By severity

High-severity vulnerabilities

CVEs rated High by CVSS, with SEC.co remediation and prioritization guidance.

4140 published vulnerabilities · page 27 of 42

• CVE-2026-12143HIGH 7.5

  The form-data library for Node.js has a header injection vulnerability in versions up to 4.0.5. When an application accepts user input for multipart form field names or filenames—common in API gateways or proxies that translate JSON keys into form fields—an attacker can inject newline and carriage-return characters to break out of the Content-Disposition header. This allows them to add fake form fields, modify headers, or inject entire new parts of the multipart request, potentially escalating privileges or bypassing validation on the backend. The vulnerability is silent: it doesn't require user interaction or special network conditions. It only affects applications that actually use untrusted data for field names; if your codebase only uses hardcoded field names, you are not at risk.

• CVE-2026-12151HIGH 7.5

  The undici WebSocket client, a widely-used library in Node.js applications, has a vulnerability that allows a malicious or compromised WebSocket server to exhaust memory on the client side. The issue stems from the library's failure to limit the number of WebSocket message fragments—even though each fragment individually respects size limits, an attacker can send hundreds or thousands of small fragments to accumulate unbounded memory usage. This causes the client process to crash due to memory exhaustion, creating a denial-of-service condition. Any application that connects to untrusted WebSocket endpoints is at risk.

• CVE-2026-12199HIGH 7.5

  NLTK's WordNet Browser, a component in the Natural Language Toolkit, has a critical flaw in versions up to 3.9.3. When the HTTP server is running in its default configuration, anyone on the network can send a single HTTP request to shut it down remotely without needing any credentials. The server listens on all network interfaces by default, making it accessible to anyone who can reach the machine. This is a pure denial-of-service issue—an attacker cannot steal data or compromise the system, but they can interrupt service availability.

• CVE-2026-1220HIGH 7.5

  A race condition in Google Chrome's V8 JavaScript engine could allow an attacker to trick the browser into confusing data types when processing a malicious webpage. An attacker would need to craft a specific HTML page and convince a user to visit it, but if successful, the vulnerability could lead to information disclosure, data tampering, or application crashes. Chrome versions before 144.0.7559.99 are affected.

• CVE-2026-12243HIGH 7.5

  NLTK 3.9.4 contains a path traversal vulnerability that allows an attacker to read files from the server by crafting specially-encoded resource names. The vulnerability exists because the security check looks for obvious traversal patterns (like `../`) but misses percent-encoded variations (like `..%2f`). When the validation passes, a decoding step reveals the actual path traversal sequence, giving attackers access to sensitive files that the Python process can read. Any application using NLTK to load data from user-controlled input is at risk.

• CVE-2026-12245HIGH 7.5

  NSD, a DNS nameserver software maintained by NLnet Labs, contains a memory safety defect that causes the server to crash when processing certain DNS-over-TLS (DoT) connections. An attacker can trivially trigger this crash by opening a DoT connection, sending a DNS query, and closing the connection before the response is read. The underlying issue is improper memory cleanup during error logging on these connections, allowing the freed memory to be accessed after it has been deallocated. While this does not enable data theft or system compromise, repeated crashes can degrade service availability.

• CVE-2026-12305HIGH 7.5

  A memory safety vulnerability was discovered in Firefox and Thunderbird that could allow an attacker to crash the application or potentially cause other harmful effects through network access. The flaw affects the way these programs manage memory, and no user interaction is required for exploitation. Mozilla has patched this issue in recent versions of both applications.

• CVE-2026-12310HIGH 7.5

  A memory safety vulnerability was discovered in Firefox and Thunderbird that allows an attacker to read sensitive information from an affected system without requiring user interaction or special privileges. The flaw stems from improper memory handling in the browser engine and has been patched in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. No active exploitation has been reported to CISA as of this analysis.

• CVE-2026-12312HIGH 7.5

  A memory safety vulnerability in Mozilla Firefox and Thunderbird allows an attacker on the network to read sensitive information from an affected user's system without requiring any user interaction or special privileges. The issue stems from improper memory handling in the browser engine and has been resolved in the latest versions of both applications.

• CVE-2026-12314HIGH 7.5

  A memory safety vulnerability in Firefox and Thunderbird allows an attacker to read sensitive data from affected browsers without user interaction. The flaw stems from unsafe memory handling that permits out-of-bounds reads. An attacker on the network can exploit this remotely to compromise the confidentiality of user data—such as cached credentials, browsing history, or page content—without requiring the user to click a malicious link or perform any action. The vulnerability does not enable data modification or system crashes.

• CVE-2026-12317HIGH 7.5

  Mozilla has patched a memory safety vulnerability affecting Firefox and Thunderbird that could allow an attacker to crash the application remotely without any user interaction required. The flaw does not expose sensitive data or enable unauthorized modifications, but the denial-of-service capability makes it worth prompt attention, especially in environments where browser availability is critical.

• CVE-2026-12340HIGH 7.5

  A flaw in WolfSSL's SM2/SM3 certificate signature verification can cause the application to crash when processing specially crafted certificates. The vulnerability occurs because the code reads 65 bytes from a public key without first verifying the key is long enough, potentially accessing memory beyond allocated bounds. This affects only builds compiled with SM2 support enabled. There is no data corruption or information disclosure risk—the primary impact is denial of service through application crashes.

• CVE-2026-12360HIGH 7.5

  JetEngine, a popular WordPress plugin for creating dynamic content listings, contains a SQL injection vulnerability in its Load More functionality. The plugin's AJAX handler accepts user-supplied filter parameters but fails to properly validate one critical input field (meta_query values), allowing attackers to inject malicious SQL commands. An attacker can exploit this without authentication by crafting a specially formatted request to extract or exfiltrate sensitive database information. The vulnerability affects all versions up to and including 3.8.10.1.

