privileges of the logged-in user, potentially allowing theft of session tokens, sensitive data, or administrative actions.

• CVE-2026-48966HIGH 7.1

  Funnel Builder by FunnelKit, a WordPress plugin used to create sales and marketing funnels, contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts without authentication. Because it's unauthenticated, anyone visiting an affected site or being directed to a malicious page can trigger the attack. The vulnerability affects versions 3.15.0.2 and earlier.

• CVE-2026-48997HIGH 7.1

  e107 is a content management system widely used for building websites and managing content. A vulnerability in versions 2.3.5 and earlier allows authenticated users to inject shell commands during the image resizing process. When news articles with attachments are uploaded, the system uses ImageMagick to resize images. The vulnerability exists because the destination filename for the resized image is constructed from the news article title without proper escaping. An attacker can craft a malicious title containing shell metacharacters (like backticks or variable expansion syntax) that will be executed by the underlying shell, potentially giving them control over the server. This only affects installations using specific ImageMagick settings and requires an authenticated account with sufficient permissions.

• CVE-2026-49055HIGH 7.1

  A reflected cross-site scripting (XSS) vulnerability exists in the Drag and Drop Multiple File Upload plugin for Contact Form 7 up to version 1.3.9.7. An attacker can craft a malicious link containing injected JavaScript that, when clicked by a user, executes in the victim's browser within the context of the vulnerable site. No authentication is required to exploit this flaw, and the attack succeeds through social engineering or phishing. The injected script can steal session tokens, deface content, or redirect users to malicious sites.

• CVE-2026-49069HIGH 7.1

  WPZOOM Portfolio contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages through reflected input. An attacker can craft a malicious link that, when clicked by a user, executes arbitrary JavaScript in the victim's browser. This affects WPZOOM Portfolio versions up to and including 1.4.21. The vulnerability requires user interaction—the victim must click a malicious link—but once triggered, the attack can compromise session cookies, steal sensitive data, or perform actions on behalf of the user.

• CVE-2026-49134HIGH 7.1

  CodexBar versions before 0.32.0 contain a local privilege escalation flaw in the CLI installer. An attacker with access to the same system can intercept and modify the installer's temporary files during the installation process, tricking the system into running malicious commands with root-level privileges. This requires the attacker to be on the same machine and to time their interference with an active installation, but once successful, grants complete system control.

• CVE-2026-49135HIGH 7.1

  CodexBar versions before 0.32.0 have a serious flaw in how they handle temporary files during the app release and notarization process. An attacker with access to the same machine can steal the App Store Connect API credentials or sabotage the build artifacts before they're submitted to Apple. The vulnerability exists because CodexBar writes sensitive files to predictable, fixed locations that any local user can read or manipulate.

• CVE-2026-49141HIGH 7.1

  WACRM contains an authorization flaw that allows someone with valid login credentials to view and change contact records from other customers. The vulnerability exists in the automation engine and doesn't properly verify that the attacker owns the contact they're modifying. An attacker needs only to know a contact's ID number to change things like names, email addresses, and company information across different customer accounts.

• CVE-2026-49371HIGH 7.1

  JetBrains TeamCity versions prior to 2026.1.1 contain a reflected cross-site scripting (XSS) vulnerability in the keyword filter feature. An attacker can craft a malicious URL containing unsanitized input that, when visited by a TeamCity user, executes arbitrary JavaScript in the victim's browser within the context of the TeamCity application. This allows session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

• CVE-2026-49373HIGH 7.1

  JetBrains TeamCity versions prior to 2026.1 contain a remote code execution vulnerability accessible through the Perforce connection configuration interface. An authenticated user with permissions to modify Perforce settings can execute arbitrary code on the TeamCity server. This requires valid credentials and access to TeamCity's configuration features, but does not require user interaction or special system conditions once access is gained.

• CVE-2026-49396HIGH 7.1

  Nezha Monitoring, a self-hosted server and website monitoring tool, contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick users into executing malicious cron commands on connected agents. An attacker can craft a specially designed webpage or email that, when visited by an authenticated Nezha administrator, silently triggers unwanted scheduled tasks on monitored servers. This happens because the application doesn't properly validate requests coming from external sources. The vulnerability affects all versions from 1.0.0 through 2.0.13, and has been resolved in version 2.0.14 and later.

