By severity

High-severity vulnerabilities

CVEs rated High by CVSS, with SEC.co remediation and prioritization guidance.

2890 published vulnerabilities · page 29 of 29

• CVE-2026-52808HIGH 7.1

  Gogs, an open-source Git hosting platform, contains an authorization bypass vulnerability in three API endpoints that handle repository settings and operations. Write-level collaborators—users with limited repository permissions—can exploit these endpoints to disable critical repository features (issue tracker, wiki) or inject malicious URLs that would compromise other users visiting the repository. The vulnerability exists because these endpoints use weaker permission checks than the equivalent web interface, allowing attackers to escalate their effective privileges within a repository. Gogs 0.14.3 and later patch this issue.

• CVE-2026-52915HIGH 7.1

  A flaw in the Linux kernel's IPv6 hop-by-hop header filtering allows a local attacker with standard user privileges to trigger an out-of-bounds array access. The vulnerability exists because the kernel accepts oversized option lists in netfilter rules without validating that they fit within the fixed 16-element array used to store them. An attacker can craft a malicious firewall rule to cause the kernel to read or write beyond array boundaries, potentially enabling privilege escalation or denial of service.

• CVE-2026-52917HIGH 7.1

  A race condition exists in the Linux kernel's SCTP (Stream Control Transmission Protocol) diagnostic module that allows a local attacker with low privileges to crash the system or read sensitive kernel memory. The vulnerability arises when the kernel attempts to retrieve SCTP socket diagnostic information while an association is being freed, causing it to read from memory that has already been deallocated or modified. This results in either a denial of service or potential information disclosure.

• CVE-2026-52942HIGH 7.1

  A flaw in the Linux kernel's netfilter logging subsystem allows a local attacker to read memory beyond allocated buffer boundaries. When the kernel logs network packets, it attempts to dump the MAC (media access control) header without properly verifying that the header information has been set. An attacker with local access can craft and send specially crafted packets through AF_PACKET with QDISC bypass enabled, causing the logging function to read approximately 64 KB past the intended buffer and leak that kernel memory into the system log. This information disclosure could expose sensitive kernel data to unprivileged users.

• CVE-2026-52953HIGH 7.1

  A flaw in the Linux kernel's IOMMU (Input/Output Memory Management Unit) VT-d driver can crash a system when certain device assignment operations occur, particularly when QEMU virtual machines are terminated. The issue arises from the kernel trying to access memory beyond the bounds of a special internal structure called the 'blocked domain,' causing a protection fault that halts the affected process or system. This is a memory safety issue specific to how the kernel manages I/O device permissions and virtual machine configurations.

• CVE-2026-52988HIGH 7.1

  A vulnerability exists in the Linux kernel's netfilter subsystem where the nf_tables module does not safely handle concurrent updates to firewall rules. When administrators modify firewall rules while the system is simultaneously retrieving rule information, a race condition can occur that may cause the kernel to crash or allow information disclosure. The issue stems from improper synchronization during the commit phase when new firewall hooks are added to the active rule list.

• CVE-2026-53040HIGH 7.1

  A flaw in the Linux kernel's OCFS2 filesystem driver can be triggered when a user issues a specific diagnostic request (OCFS2_IOC_INFO with non-coherent mode) against a crafted filesystem. An attacker with local access can supply malformed filesystem metadata that causes the kernel to read memory outside the bounds of a bitmap structure, leading to a use-after-free condition. This can crash the system or potentially allow information disclosure. The vulnerability requires local access and standard user privileges to trigger.

• CVE-2026-53041HIGH 7.1

  A flaw in how the Linux kernel's OCFS2 filesystem reports extended file attributes (xattrs) can cause a kernel crash when listing these attributes on files that store them in multiple locations. When a file's inline xattrs exactly fill a user's buffer and there are additional xattrs stored in blocks, the kernel incorrectly reports a size that exceeds the buffer and then attempts to write beyond it, triggering a kernel panic. This affects systems using OCFS2 as their filesystem, particularly in Oracle environments and high-availability clusters.

• CVE-2026-53044HIGH 7.1

  A memory access vulnerability exists in the Linux kernel's Tegra SoC cross-bar (CBB) fabric code. The vulnerability stems from incorrect array size calculations in lookup tables used during target timeout operations. When the kernel attempts to access fabric configuration data during a timeout event, it may read memory outside the intended table boundaries. This could allow a local attacker with minimal privileges to read sensitive kernel memory or cause a system crash.