• CVE-2026-1239HIGH 7.5

  Ninja Forms, a widely-used WordPress contact form plugin, has a critical flaw that allows anyone on the internet to access submitted form data without logging in. The vulnerability exists in the token refresh endpoint of the REST API, which fails to check whether a requester has permission before returning information. An attacker can view form submissions—including names, emails, phone numbers, and any custom fields—without credentials. This affects all versions up to 3.14.1.

• CVE-2026-12398HIGH 7.5

  A command injection flaw in galaxy_ng allows authenticated users to execute arbitrary code on pulp worker systems. The vulnerability exists in the legacy role import API, where unvalidated git branch or tag names are passed directly into shell commands. An attacker who controls a git repository can craft malicious branch or tag names containing shell metacharacters to gain remote code execution. The attack requires authentication and is only possible when legacy role support is explicitly enabled in the configuration.

• CVE-2026-12413HIGH 7.5

  Libreswan, a widely-deployed open-source VPN implementation, contains a flaw in how it processes fragmented IKEv2 (Internet Key Exchange version 2) messages. When a specially malformed fragment arrives, the pluto daemon—the core IKEv2 negotiation process—crashes and restarts. An attacker can repeatedly send these crafted fragments to force repeated crashes, creating a denial-of-service condition. The flaw stems from an off-by-one error that allows the daemon to write beyond its intended buffer bounds, triggering a fatal assertion. Remote code execution is not possible. Only systems configured to accept IKEv2 connections without explicitly disabling fragmentation are at risk.

• CVE-2026-12445HIGH 7.5

  Google Chrome versions before 149.0.7827.155 contain a use-after-free vulnerability in the Extensions subsystem. An attacker can exploit this by tricking a user into installing a malicious Chrome extension, potentially leading to heap corruption and arbitrary code execution on the victim's machine. The vulnerability requires user interaction (extension installation) but poses significant risk because users may not scrutinize extension permissions closely.

• CVE-2026-12455HIGH 7.5

  A use-after-free memory vulnerability exists in Google Chrome's tab strip component that could allow an attacker to corrupt the browser's heap memory. The attack requires convincing a user to perform specific UI actions (such as interacting with tabs in a particular sequence) while viewing a malicious webpage. If exploited successfully, an attacker could gain the ability to read sensitive data, modify browser behavior, or crash the application. This vulnerability affects Chrome versions prior to 149.0.7827.155 across Windows, macOS, and Linux systems.

• CVE-2026-12462HIGH 7.5

  A use-after-free vulnerability in Chrome's media handling allows an attacker who has already compromised the renderer process to execute arbitrary code within the browser sandbox. The vulnerability requires user interaction (such as opening a malicious HTML page) but poses a serious risk because it enables code execution even when the renderer is already isolated from the system. This vulnerability affects Chrome versions prior to 149.0.7827.155.

• CVE-2026-12490HIGH 7.5

  CVE-2026-12490 is a TLS authentication bypass in NLnet Labs NSD, a popular authoritative DNS server. The vulnerability allows a secondary nameserver to request zone transfers without providing the required client certificate when the transfer request arrives over standard TLS or TCP ports, even though the primary server is configured to demand certificate authentication. An attacker can exploit this to request sensitive DNS zone data if they can reach the server over the network, bypassing what administrators believed was a protected channel.

• CVE-2026-12576HIGH 7.5

  CVE-2026-12576 affects the DVP80ES3 device and involves improper enforcement of message integrity checks during network communication. An attacker on the network can send crafted messages that bypass integrity validation, potentially causing the device to become unavailable or behave unpredictably. No authentication is required to exploit this vulnerability, and it can be triggered remotely without user interaction.

• CVE-2026-12581HIGH 7.5

  CVE-2026-12581 is a session fixation vulnerability in Digiwin's EasyFlow .NET application. An unauthenticated attacker can manipulate a user's session ID before that user logs in. Once the victim authenticates, the attacker gains full access to the user's account and privileges. The attack requires no special technical skill beyond intercepting or predicting the session token, and succeeds when a user takes the bait to log in with a compromised session already in place.

• CVE-2026-12685HIGH 7.5

  The EscortWP WordPress theme, versions up to and including 3.6.2, contained intentional malicious code inserted by the vendor. This backdoor allows attackers with knowledge of a hard-coded key unique to each build to delete all website content without authentication. The theme also secretly exfiltrates sensitive site information—including the site URL, administrator email, and license key—to external servers controlled by the attackers. This represents a critical supply-chain compromise where the threat originated from the vendor itself.

• CVE-2026-12844HIGH 7.5

  List::Util::XS, a Perl module used to optimize list processing operations, contains a critical memory safety flaw in its pairwise() function. When the function processes pairs of values, it allocates memory to store results but fails to allocate enough space if a single block invocation returns a large amount of data. Specifically, the memory allocation strategy grows by only four times the current size in one step, but if a block returns more than that, the function writes beyond the allocated buffer, corrupting heap memory. Any application using pairwise() with a block that can produce large outputs in a single call is at risk of denial of service or potential code execution.

• CVE-2026-12923HIGH 7.5

  A flaw in the Youtube Showcase WordPress plugin (versions up to 4.0.3) allows authenticated users with minimal permissions to execute arbitrary PHP functions on a site. The vulnerability stems from improper input validation in a file-deletion handler. An attacker with even a basic Subscriber account can trick the plugin into running dangerous PHP functions like phpinfo() or phpversion(), potentially exposing sensitive server information or enabling further attacks. The flaw is made worse by the fact that the security token (nonce) protecting the handler is publicly available on any page containing a file upload form.