• CVE-2026-5230HIGH 7.1

  CVE-2026-5230 is a high-severity access control flaw in MIA Technology Inc.'s Pizzy Library that allows authenticated users to bypass authorization checks and access data or functionality they shouldn't have permission to reach. The vulnerability stems from incorrectly configured security levels that fail to properly validate user privileges. Versions 1.0.0.26250 through 1.3.8.26250 are affected; upgrading to 1.3.9.26250 or later resolves the issue.

• CVE-2026-5233HIGH 7.1

  CVE-2026-5233 is a flaw in MIA Technology Inc.'s Pizzy Library that allows authenticated users to overwhelm the system by making requests at abnormally high frequencies. An attacker with valid credentials can trigger excessive interactions that degrade service availability and may corrupt or modify data in transit. The vulnerability affects versions 1.0.0.26250 through 1.3.8.26250. While it requires authentication to exploit, the damage potential—particularly availability and integrity impacts—makes this a material risk for any system using vulnerable versions.

• CVE-2026-52719HIGH 7.1

  A flaw in GStreamer's JPEG decoder allows an attacker to craft a malicious JPEG file that, when opened, causes the application to read data outside the bounds of the file buffer. This can crash the application or potentially leak sensitive information from memory. The vulnerability requires user interaction—someone must open the specially crafted file—but requires no special privileges and spreads easily via email, messaging, or web downloads.

• CVE-2026-52722HIGH 7.1

  GStreamer, a widely-used multimedia framework, contains a flaw in how it processes VMnc video streams—a format used for remote desktop and screen recording. An attacker can craft a malicious VMnc file with artificially large cursor dimensions that causes the decoder to mishandle size calculations. This integer overflow bypasses safety checks meant to prevent reading beyond allocated memory, potentially allowing the attacker to crash the application or extract sensitive data from memory. The attack requires user interaction: a victim must be tricked into opening the malicious file.

• CVE-2026-53674HIGH 7.1

  BuddyPress 14.4.0 has a flaw in how it processes @mention names when a specific username compatibility feature is enabled. Attackers can craft malicious mention text containing special regex characters that slip past the software's input sanitization, allowing them to probe the database for usernames or crash the system through resource exhaustion. The vulnerability requires an attacker to be logged in but poses meaningful risk to information disclosure and availability.

• CVE-2026-53689HIGH 7.1

  A vulnerability in libnfs (an open-source NFS client library) allows attackers to trigger an integer overflow by connecting to a malicious NFS server that sends specially crafted data. The flaw stems from insufficient validation of string sizes during data parsing, potentially allowing an attacker to cause memory corruption, information disclosure, or limited system unavailability. An attacker would need to trick a user into connecting to a compromised or attacker-controlled NFS server, making this a network-based but not trivially exploitable threat.

• CVE-2026-53703HIGH 7.1

  GStreamer's RealMedia file parser has a buffer-reading flaw that can crash applications or leak memory contents. When a malicious or malformed RealMedia (.rm) file contains an undersized audio header, the parser reads past the end of its data buffer, potentially accessing uninitialized or sensitive memory. The vulnerability requires user interaction—someone must open a crafted file—but poses a meaningful risk to applications that automatically process media files or expose the parser to untrusted sources.

• CVE-2026-53704HIGH 7.1

  GStreamer, a popular multimedia framework, contains a vulnerability in its RealMedia file parser that can be triggered by opening a malicious .rm file. The parser fails to properly validate boundaries when reading metadata, allowing crafted files to cause the application to hang indefinitely, crash, or leak memory. An attacker simply needs to trick a user into opening a specially constructed RealMedia file—no special network access or authentication is required. The flaw affects the gst-plugins-ugly package, which is commonly installed alongside GStreamer for handling restricted multimedia formats.

• CVE-2026-53840HIGH 7.1

  OpenClaw versions before 2026.5.12 inadvertently leak sensitive authentication headers—such as API keys and tenant-routing credentials—when handling cross-origin redirects through its streamable-http Model Context Protocol (MCP) servers. An attacker who controls or compromises an MCP endpoint can exploit this by redirecting requests to an attacker-controlled domain, capturing those headers in transit. This is a credential exfiltration risk that requires authentication to trigger but carries significant impact once exploited.

• CVE-2026-53842HIGH 7.1

  OpenClaw versions before 2026.5.2 contain a flaw that allows attackers with repository access to inject malicious environment variables into workspace configuration files. When users run Gmail setup commands through gcloud, the tool may be tricked into using an attacker-controlled Python interpreter instead of the legitimate one, potentially leading to arbitrary code execution on the developer's machine. The vulnerability requires user interaction (a developer running the setup process) but no special system privileges.