• CVE-2026-53068HIGH 7.1

  A vulnerability exists in the Linux kernel's display driver (DRM/Komeda) where a math error during framebuffer validation can allow a user to trick the system into accepting an undersized memory buffer. When the kernel adds two numbers together to check buffer size requirements, it doesn't protect against arithmetic overflow—if the sum wraps around to a small number, a malformed request passes validation when it shouldn't. This could lead to memory access outside the intended buffer boundaries, potentially exposing sensitive data or causing system instability.

• CVE-2026-53076HIGH 7.1

  A flaw in the Linux kernel's BPF (Berkeley Packet Filter) subsystem allows an unprivileged local user to read memory beyond intended boundaries. The vulnerability arises when copying data between certain kernel map types—specifically from a CGROUP_STORAGE map into a per-CPU map when both have non-standard sizes (not aligned to 8 bytes). The kernel incorrectly assumes all source memory is rounded up to 8 bytes, causing it to read extra data it shouldn't access. This could leak sensitive kernel memory to an attacker with local access.

• CVE-2026-53132HIGH 7.1

  A flaw in the Linux kernel's vsock (virtual socket) transport layer could allow an attacker to exhaust system memory by flooding the network queue with malformed packets. An attacker with local access can craft packets with zero payload length but marked as end-of-message (EOM), bypassing the kernel's normal quota checks. Because these packets consume almost no actual data bytes, the kernel's safeguards fail to detect the buildup, allowing an unbounded number of empty packets to accumulate in the receive queue. This eventually starves legitimate network traffic and system processes of available memory, causing a denial of service.

• CVE-2026-53138HIGH 7.1

  A flaw in the Linux kernel's AMD display driver can cause the system to loop indefinitely when processing a corrupted graphics firmware (VBIOS) image. During system startup, the driver reads firmware records to configure the display hardware. If the firmware is malformed and missing the expected end-marker, the driver keeps reading memory in 256-byte increments until it either crashes or exhausts resources. An attacker with physical access to replace the firmware, or a supply-chain compromise affecting pre-installed firmware, could trigger this condition. Local users with sufficient privilege to load modified firmware could also exploit it. The fix limits the loop to a reasonable maximum of 256 records, preventing runaway iteration.

• CVE-2026-53146HIGH 7.1

  A memory disclosure vulnerability exists in the Linux kernel's Thunderbolt XDomain (cross-domain) communication handler. When a system receives a shorter-than-expected response packet over Thunderbolt, the kernel incorrectly reads beyond the legitimate frame data into stale memory contents from previous transactions. This allows an attacker with adjacent network access to extract sensitive information from kernel memory, such as cryptographic keys or other data processed in prior Thunderbolt communications.

• CVE-2026-53149HIGH 7.1

  A flaw in the Linux kernel's Thunderbolt driver allows a local user with restricted privileges to read sensitive memory or crash the system. The vulnerability exists in how the kernel validates directory structures when parsing Thunderbolt property data. When a malformed directory header claims to contain more content than the allocated memory block actually holds, the kernel fails to reject it and instead reads beyond the intended boundaries, potentially exposing kernel memory or causing a denial of service.

• CVE-2026-53179HIGH 7.1

  A buffer over-read vulnerability exists in the Linux kernel's RTL8723BS wireless driver. The rtw_update_protection() function is called with a pointer that references a specific position within a buffer, but it is passed the total length of the entire buffer rather than the remaining bytes from that position. This causes the function to read beyond the intended region of memory, potentially exposing sensitive kernel data. The flaw affects the staging driver and requires local access to trigger.

• CVE-2026-53187HIGH 7.1

  A vulnerability exists in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem where user-supplied CPU IDs are not properly validated before being used in system operations. An attacker with local access can supply an invalid CPU ID that causes the kernel to read memory outside the valid CPU bitmap range, potentially exposing sensitive information or crashing the system. This is particularly dangerous on systems configured to panic when kernel warnings are triggered.

• CVE-2026-53203HIGH 7.1

  A buffer overflow vulnerability exists in the Linux kernel's Intel VPU (Vision Processing Unit) acceleration driver. When the driver queries metric stream information from firmware, it does not properly validate whether the returned data size exceeds the allocated buffer. An attacker with local access could trigger this condition, potentially leading to information disclosure or system instability. The vulnerability affects systems running vulnerable Linux kernel versions with the Intel VPU driver enabled.