• CVE-2026-12937HIGH 7.5

  The Tourfic WordPress plugin, used for travel and hotel booking functionality, contains a SQL injection vulnerability in versions 2.22.7 and earlier. An unauthenticated attacker can manipulate the 'post_id' parameter in an AJAX request to inject arbitrary SQL commands, potentially extracting sensitive data from the website's database. The vulnerability is made more dangerous by the fact that the vulnerable code is accessible without authentication, and the security token (nonce) needed to exploit it is publicly available on hotel listing pages.

• CVE-2026-13007HIGH 7.5

  Tenable Identity Exposure exposes sensitive configuration data through unauthenticated API endpoints. An attacker on the network can request data from the /w/api/* paths without logging in and receive cleartext LDAP credentials, SAML settings, user accounts, and directory configuration. The vulnerability is compounded because responses are marked as publicly cacheable, meaning intermediate systems like CDNs and reverse proxies may store and serve this sensitive data indefinitely, even after you implement authentication fixes.

• CVE-2026-13029HIGH 7.5

  A use-after-free flaw in Chrome's Web Authentication system allows attackers to corrupt the browser's heap memory. The vulnerability requires both user interaction—tricking someone into installing a malicious Chrome extension—and the extension itself to be crafted specifically to exploit the weakness. If successfully exploited, an attacker could potentially execute arbitrary code within the Chrome process, compromising browsing security and data confidentiality.

• CVE-2026-13207HIGH 7.5

  FUXA, an open-source industrial automation and visualization platform, contains a flaw that allows attackers to access protected user and role data without logging in. The vulnerability exploits how the application processes file paths—specifically dot-segments like `./` and `../`—which the authentication system fails to normalize before checking permissions. An attacker can craft requests using paths such as `/api/./users` or `/api/project/../users` to bypass login requirements and retrieve sensitive information. Versions 1.3.1 and earlier are affected.

• CVE-2026-13251HIGH 7.5

  A directory traversal vulnerability in the Perfmatters WordPress plugin allows attackers to read files they shouldn't have access to. An attacker can request arbitrary files on a server by manipulating a parameter in a specially crafted request, potentially exposing passwords, configuration files, or other sensitive data. The vulnerability affects all versions up to 2.6.4 and requires three specific conditions: the Local Google Fonts feature must be enabled, WordPress pretty permalinks must be active, and RSS feed links must remain enabled in plugin settings. No authentication is needed to exploit this flaw.

• CVE-2026-13283HIGH 7.5

  Google Chrome on Android contains a use-after-free vulnerability in its AdFilter component that could allow an attacker to run malicious code on a user's device. An attacker would need to trick a user into performing specific touch gestures on a specially crafted webpage to trigger the flaw. This is a memory safety issue where freed memory is accessed, leading to potential code execution with the privileges of the browser process.

• CVE-2026-13311HIGH 7.5

  shell-quote, a popular Node.js library for parsing shell command strings, contains a performance vulnerability that allows an attacker to cause a denial of service by supplying a specially crafted input string. The vulnerability exists because the library uses an inefficient algorithm that becomes exponentially slower as input size grows. An attacker with the ability to provide input to an application using this library can freeze the application's event loop, making it unresponsive. No data theft or code execution is possible; the impact is purely on availability.

• CVE-2026-13347HIGH 7.5

  The Hide My WP Lite WordPress plugin up to version 1.3 contains a flaw that allows anyone on the internet to read sensitive files from affected websites without logging in. An attacker can exploit path traversal weaknesses in how the plugin handles file requests to download configuration files, database credentials, and other protected content. The vulnerability is triggered through specific URL parameters when Elementor integration is enabled, making this a serious information disclosure risk for any site running the vulnerable plugin with Elementor active.

• CVE-2026-13351HIGH 7.5

  Zephyr's IPv6 networking implementation contains a memory leak in its fragment packet handling code. An attacker can send specially crafted fragmented IPv6 packets that cause the network stack to fail to return allocated buffer memory to the system pool. By sending a small number of these malicious packets in succession, an attacker exhausts the limited pool of receive buffers, leaving the device unable to accept any new network traffic. Once buffers are depleted, the device enters a denial-of-service state until rebooted, making it unavailable for its intended purpose.

• CVE-2026-13369HIGH 7.5

  The Ninja Forms – File Uploads plugin for WordPress contains a flaw that allows unauthenticated attackers to read sensitive files from the web server. The vulnerability exists in how the plugin handles file attachments when users interact with form progress-saving features. By manipulating a request parameter, an attacker can bypass security checks and trick the plugin into treating arbitrary server files as email attachments, exposing their contents. This affects all versions up to and including 3.3.29.

• CVE-2026-13462HIGH 7.5

  PayRange's Android app (version 7.0.7 and earlier) fails to properly validate SSL certificates when displaying web content within the app. This means an attacker positioned on the network or capable of intercepting traffic can impersonate legitimate services by presenting invalid or self-signed certificates—and the app will accept them. Users interacting with these compromised webviews may unknowingly send sensitive information directly to the attacker, who can read it in transit. The vulnerability requires no user authentication and can be triggered remotely.

• CVE-2026-13468HIGH 7.5

  The Visualizer plugin for WordPress—a tool that helps site owners create and embed charts and tables—has a serious flaw in its security. Anyone on the internet can access and download the raw data from any chart on an affected site, including charts that are supposed to be private, still in draft, or in the trash. The plugin is allowing this through a custom REST API endpoint that skips essential authorization checks that WordPress normally enforces. This is particularly problematic because the vulnerability contradicts how WordPress itself protects custom content types, creating a false sense of security if you've restricted who can view these charts through normal WordPress settings.