• CVE-2026-53846HIGH 7.1

  OpenClaw before version 2026.4.29 contains a vulnerability that allows attackers to hijack the package manager used during dependency installation. An attacker with access to a workspace can craft a malicious .env file that tricks the install process into running an unauthorized package manager executable. This could enable them to inject malicious code into the build environment and compromise software artifacts.

• CVE-2026-53858HIGH 7.1

  OpenClaw versions before 2026.5.2 contain a vulnerability that allows attackers to manipulate how the application loads software dependencies. By controlling an environment variable called STATE_DIRECTORY in a workspace configuration file, an attacker can trick OpenClaw into loading malicious code from attacker-controlled locations on the same computer. This attack requires local access and user interaction (such as a developer opening a project), but if successful, it can lead to arbitrary code execution during the dependency resolution process.

• CVE-2026-53863HIGH 7.1

  OpenClaw versions before 2026.4.25 have a flaw in how they validate group identifiers when making access control decisions for tool invocations. An attacker with basic authentication credentials can supply a crafted group ID that the system fails to properly validate, leading to incorrect policy enforcement. This could allow the attacker to invoke tools or perform actions they should not have permission to access, effectively bypassing the intended security controls that restrict who can use what tools.

• CVE-2026-53865HIGH 7.1

  OpenClaw versions before 2026.5.2 contain a vulnerability that allows a local attacker with user-level access to execute arbitrary executables on the system. The flaw exists in how the maintenance task system handles file paths: an attacker can manipulate workspace-derived environment paths to trick the system into running their chosen command instead of the intended maintenance cleanup utility. This gives an attacker the ability to run code with the privileges of the OpenClaw process during routine maintenance operations.

• CVE-2026-53915HIGH 7.1

  JetBrains GoLand before version 2026.1.3 contains a remote code execution vulnerability triggered when developers open untrusted project configurations. An attacker can craft a malicious project file that executes arbitrary code on a developer's machine without requiring any special permissions or complex user interaction beyond opening the project. This affects GoLand across all network environments.

• CVE-2026-54198HIGH 7.1

  Media Library Assistant versions 3.35 and earlier contain an unauthenticated cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application without requiring a login. An attacker can craft a malicious link and trick a user into clicking it, causing the victim's browser to execute the injected code within the context of the Media Library Assistant application. This could lead to session hijacking, credential theft, or malware distribution.

• CVE-2026-8035HIGH 7.1

  CVE-2026-8035 is a denial-of-service vulnerability in National Instruments' PAL kernel driver that allows authenticated local users to crash the system. The flaw stems from inadequate input validation that fails to check for NULL pointers before dereferencing them in memory. An attacker with local system access can exploit this by supplying malformed input to the driver, causing an immediate kernel panic. The vulnerability affects NI-PAL version 26.3.0 and all earlier releases across both Windows and Linux platforms.

• CVE-2026-8036HIGH 7.1

  NI-PAL, National Instruments' process abstraction layer, contains an input validation flaw that allows authenticated local users to read and modify arbitrary memory regions on affected systems. An attacker with local access could exploit this to escalate their privileges. The vulnerability affects NI-PAL version 26.3.0 and earlier on both Windows and Linux platforms.

• CVE-2026-8089HIGH 7.1

  The weMail WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to trick authenticated users—including administrators—into clicking malicious links. When a victim clicks a crafted URL, malicious JavaScript executes in their browser with their privileges, potentially allowing attackers to perform actions on their behalf, steal session tokens, or modify site content. The vulnerability exists because user input is not properly sanitized before being inserted into HTML attributes in AJAX responses, and the vulnerable endpoint lacks nonce protection to validate legitimate requests.

• CVE-2026-8874HIGH 7.1

  Securly Chrome Extension version 3.0.7 downloads security configuration files—specifically crisis alert keywords and filtering rules—over plain HTTP instead of the encrypted HTTPS protocol. While the same extension correctly uses HTTPS for other sensitive data (IWF and CIPA filtering data), this inconsistency leaves downloaded crisis alert configurations vulnerable to interception and modification by network-positioned attackers. An attacker on the same network could intercept these files and inject malicious keywords or rules, potentially disrupting the extension's security functionality or causing it to behave unexpectedly.