• CVE-2026-53205HIGH 7.1

  The Linux kernel contains a vulnerability in the Intel VPU (Video Processing Unit) acceleration driver where firmware-supplied log buffer indices are not properly validated. When the firmware provides read or write indices that fall outside the valid range of the log buffer, the kernel does not catch this before using them to access memory. This can lead to the kernel reading from or writing to unintended memory locations, potentially exposing sensitive data or causing system instability. The fix adds validation to ensure indices stay within bounds and clamps out-of-range values to safe defaults.

• CVE-2026-53223HIGH 7.1

  A flaw in the Linux kernel's network stack allows a local attacker to misuse socket timestamping features to read or leak adjacent kernel heap memory. The vulnerability arises from incorrect classification of packet socket buffers, where the kernel mistakenly treats outgoing AF_PACKET frames as error-queue messages when timestamping is enabled. This confusion causes the kernel to read control buffer state from the wrong location, potentially exposing sensitive data or triggering memory protection mechanisms.

• CVE-2026-53253HIGH 7.1

  A flaw in the Linux kernel's Bluetooth BNEP (Bluetooth Network Encapsulation Protocol) handler allows a remote Bluetooth peer to trigger a memory access violation by sending malformed frames. The vulnerability stems from the kernel reading packet fields without first verifying that enough data is present in the incoming frame. When an attacker sends a truncated BNEP packet, the code attempts to access memory beyond the actual packet contents, leading to a crash or potential information disclosure. The issue affects systems with Bluetooth connectivity that process BNEP traffic.

• CVE-2026-53255HIGH 7.1

  The Linux kernel contains a flaw in how it validates Bluetooth advertising data when processing management commands. A malformed advertising request can cause the kernel to read memory beyond the bounds of the supplied data buffer. This out-of-bounds read is triggered when a length field points past the actual data, allowing an attacker with local access to crash the system or potentially leak sensitive memory contents.

• CVE-2026-53674HIGH 7.1

  BuddyPress 14.4.0 has a flaw in how it processes @mention names when a specific username compatibility feature is enabled. Attackers can craft malicious mention text containing special regex characters that slip past the software's input sanitization, allowing them to probe the database for usernames or crash the system through resource exhaustion. The vulnerability requires an attacker to be logged in but poses meaningful risk to information disclosure and availability.

• CVE-2026-53689HIGH 7.1

  A vulnerability in libnfs (an open-source NFS client library) allows attackers to trigger an integer overflow by connecting to a malicious NFS server that sends specially crafted data. The flaw stems from insufficient validation of string sizes during data parsing, potentially allowing an attacker to cause memory corruption, information disclosure, or limited system unavailability. An attacker would need to trick a user into connecting to a compromised or attacker-controlled NFS server, making this a network-based but not trivially exploitable threat.

• CVE-2026-53703HIGH 7.1

  GStreamer's RealMedia file parser has a buffer-reading flaw that can crash applications or leak memory contents. When a malicious or malformed RealMedia (.rm) file contains an undersized audio header, the parser reads past the end of its data buffer, potentially accessing uninitialized or sensitive memory. The vulnerability requires user interaction—someone must open a crafted file—but poses a meaningful risk to applications that automatically process media files or expose the parser to untrusted sources.

• CVE-2026-53704HIGH 7.1

  GStreamer, a popular multimedia framework, contains a vulnerability in its RealMedia file parser that can be triggered by opening a malicious .rm file. The parser fails to properly validate boundaries when reading metadata, allowing crafted files to cause the application to hang indefinitely, crash, or leak memory. An attacker simply needs to trick a user into opening a specially constructed RealMedia file—no special network access or authentication is required. The flaw affects the gst-plugins-ugly package, which is commonly installed alongside GStreamer for handling restricted multimedia formats.

• CVE-2026-53840HIGH 7.1

  OpenClaw versions before 2026.5.12 inadvertently leak sensitive authentication headers—such as API keys and tenant-routing credentials—when handling cross-origin redirects through its streamable-http Model Context Protocol (MCP) servers. An attacker who controls or compromises an MCP endpoint can exploit this by redirecting requests to an attacker-controlled domain, capturing those headers in transit. This is a credential exfiltration risk that requires authentication to trigger but carries significant impact once exploited.