• CVE-2026-13474HIGH 7.5

  A denial-of-service vulnerability exists in Citrix NetScaler ADC and NetScaler Gateway when HTTP/2 support is enabled. An unauthenticated attacker can send specially crafted HTTP/2 requests to crash or disable the appliance, causing service interruptions without needing valid credentials or user interaction.

• CVE-2026-13676HIGH 7.5

  fast-uri, a popular Node.js URL parsing library, contains a flaw in how it handles internationalized domain names (IDN) written in Unicode characters. When applications use fast-uri to enforce security policies—such as blocking certain hosts, restricting outbound traffic, or validating redirect destinations—the library fails to convert Unicode hostnames to their standard ASCII form. This mismatch means an attacker could craft a URL with Unicode characters that passes your security checks but resolves to a different host when the actual request is made using Node's standard URL parser or the fetch API. The vulnerability affects versions 2.3.1 through 3.1.2 in the 3.x branch, and 4.0.0 in the 4.x branch.

• CVE-2026-13698HIGH 7.5

  OpenVPN has a memory leak vulnerability affecting versions 2.5.0 through 2.5.11, 2.6.0 through 2.6.20, and 2.7_alpha1 through 2.7.4. An attacker with a valid tls-crypt-v2 client key can trigger this leak repeatedly, eventually exhausting server memory and causing the VPN service to become unavailable. The vulnerability requires network access and a legitimate cryptographic key, but no user interaction is needed to exploit it.

• CVE-2026-13708HIGH 7.5

  A memory leak vulnerability in Imager::File::JPEG (and the bundled Imager distribution) allows attackers to cause denial of service by uploading specially crafted JPEG files containing repeated APP13 markers. Each time the file is read, the application fails to free memory from previous APP13 payloads, causing heap memory to accumulate and eventually exhaust available system resources. This is particularly dangerous in long-lived services like image upload handlers or thumbnail generators that process many files over time.

• CVE-2026-13753HIGH 7.5

  HP Deskjet 2800 Series Printers contain a security flaw that allows an attacker on your network to request sensitive information directly from the printer without logging in. The printer's internal web server exposes administrative settings—including Wi-Fi Direct passwords, device serial numbers, and other security-related data—through unprotected API endpoints. While the printer's normal web interface requires admin credentials to view these details, the underlying API does not enforce the same controls, creating a bypass that leaks information an attacker could use to compromise the printer or connected networks.

• CVE-2026-13759HIGH 7.5

  IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 contain a deserialization vulnerability that allows attackers to execute arbitrary code on affected systems. The vulnerability exists because three internal classes fail to implement Java's standard class-filtering protections when deserializing untrusted data. When the Apache Coherence library is present on the classpath, attackers can exploit well-known gadget chains to achieve remote code execution. Two attack paths are possible: an authenticated attacker with the ability to inject malicious session attributes, or a network-adjacent attacker positioned on the grid replication communications channel. Both scenarios bypass normal deserialization safety mechanisms.

• CVE-2026-13772HIGH 7.5

  IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 contain a critical vulnerability in their Object Query Language (OQL) engine that allows authenticated attackers to execute arbitrary code on affected application servers. The vulnerability stems from unsafe handling of class names in OQL queries—the system dynamically loads and instantiates classes based on user input without any validation or blocklist. An attacker with valid credentials who can influence OQL query strings used by an application can trigger execution of arbitrary constructors within the WebSphere JVM. Additionally, a serialization variant can bypass Java's standard security filters when data moves between grid nodes, expanding the attack surface.

• CVE-2026-13794HIGH 7.5

  Google Chrome on Windows contains a flaw in its web app installation feature that fails to properly validate user-supplied input. An attacker can craft a malicious HTML page that, when visited by a user who performs specific interactions with Chrome's UI, triggers arbitrary code execution on the affected system. The vulnerability requires user interaction but grants complete control over the compromised machine.

• CVE-2026-13802HIGH 7.5

  Google Chrome versions before 150.0.7871.47 contain a use-after-free vulnerability in the Views component that allows an attacker to execute arbitrary code on an affected system. The attack requires a user to visit a specially crafted webpage and perform specific UI interactions—such as clicking or navigating—that trigger the vulnerable code path. While user interaction is required, successful exploitation could grant the attacker full control over the affected Chrome process and any data it can access.

• CVE-2026-13807HIGH 7.5

  A use-after-free vulnerability exists in Google Chrome's import functionality on iOS. An attacker can exploit this by hosting a malicious file and convincing a user to perform specific gestures (such as importing the file) within the browser. If successful, the attacker gains the ability to run arbitrary code on the affected device with the privileges of the Chrome process. The vulnerability affects Chrome versions before 150.0.7871.47.

• CVE-2026-13814HIGH 7.5

  Google Chrome versions prior to 150.0.7871.47 contain a use-after-free vulnerability in the Views component that can lead to heap corruption. An attacker would need to craft a malicious HTML page and socially engineer a user into performing specific UI interactions to trigger the flaw. If exploited, this could allow code execution or data theft on the affected machine.

• CVE-2026-13824HIGH 7.5

  Google Chrome versions before 150.0.7871.47 contain a security flaw in how it enforces policies for browser extensions. An attacker who has already compromised Chrome's renderer process—the component that executes web content—can exploit insufficient policy checks to escalate their privileges and gain deeper control of the browser. The attack requires user interaction (such as visiting a malicious webpage) but bypasses normal security boundaries once the renderer is compromised.