• CVE-2026-9570HIGH 7.1

  The Taskbuilder WordPress plugin before version 5.0.8 contains a reflected cross-site scripting (XSS) vulnerability in its frontend shortcode functionality. An attacker can craft a malicious URL containing JavaScript code that, when visited by a logged-in user, executes in the context of that user's browser session. The vulnerability stems from inadequate sanitization of a URL parameter before it is output directly into inline JavaScript code on the page. This allows an attacker to hijack user sessions, steal sensitive data, or perform actions on behalf of the victim within WordPress.

• CVE-2026-9808HIGH 7.1

  Mautic 7's API has a flaw where user permission restrictions aren't being honored properly. Specifically, permissions designed to let users only see or edit their own resources (called 'owner-scope' restrictions) are being bypassed. An attacker with low-level API access can exploit this to view or modify other users' data, even though they shouldn't have that permission.

• CVE-2024-38487HIGH 7.0

  CVE-2024-38487 is a container escape vulnerability affecting api-gateway containers that run with root privileges. An attacker with local access to a system running a vulnerable api-gateway container could break out of the container and gain access to the underlying host system, potentially allowing them to modify, delete, or disable critical services and data. The vulnerability requires local access and some effort to exploit, but the consequences—full host compromise—are severe.

• CVE-2026-0083HIGH 7.0

  A race condition in Android's NFC (Near Field Communication) event handling code allows a local attacker with basic system access to escalate their privileges to access sensitive data or modify system files. The vulnerability requires precise timing exploitation but no special permissions or user interaction to trigger, making it a significant local security concern.

• CVE-2026-0125HIGH 7.0

  CVE-2026-0125 is a race condition vulnerability in Android's VPU (Video Processing Unit) driver that allows a local attacker to escalate their privileges. An attacker with a low-privilege local account can trigger a use-after-free condition in the vpu_ioctl.c file by timing requests carefully, potentially gaining higher-level access to the device without needing special permissions or user interaction. This is a serious flaw because it requires only local access and basic user privileges to exploit.

• CVE-2026-34335HIGH 7.0

  A use-after-free memory vulnerability exists in Windows Ancillary Function Driver for WinSock (AFD.sys), affecting Windows 10 and Windows 11 across multiple versions, as well as Windows Server 2012 through 2025. An authenticated local attacker can exploit this flaw to escalate their privileges to SYSTEM level. The vulnerability requires local access and specific conditions to trigger, but once exploited, grants complete control over the affected system.

• CVE-2026-41108HIGH 7.0

  A memory safety flaw in Windows DNS could allow someone with local system access to break out of normal restrictions and gain full control of the computer. The vulnerability exists because DNS processes input in a way that can overflow a memory buffer, and an attacker positioned locally—such as a low-privilege user or service—could exploit this to run code with elevated permissions. This is not a remote vulnerability, but it poses a significant risk in multi-user or shared-system environments.

• CVE-2026-42462HIGH 7.0

  Fedify, a TypeScript library for building federated applications using ActivityPub, contains a vulnerability that allows attackers to manipulate cryptographically signed activities without invalidating the signatures. By exploiting JSON-LD (JSON Linked Data) restructuring techniques, an attacker who receives a validly signed activity from a third party can alter its meaning and content while the Linked Data Signature remains valid. This breaks the integrity guarantee that signatures are supposed to provide, enabling attackers to forge or modify federated messages in a way that appears authentic.

• CVE-2026-42836HIGH 7.0

  A race condition in Windows' Function Discovery Service (fdwsd.dll) allows a user already logged into a machine to escalate their privileges to administrator level. The vulnerability exists because the service does not properly synchronize access to shared resources when multiple processes run concurrently, creating a narrow window where an attacker can manipulate the process. An authorized user would need local access and specific timing to exploit this, but successful exploitation grants full system-level permissions.

• CVE-2026-42911HIGH 7.0

  A use-after-free memory vulnerability exists in Windows' Ancillary Function Driver for WinSock (AFD.sys). An attacker who already has local access to a machine can exploit this flaw to gain elevated privileges, potentially running code with system-level permissions. The vulnerability requires specific conditions to trigger—it is not trivially exploitable—but once successful grants significant control over the affected system.

• CVE-2026-42912HIGH 7.0

  A race condition in Windows Telephony Service allows an attacker who already has local user access to exploit improper synchronization of shared resources and gain system-level privileges. The vulnerability requires the attacker to perform specific timing-dependent actions during concurrent operations—making it moderately difficult to exploit in practice, but reliably escalatable once triggered. No user interaction is required beyond the attacker's ability to run code as a local user.