• CVE-2026-53842HIGH 7.1

  OpenClaw versions before 2026.5.2 contain a flaw that allows attackers with repository access to inject malicious environment variables into workspace configuration files. When users run Gmail setup commands through gcloud, the tool may be tricked into using an attacker-controlled Python interpreter instead of the legitimate one, potentially leading to arbitrary code execution on the developer's machine. The vulnerability requires user interaction (a developer running the setup process) but no special system privileges.

• CVE-2026-53846HIGH 7.1

  OpenClaw before version 2026.4.29 contains a vulnerability that allows attackers to hijack the package manager used during dependency installation. An attacker with access to a workspace can craft a malicious .env file that tricks the install process into running an unauthorized package manager executable. This could enable them to inject malicious code into the build environment and compromise software artifacts.

• CVE-2026-53858HIGH 7.1

  OpenClaw versions before 2026.5.2 contain a vulnerability that allows attackers to manipulate how the application loads software dependencies. By controlling an environment variable called STATE_DIRECTORY in a workspace configuration file, an attacker can trick OpenClaw into loading malicious code from attacker-controlled locations on the same computer. This attack requires local access and user interaction (such as a developer opening a project), but if successful, it can lead to arbitrary code execution during the dependency resolution process.

• CVE-2026-53863HIGH 7.1

  OpenClaw versions before 2026.4.25 have a flaw in how they validate group identifiers when making access control decisions for tool invocations. An attacker with basic authentication credentials can supply a crafted group ID that the system fails to properly validate, leading to incorrect policy enforcement. This could allow the attacker to invoke tools or perform actions they should not have permission to access, effectively bypassing the intended security controls that restrict who can use what tools.

• CVE-2026-53865HIGH 7.1

  OpenClaw versions before 2026.5.2 contain a vulnerability that allows a local attacker with user-level access to execute arbitrary executables on the system. The flaw exists in how the maintenance task system handles file paths: an attacker can manipulate workspace-derived environment paths to trick the system into running their chosen command instead of the intended maintenance cleanup utility. This gives an attacker the ability to run code with the privileges of the OpenClaw process during routine maintenance operations.

• CVE-2026-53915HIGH 7.1

  JetBrains GoLand before version 2026.1.3 contains a remote code execution vulnerability triggered when developers open untrusted project configurations. An attacker can craft a malicious project file that executes arbitrary code on a developer's machine without requiring any special permissions or complex user interaction beyond opening the project. This affects GoLand across all network environments.

• CVE-2026-54012HIGH 7.1

  Open WebUI, a self-hosted AI platform, contains a flaw in how it manages file access permissions tied to AI models. Before version 0.9.6, a user who creates or imports a model can attach references to files belonging to other users without any verification. This allows the malicious model owner to read or delete those private files by manipulating how the system validates file access. The vulnerability requires an authenticated attacker but poses a direct threat to data confidentiality and integrity within shared Open WebUI deployments.

• CVE-2026-54070HIGH 7.1

  SiYuan, an open-source personal knowledge management system, contains a cross-site scripting (XSS) vulnerability in how it displays README files from Bazaar marketplace packages. When an administrator views a package in the Settings → Marketplace interface, malicious code embedded in a package README can execute with full administrative privileges in the user's SiYuan workspace. The attack requires no installation—viewing the package listing is sufficient. This affects versions prior to 3.7.0.

• CVE-2026-54198HIGH 7.1

  Media Library Assistant versions 3.35 and earlier contain an unauthenticated cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application without requiring a login. An attacker can craft a malicious link and trick a user into clicking it, causing the victim's browser to execute the injected code within the context of the Media Library Assistant application. This could lead to session hijacking, credential theft, or malware distribution.

• CVE-2026-54290HIGH 7.1

  Hono, a JavaScript web framework supporting multiple runtimes, has a cross-origin request forgery vulnerability in its CORS middleware. When CORS is configured to allow credentials (a common requirement for authenticated APIs) without explicitly restricting which origins can access the application, the middleware will mirror back whatever origin made the request and grant it credential access. This means any website can trick a user's browser into making authenticated requests to a Hono application and read the responses—essentially stealing the user's session. The flaw affects versions before 4.12.25 and is particularly dangerous because the vulnerable configuration may feel like a reasonable default to developers unfamiliar with CORS security nuances.