• CVE-2026-13831HIGH 7.5

  A memory safety vulnerability in Google Chrome's GPU processing component allows an attacker who has already compromised a Chrome renderer process to break out of the sandbox and execute arbitrary code with elevated privileges. The vulnerability stems from improper bounds checking in GPU memory operations, allowing out-of-bounds read and write access. An attacker would need to deliver a malicious HTML page to a user and have that page run within an already-compromised renderer context to exploit this flaw.

• CVE-2026-13855HIGH 7.5

  A use-after-free vulnerability exists in the Ozone subsystem of Google Chrome on Linux. An attacker can exploit this by crafting a malicious webpage that tricks a user into performing specific mouse or keyboard gestures, leading to arbitrary code execution on the affected system. The vulnerability requires user interaction but allows full compromise of the browser process and potentially the underlying system.

• CVE-2026-13856HIGH 7.5

  Google Chrome on Android contains a vulnerability in its Speech feature that could allow an attacker to gain elevated privileges on your device. The vulnerability requires two conditions: first, the attacker must have already compromised Chrome's rendering engine (the part that displays web content), and second, you must visit a malicious webpage. If both happen, the attacker could escalate from their limited renderer access to higher system privileges, potentially compromising your device more completely. Google has released Chrome version 150.0.7871.47 or later to fix this issue.

• CVE-2026-13891HIGH 7.5

  Google Chrome versions before 150.0.7871.47 contain a vulnerability in how the browser's extension system validates user input. An attacker who has already compromised Chrome's rendering engine can exploit this weakness to escape the browser's sandbox and gain system-level privileges. The attack requires a specially crafted web page and user interaction, but once executed allows the attacker to move from browser context to full machine control.

• CVE-2026-13925HIGH 7.5

  Google Chrome on Windows contains a flaw in how it handles downloaded files that could allow an attacker to run malicious code on your computer. The attack requires tricking a user into performing specific actions (like clicking or dragging) while viewing a specially crafted webpage. Once triggered, the vulnerability grants full control over the affected system, including the ability to read sensitive data, modify files, or disable functionality.

• CVE-2026-13968HIGH 7.5

  A vulnerability in Google Chrome's DevTools allows attackers to run malicious code within a sandboxed environment if they can trick a user into performing specific actions with a crafted file. The flaw stems from inadequate validation of user-supplied input, making it possible for remote attackers to execute arbitrary code without needing special privileges or system access. While the code runs in a sandbox—which limits potential system-wide damage—successful exploitation could still grant attackers access to sensitive data or capabilities within that sandbox context.

• CVE-2026-14064HIGH 7.5

  A use-after-free flaw in Chrome's PageInfo component on Android allows attackers to run malicious code on affected devices. The attack requires social engineering—convincing a user to perform specific UI interactions with a specially crafted webpage. While the underlying defect is classified as 'Low' severity by Chromium, the potential for complete system compromise (data theft, modification, or disruption) combined with the user interaction requirement results in a HIGH CVSS score of 7.5.

• CVE-2026-14114HIGH 7.5

  Google Chrome on Android versions prior to 150.0.7871.47 contain a flaw in how the WebAppInstalls feature handles certain file types. An attacker with local access to a device can exploit this to make the browser display fake buttons, warnings, or interface elements that trick users into taking unwanted actions. While the underlying severity designation from Google's security team is 'Low,' the CVSS score reflects the potential for integrity impact if a user is socially engineered through the spoofed UI.

• CVE-2026-14115HIGH 7.5

  CVE-2026-14115 is a privilege escalation vulnerability in Google Chrome's Cast feature that allows an attacker who has already compromised Chrome's renderer process to gain elevated system privileges through a specially crafted HTML page. While the underlying Chromium defect is rated Low severity by Google's own assessment, the CVSS 3.1 score reflects the potential for complete system compromise (confidentiality, integrity, and availability impact) once an attacker reaches the renderer process. The vulnerability affects Chrome versions before 150.0.7871.47 and impacts Windows, macOS, and Linux users.

• CVE-2026-14161HIGH 7.5

  A sensitive data exposure vulnerability exists in Advantech's Hospital Queuing Management system. The flaw allows unauthenticated attackers to access a specific URL endpoint that exposes API documentation, which could reveal information about system architecture, endpoints, authentication mechanisms, and other technical details useful for mounting further attacks. No authentication or user interaction is required to exploit this issue.

• CVE-2026-14164HIGH 7.5

  CVE-2026-14164 is a memory corruption vulnerability in libarchive, a widely-used library for reading and writing archive formats. When processing a specially-crafted RAR5 archive file, the library can accidentally free the same memory location twice—a condition known as a double-free. This can cause applications that use libarchive to crash unexpectedly. The vulnerability requires no user authentication and can be triggered remotely by sending a malicious archive file, but it does not enable data theft or system compromise—only denial of service through application termination.

• CVE-2026-14181HIGH 7.5

  A vulnerability in @fastify/middie versions 9.1.0 through 9.3.2 allows an attacker to crash Node.js applications by sending HTTP requests with malformed URL encodings. When the middleware attempts to normalize incoming request paths containing broken percent-encoded sequences—such as incomplete escape codes or truncated multibyte characters—the underlying decoder throws an unhandled exception that terminates the entire process. This causes immediate service unavailability for all connected users until the application restarts. The vulnerability only affects applications using middie's standalone engine API; those using the Fastify plugin integration are protected because Fastify's error handler catches the exception before it propagates.

• CVE-2026-14244HIGH 7.5

  The Jssor Slider plugin for WordPress contains a directory traversal vulnerability that allows unauthenticated attackers to read files from the server. An attacker can manipulate the 'url' parameter to access sensitive files outside the intended directory, potentially exposing database credentials, configuration files, and other confidential data. This affects all versions up to and including 3.1.24.