• CVE-2026-42984HIGH 7.0

  A use-after-free memory vulnerability exists in the Windows Kernel that allows an authorized local user to escalate their privileges to a higher level of access. An attacker with standard user permissions could exploit this flaw to gain system-level control on an affected machine. The vulnerability requires local access and specific conditions to trigger, but successful exploitation would grant complete compromise of the target system.

• CVE-2026-44495HIGH 7.0

  Axios, a widely-used HTTP client library for JavaScript applications, contains prototype-pollution gadgets that can be exploited if another vulnerability in the same process has already poisoned JavaScript's Object.prototype. The issue affects versions 0.19.0 through 0.31.0 in the 0.x branch and version 1.15.1 in the 1.x branch. By itself, Axios does not cause the initial prototype pollution; instead, it becomes a secondary target once an attacker has already compromised Object.prototype through a separate vulnerability. When this occurs, Axios may incorrectly interpret inherited properties as legitimate request configuration, leading to potential code execution or data exposure. The vulnerability is addressed in Axios 0.31.1 and 1.15.2.

• CVE-2026-44604HIGH 7.0

  A flaw in RPM's archive extraction tool allows an attacker to run arbitrary commands on a system by crafting a malicious archive with shell metacharacters embedded in its folder name. When a user extracts such an archive using the rpmuncompress utility, the unsanitized folder name is passed directly into a shell command, enabling code execution with the privileges of the extracting user. The vulnerability affects ZIP, 7z, and GEM archive formats.

• CVE-2026-44818HIGH 7.0

  A race condition vulnerability in Microsoft Office Excel could allow an attacker to execute code on a user's computer. The flaw arises from improper synchronization when multiple processes access shared resources simultaneously. An attacker would need to trick a user into opening a malicious Excel file, but once triggered, the vulnerability can grant full control over the affected system. The vulnerability affects multiple versions of Excel and Office across 365 subscriptions, on-premises deployments, and older perpetual licenses.

• CVE-2026-45596HIGH 7.0

  A use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD) allows an authenticated attacker to elevate their privileges on a local system. The vulnerability requires the attacker to already have user-level access and involves a race condition during memory management. Successfully exploiting it grants the attacker full system-level control.

• CVE-2026-45597HIGH 7.0

  A race condition vulnerability in Windows UI Automation Manager allows an authorized local user to escalate privileges on affected systems. The flaw arises from improper synchronization when multiple processes access shared resources simultaneously. An attacker with existing local access can exploit timing windows to gain system-level privileges. This is not a remote vulnerability and requires prior authentication or local access, which narrows but does not eliminate the risk in shared computing environments.

• CVE-2026-45598HIGH 7.0

  A race condition in Windows' Ancillary Function Driver for WinSock (AFD.sys) allows an attacker who already has local access to a system to escalate their privileges to a higher level. The vulnerability stems from improper synchronization when the driver handles shared resources, meaning that under specific timing conditions, an attacker can exploit the flaw to gain elevated permissions. This is not a remote attack—the attacker must already have a foothold on the machine, such as a low-privileged user account or compromised application context.

• CVE-2026-45601HIGH 7.0

  A race condition in the Windows Ancillary Function Driver for WinSock allows someone already logged into a Windows system to escalate their privileges to a higher level of access. The vulnerability arises from improper synchronization of shared resources, meaning two processes can interfere with each other when accessing the same data simultaneously. An attacker with local user privileges can exploit this timing-dependent flaw to gain elevated system rights, though doing so requires specific conditions and is not trivial to reproduce reliably.

• CVE-2026-45603HIGH 7.0

  A race condition vulnerability exists in Windows' Ancillary Function Driver for WinSock (AFD) that allows an authorized local user to escalate privileges to a higher level on the system. The flaw arises from improper synchronization when multiple processes access a shared resource simultaneously, creating a narrow window of opportunity for an attacker to manipulate the driver's behavior. An authenticated user with basic local access can exploit this to gain elevated privileges, potentially achieving full system compromise. This is not a remote vulnerability and requires the attacker already has some level of access to the target machine.

• CVE-2026-45640HIGH 7.0

  A use-after-free vulnerability in the Windows Bluetooth Port Driver permits a user with local system access to escalate their privileges to a higher level. The flaw exists because the driver fails to properly manage memory when Bluetooth port operations conclude, leaving a freed memory region accessible for malicious manipulation. An attacker must already have some level of local authentication and user rights to exploit this issue, but successful exploitation grants full system control.

• CVE-2026-45653HIGH 7.0

  A heap-based buffer overflow vulnerability in the Windows Kernel allows a user with local system access to overflow a memory buffer, enabling them to execute code with elevated privileges. The attack requires an authenticated user account and moderate technical effort to exploit, but if successful grants attacker control over the affected system. This is a local privilege escalation issue, not a remote attack vector.

• CVE-2026-46154HIGH 7.0

  A race condition exists in the Linux kernel's scheduler extension (sched_ext) cgroup interface that can lead to use-after-free memory access. When system administrators adjust cgroup scheduling parameters like weight, idle status, or bandwidth, the kernel reads a pointer to the scheduler without proper synchronization. If another process simultaneously disables and re-enables a different scheduler, the cached pointer becomes stale and points to freed memory. When the original operation tries to use this pointer, it dereferences already-freed kernel memory, potentially allowing local privilege escalation.

• CVE-2026-46164HIGH 7.0

  A memory management bug in the Linux kernel's Btrfs filesystem can cause the same memory region to be freed twice when a sysfs initialization step fails. This double-free condition can lead to memory corruption and potentially allow an attacker with local access to crash the system or execute code with elevated privileges. The issue occurs in error handling code that wasn't properly coordinated between two layers of the filesystem's initialization logic.

• CVE-2026-46299HIGH 7.0

  CVE-2026-46299 is a lock-handling bug in the Linux kernel's HFS+ filesystem driver that can allow a local attacker with moderate privileges to crash the system or potentially escalate privileges. The vulnerability occurs during filesystem mount when the code acquires a lock but fails to release it properly if certain filename validation steps fail. This causes the system to detect a memory leak while a critical lock is still held, triggering a kernel warning and potential system instability.

• CVE-2026-46309HIGH 7.0

  CVE-2026-46309 is a memory access control flaw in the Linux kernel's GPU driver (xe) that can leak sensitive data. When a privileged process uses a low-coherency GPU memory mode on CPU-cached buffers, the GPU can bypass CPU caches and read stale data directly from RAM—including sensitive information from previously freed memory of other processes. The fix validates GPU memory configuration requests to prevent this dangerous combination.

• CVE-2026-47293HIGH 7.0

  A use-after-free vulnerability exists in Microsoft Office's Click-To-Run installation and update mechanism. An attacker with valid credentials on a local machine can exploit a memory management flaw to gain elevated (administrator) privileges. This is not a remote vulnerability—it requires an authorized user account and local access—but the privilege escalation risk makes it a meaningful threat in environments where credential compromise or insider activity is a concern.

• CVE-2026-47648HIGH 7.0

  CVE-2026-47648 is a privilege escalation vulnerability in Windows Storage that affects multiple versions of Windows 10, Windows 11, and Windows Server. An authorized local user can exploit an untrusted search path flaw to gain elevated privileges on a compromised system. The vulnerability requires local access and user interaction is not needed, but exploitation depends on specific system conditions. With a CVSS score of 7.0 (HIGH), this poses a meaningful risk to environments where local account compromise is plausible.

• CVE-2026-54229HIGH 7.0

  A timing vulnerability exists in the abrt-dbus D-Bus service that allows a local attacker with limited privileges to take control of crash dump files while the system is processing them. The vulnerability stems from a race condition where the ChownProblemDir method changes file ownership even though privileged event handlers are actively writing to the same directory. An attacker exploiting this can redirect, modify, or delete crash dumps before they're fully processed, potentially compromising system integrity and enabling local privilege escalation.

• CVE-2026-54230HIGH 7.0

  A vulnerability in libreport's ABRT (Automatic Bug Reporting Tool) event handler scripts allows a local attacker with limited privileges to overwrite arbitrary files on a system. The flaw occurs because event scripts use file output redirection without protective measures that would prevent following symbolic links. An attacker can replace a target file with a symlink pointing to a sensitive system file, then trigger an ABRT event. Since the event scripts run as root, they unwittingly follow the symlink and write data to the attacker's chosen location, potentially corrupting critical system files or planting malicious content.

• CVE-2026-6090HIGH 7.0

  CVE-2026-6090 is a HIGH severity authentication bypass vulnerability in Lenovo Smart Connect for Windows that allows an authenticated local user to gain elevated system privileges and run arbitrary code. An attacker already logged into the system could exploit this to escalate their access and take full control of the machine. The vulnerability requires local access and some specific conditions to trigger, making it a meaningful risk for shared systems or environments where user accounts are provisioned broadly.