• CVE-2026-14249HIGH 7.5

  The Request a Quote plugin for WordPress contains a critical flaw that allows unauthenticated attackers to execute arbitrary PHP functions on affected servers. The vulnerability exists in the emd_delete_file AJAX handler, which accepts a user-supplied path parameter, extracts a function name from it, and then executes that function dynamically. Although the handler includes a nonce check (a WordPress security token), the nonce is publicly exposed in the page source via wp_localize_script, making it accessible to attackers. This means an attacker can craft a request to run dangerous PHP functions like phpinfo() to steal configuration data and credentials, or invoke other destructive built-in functions to compromise the server.

• CVE-2026-14265HIGH 7.5

  AWS Advanced JDBC Wrapper versions 3.3.0 through 4.0.0 contain a dangerous deserialization flaw in the RemoteQueryCachePlugin component. If an attacker gains write access to your Redis or Valkey cache layer, they can inject a malicious serialized Java object that executes arbitrary code on any application server reading from that cache. The vulnerability exists because the plugin deserializes cache entries without validating the object types first, making it vulnerable to Java gadget chain attacks.

• CVE-2026-14327HIGH 7.5

  A directory traversal vulnerability exists in the AR for WordPress plugin affecting all versions through 8.40. Unauthenticated attackers can read arbitrary files from the server by exploiting publicly accessible AJAX handlers to obtain a nonce and encryption key, then using those credentials to access files via a crafted 'file' parameter. This could expose sensitive configuration files, database credentials, and other confidential data. The vulnerability is practical to exploit on default installations where no license key is configured.

• CVE-2026-14352HIGH 7.5

  The AR for WooCommerce plugin—used by WordPress sites to add augmented reality features to product pages—contains a path traversal flaw that allows anyone on the internet to read sensitive files from affected servers. An attacker needs only to craft a malicious request; no login is required. The vulnerability bypasses three separate security controls, including a broken nonce system and a weak encryption mechanism, making it straightforward to exploit in practice.

• CVE-2026-14409HIGH 7.5

  A vulnerability in Chrome's V8 JavaScript engine allows attackers to run malicious code within the browser's sandbox if a user performs specific interactions with a crafted webpage. While the vulnerability requires user engagement and is marked as 'Low' severity by Google's internal classification, the CVSS score of 7.5 reflects the potential for complete compromise of user data within the browser process. All Chrome versions before 150.0.7871.46 are affected.

• CVE-2026-14426HIGH 7.5

  A use-after-free flaw in Google Chrome's V8 JavaScript engine allows attackers to execute code within the browser's sandbox if they trick a user into performing specific UI interactions on a malicious webpage. The attack requires both a crafted HTML page and active user participation, making it a targeted rather than passive threat. Chrome versions prior to 150.0.7871.46 are vulnerable.

• CVE-2026-14570HIGH 7.5

  Crypt::DSA is a Perl library used to generate and validate digital signatures based on the DSA (Digital Signature Algorithm) standard. Versions before 1.22 contain a flaw in how they generate random numbers needed for signing operations. Specifically, the library forces the highest bit of every random value to be 1, which was intended to ensure proper bit-length but instead makes the randomness predictable and mathematically weak. An attacker who obtains a modest collection of signatures created with an affected key—along with the public key, which is often public—can use advanced mathematical techniques (lattice-based cryptanalysis) to recover the private signing key. Any private key that has been used to sign with a vulnerable version should be treated as compromised.

• CVE-2026-14809HIGH 7.5

  A SQL Injection vulnerability exists in the Prog Management System developed by PROG MIS. The vulnerability allows attackers without credentials to send specially crafted requests that execute unauthorized SQL commands directly against the system's database. This enables attackers to read sensitive data stored in the database. The vulnerability requires no authentication, no special user interaction, and can be exploited over the network.

• CVE-2026-14895HIGH 7.5

  String::Util before version 1.36 for Perl contains a regular expression denial-of-service (ReDoS) vulnerability in its trim and rtrim functions. An attacker can supply a string with a long sequence of whitespace characters to cause excessive CPU consumption, potentially freezing or crashing applications that use these functions with untrusted input. The vulnerability stems from inefficient regex pattern matching that forces the engine to retry matches repeatedly as it backtracks through whitespace.

• CVE-2026-15111HIGH 7.5

  A use-after-free memory vulnerability exists in Google Chrome's rendering engine that could allow an attacker to corrupt heap memory and potentially execute code if a user interacts with a specially crafted webpage in specific ways. The vulnerability affects Chrome versions prior to 150.0.7871.115 and requires user interaction to exploit, but successful exploitation could lead to data theft, system compromise, or denial of service.

• CVE-2026-15117HIGH 7.5

  A use-after-free vulnerability exists in Google Chrome's Payments feature that could allow an attacker to corrupt computer memory if a user is tricked into performing specific interactions with a malicious webpage. The vulnerability affects Chrome versions prior to 150.0.7871.115 and requires the attacker to craft a deceptive HTML page and convince the user to engage in particular UI gestures. If successfully exploited, an attacker could potentially read sensitive data, modify system behavior, or crash the browser.

• CVE-2026-15167HIGH 7.5

  Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16 contain a vulnerability in how they parse DBS Etherwatch files that can cause the application to crash. An attacker can exploit this by sending a specially crafted file that triggers a stack-based buffer overflow, resulting in a denial of service. The attack requires no user privileges or interaction beyond opening a malicious file, making it a straightforward vector for disruption in environments where Wireshark is used for network analysis.

• CVE-2026-15270HIGH 7.5

  A privilege escalation vulnerability has been discovered in D-Link DIR-823G routers running firmware version 1.0.2B05_20181207. An authenticated attacker can manipulate the web interface configuration files to bypass access controls and gain unauthorized elevated privileges on the device. While exploitation requires legitimate login credentials and involves complex technical steps, public proof-of-concept code now exists, increasing the practical risk to deployed devices.

• CVE-2026-15271HIGH 7.5

  TOTOLINK has released information about a privilege escalation vulnerability affecting seven models of their networking equipment (A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10, and EX200) with firmware versions up to 20260906. The flaw exists in the web interface configuration and allows an authenticated attacker to gain elevated privileges on the device. While the vulnerability requires login credentials and careful exploitation technique, successful compromise could grant an attacker administrative control over the affected router or access point.

• CVE-2026-15288HIGH 7.5

  The SureForms WordPress plugin contains a flaw that allows anyone on the internet to change the price of products or services during checkout. When customers submit a payment form powered by Stripe, the plugin accepts the payment amount directly from the user's browser without verifying it matches the price configured in the form. An attacker can intercept and modify this amount to charge significantly less—or potentially nothing—before completing the transaction. This affects all versions of the plugin up to and including 2.2.1.

• CVE-2026-15290HIGH 7.5

  The Ultimate Member WordPress plugin contains a blind SQL injection vulnerability in its search functionality that allows unauthenticated attackers to extract sensitive data from the database. An attacker can craft malicious search queries that break out of the intended SQL statement and inject arbitrary SQL commands. While a partial patch was applied in version 2.9.2 for a related issue (CVE-2025-0308), the vulnerability persists through version 2.10.1, indicating the original fix was incomplete.

• CVE-2026-15291HIGH 7.5

  A WordPress plugin called Chat Help – Click to Chat Button & Form fails to verify that users making API requests are actually authorized to do so. This means anyone on the internet can send a simple request to the plugin's endpoints and retrieve sensitive customer data without needing a password or login credentials. The exposed information includes names, emails, phone numbers, chat messages, precise location details, browser fingerprints, and even WordPress user credentials. The vulnerability affects all versions up to 3.1.3.

• CVE-2026-15308HIGH 7.5

  Python's built-in HTML parser can be forced to consume excessive CPU resources when processing specially crafted HTML containing repeated unterminated markup declarations. An attacker who can submit or inject malicious HTML into an application using Python's html.parser.HTMLParser can trigger a denial-of-service condition, potentially freezing or slowing the affected service. This vulnerability affects the standard library across Python versions and requires no authentication or user interaction to exploit.

• CVE-2026-1840HIGH 7.5

  The Aclara Metrum Cellular Web Interface lacks basic authentication on key administrative functions. An attacker can access the web interface over the network without credentials and modify critical system settings or force restarts. Repeated interference could knock the device offline entirely, disrupting meter communications.

• CVE-2026-1989HIGH 7.5

  CVE-2026-1989 is an authorization bypass vulnerability in PAVO Pay that allows attackers to exploit user-controlled identifiers to gain unauthorized access to accounts or data. An attacker with network access can bypass authentication checks by manipulating trusted identifiers without needing valid credentials, compromising the confidentiality of sensitive financial information. The vulnerability affects PAVO Pay versions through 09/07/2026 and carries a CVSS score of 7.5 (High severity). Notably, PAVO Financial Technology Solutions did not respond to early disclosure attempts, raising concerns about patch availability and timeline.

• CVE-2026-20190HIGH 7.5

  Cisco Identity Services Engine (ISE) and ISE-PIC contain a flaw that allows unauthenticated attackers to remotely access sensitive information without proper authorization. The vulnerability stems from inadequate permission checks when resources are requested. By crafting and sending specific traffic to an affected device, an attacker can retrieve sensitive data including hashed credentials—material that could enable follow-on attacks such as password cracking or lateral movement within the network.

• CVE-2026-20191HIGH 7.5

  Cisco Catalyst Center contains a flaw that allows someone on the internet to read files from inside the system without needing a password. An attacker sends a specially crafted web request that bypasses security checks, gaining unauthorized access to sensitive data stored within the application's restricted areas. The vulnerability requires no user interaction and can be exploited directly over the network.

• CVE-2026-20213HIGH 7.5

  ClamAV, a widely-used open-source antivirus engine, contains a flaw in how it processes PE (Portable Executable) files during scanning. An attacker can craft a malicious PE file that, when scanned, causes ClamAV to crash due to improper memory handling. This disrupts the scanning service and prevents legitimate threat detection from functioning. While the primary impact is denial of service, the underlying memory corruption could potentially enable more severe attacks depending on how the vulnerability is exploited.

• CVE-2026-20214HIGH 7.5

  ClamAV, a widely deployed open-source antivirus engine used in products like Cisco Secure Endpoint, contains a flaw in how it parses FSG-compressed executable files. An attacker can craft a malicious FSG file that triggers an out-of-bounds memory write when scanned, crashing the scanning process and disrupting threat detection. This is a network-reachable denial-of-service vulnerability requiring no authentication or user interaction.

• CVE-2026-20215HIGH 7.5

  ClamAV, an open-source antivirus engine widely integrated into Cisco Secure Endpoint and other security products, contains a flaw in how it parses 7z compressed files. When scanning a specially crafted 7z file, the parser fails to properly validate memory boundaries, allowing an attacker to write data outside allocated buffer space. This memory corruption causes the ClamAV scanning process to crash, disrupting antivirus protection on affected systems. An attacker needs only to submit a malicious 7z file for scanning—no authentication or user interaction required—making this a remote denial-of-service threat to organizations relying on ClamAV for file scanning.

• CVE-2026-20216HIGH 7.5

  ClamAV, an open-source antivirus engine widely deployed in enterprise environments, contains a flaw in how it parses InstallShield installer files. When ClamAV scans a specially crafted InstallShield file, the parser mismanages temporary resources, causing the scanning process to crash and consuming system memory and CPU in the process. An attacker can trigger this remotely by uploading or submitting a malicious file to any system running ClamAV, resulting in service disruption without needing credentials or user interaction.

• CVE-2026-20217HIGH 7.5

  ClamAV's PESpin file format parser contains a memory safety flaw that allows remote attackers to crash the scanning engine by submitting a specially crafted file. When ClamAV processes the malicious file, improper boundary validation causes a buffer to be written beyond its allocated memory, terminating the scanner and disrupting security operations. The attacker needs only network access and no credentials; the vulnerable software will automatically process the file if scanned.

• CVE-2026-20243HIGH 7.5

  ClamAV's parser for ALZ archive files contains a flaw that fails to properly validate file boundaries during scanning. This allows an attacker to craft a malicious ALZ file that, when scanned, causes the antivirus engine to write data outside allocated memory regions. The result is typically a crash of the scanning process, disrupting the ability of the affected system to scan files until the service is restarted. While the vulnerability is currently characterized as causing denial of service, memory corruption of this nature can sometimes enable deeper system compromise depending on the specifics of exploitation.

• CVE-2026-20244HIGH 7.5

  ClamAV's DMG file parser contains a flaw that allows remote attackers to crash the scanning engine by submitting specially crafted DMG archive files. The vulnerability stems from inadequate boundary validation when processing DMG content, leading to integer overflow on 32-bit systems. An attacker needs only to send a malicious DMG file to a ClamAV instance; no authentication or user interaction is required. Successful exploitation terminates the scanning process, effectively disabling antivirus protection on the affected device until the service restarts.

• CVE-2026-20458HIGH 7.5

  A memory corruption flaw in cellular modems could allow an attacker to gain elevated system privileges if a device connects to a malicious base station the attacker controls. The vulnerability requires the attacker to operate or compromise a base station, but once a user's phone or modem connects to it, no further interaction or special privileges are needed to exploit the flaw. This is a serious risk for any organization with field personnel or devices that roam across cellular networks.

• CVE-2026-21035HIGH 7.5

  Samsung Plus TV versions before 1.0.28.6 contain a flaw that allows attackers on a network to access sensitive information without needing credentials or user interaction. The vulnerability stems from the application failing to properly validate input, making it straightforward to exploit if exposed to the internet or an untrusted network.

• CVE-2026-22164HIGH 7.5

  CVE-2026-22164 is a heap memory corruption vulnerability affecting GPU drivers or graphics subsystems. A non-privileged user can exploit improper GPU system call handling to corrupt kernel heap memory by creating specific resource types and supplying crafted parameters. While it requires local access to create and manipulate resources, successful exploitation could crash the system or potentially enable further attacks. The vulnerability is rated HIGH severity due to its availability impact.

• CVE-2026-22283HIGH 7.5

  Dell PowerFlex Manager versions before 5.1.0.1 contain a vulnerability that allows an unauthenticated, remote attacker to disclose sensitive information. The flaw stems from the inclusion of functionality from an untrusted control sphere—essentially, the product incorporates code or resources from an unvetted source that an attacker can manipulate to bypass security controls and access confidential data. While exploitation requires user interaction (a user must be present or perform an action), no authentication is needed, making this a meaningful risk for organizations running affected PowerFlex Manager instances.

• CVE-2026-24012HIGH 7.5

  Apache IoTDB contains a denial-of-service vulnerability in query processing that allows unauthenticated attackers to crash DataNode instances. When submitting queries with extreme parameters—such as a very large time range paired with a minimal aggregation interval—an attacker can force the DataNode to allocate massive amounts of memory, overwhelming the Java heap and terminating the process. No authentication is required to exploit this issue, making it a network-accessible threat to any exposed IoTDB deployment.

• CVE-2026-24264HIGH 7.5

  NVIDIA Triton Inference Server running on Linux has a vulnerability that allows remote attackers to crash the service by sending specially crafted highly compressed data. An attacker needs no credentials or user interaction to trigger this denial-of-service condition, making it a straightforward attack vector. The vulnerability does not enable data theft or system compromise, but availability impact can be significant for organizations relying on Triton for AI inference workloads.

• CVE-2026-24451HIGH 7.5

  Gitea 1.26.2 has a flaw in how it handles repository access control when a parent repository transitions from public to private. If a user has forked a public repository, they can continue to sync updates from the parent even after the parent becomes private—a synchronization that should be blocked. This allows fork owners to access data they no longer have authorization to see, turning a change in access policy into a data exposure window.

• CVE-2026-24690HIGH 7.5

  Gitea, a popular self-hosted Git service platform, contains a flaw in how it checks permissions when developers request changes to pull request branches. An unauthenticated attacker can exploit this weakness to update or rebase pull request branches without proper authorization, potentially altering code that others are reviewing or about to merge. The vulnerability affects all Gitea versions prior to 1.25.5 and carries a high severity rating.

• CVE-2026-25712HIGH 7.5

  Gitea, a self-hosted Git service popular among development teams, contains a vulnerability in its organization management APIs that allows unauthenticated users to discover sensitive information about hidden organization members and private organizations. The flaw stems from insufficient permission checks when querying organization data, potentially exposing membership lists and organizational structure that administrators intended to keep confidential. This is a read-only disclosure issue—attackers cannot modify data or take control of systems, but they can gather reconnaissance information about an organization's internal structure.