• CVE-2026-54318HIGH 7.1

  Home Assistant's companion app for Android contains a flaw that allows any installed application to spoof your device's GPS location without needing special permissions. An attacker can trick Home Assistant into believing you're at a different location than where you actually are, potentially triggering automations tied to your real-world position—such as unlocking doors, disarming alarms, or opening garages. Because this vulnerability bypasses Android's built-in mock location protections, even apps that appear benign could exploit it. The issue is fixed in version 2026.5.3.

• CVE-2026-54761HIGH 7.1

  Traefik, a widely-deployed reverse proxy and load balancer, contains a flaw in how it enforces access controls when Kubernetes HTTPRoutes specify multiple backend services. An attacker with the ability to create HTTP routes in a non-allowed namespace can exploit a namespace validation bypass to expose sensitive internal Traefik services—including the admin API, dashboard, and REST interface—to the network. The vulnerability stems from Traefik checking permissions against the wrong namespace when evaluating cross-provider service references, allowing an attacker to pivot through an allow-listed namespace to reach forbidden internal endpoints. This affects versions prior to 3.6.21 and 3.7.5.

• CVE-2026-55700HIGH 7.1

  pnpm, a widely-used JavaScript package manager, contains a path traversal vulnerability in its download staging feature that could allow an attacker to overwrite files outside the intended download directory. By crafting a malicious package manifest with specially designed name and version fields, an attacker could trick pnpm into writing files to unintended locations on a developer's machine. This affects versions 11.3.0 through 11.5.2. The fix validates and sanitizes both the package name and version before deriving a safe filename, then verifies the destination path before writing any files.

• CVE-2026-56005HIGH 7.1

  WP Activity Log, a WordPress plugin used to monitor and log user activity, contains a stored cross-site scripting (XSS) vulnerability in versions 5.6.3.1 and earlier. An attacker can inject malicious scripts that execute in the browsers of subscribers viewing activity logs, potentially allowing credential theft, session hijacking, or malware distribution. The vulnerability requires user interaction but affects a broad audience since it impacts any subscriber with access to the plugin's logging interface.

• CVE-2026-56209HIGH 7.1

  A critical flaw exists in libaom, the open-source reference implementation of the AV1 video codec. An attacker can craft malicious video frames that exploit a missing validation check in the Scalable Video Coding layer, allowing them to write data to arbitrary memory locations on a system running a vulnerable encoder. This could crash the encoder (denial of service) or potentially allow the attacker to execute arbitrary code. The vulnerability is particularly dangerous because it requires no prior information disclosure to exploit—an attacker who can feed frames to a network-accessible encoder, such as in a transcoding service or live stream ingestion pipeline, can trigger the flaw reliably.

• CVE-2026-56210HIGH 7.1

  A bounds-checking flaw in libaom, the reference implementation of the AV1 video codec, allows attackers to read unintended memory from the heap. An attacker who can send specially crafted video encoding parameters—particularly by setting an SVC (Scalable Video Coding) layer identifier beyond the legitimate range—can trigger the vulnerability. The result is either exposure of sensitive data resident in heap memory or a crash of the encoder process. This matters most to services that accept untrusted video input and run libaom on network-facing infrastructure.

• CVE-2026-56211HIGH 7.1

  A vulnerability in libaom, the open-source AV1 video codec library, allows an attacker to execute arbitrary code on systems that process untrusted video files with scalable video coding (SVC) features enabled. An attacker crafts malicious video frames that bypass safety checks in the encoder, allowing them to corrupt memory structures that control how the encoder operates. In services that spawn separate processes to handle video encoding, this memory corruption can be leveraged to discover the process layout in memory and ultimately redirect execution to attacker-controlled code. Exploitation requires that the target application uses libaom with SVC encoding active and processes video frames from an untrusted source.

• CVE-2026-56244HIGH 7.1

  Capgo versions prior to 12.128.2 contain a security flaw where webhook signing secrets can be exposed to users with standard (non-admin) API keys. This happens because the underlying database does not properly restrict access to sensitive webhook configuration data. An attacker with a basic API key can retrieve these secrets, then use them to forge legitimate-looking webhook messages that your systems will accept as authentic, potentially allowing them to trigger unauthorized actions in any application listening to your webhooks.

• CVE-2026-56256HIGH 7.1

  Capgo versions before 12.128.2 have a critical authentication bypass where the two-factor authentication (2FA) requirement is only enforced in the user interface, not in the backend API. This means an authenticated admin user who hasn't actually enabled 2FA can send direct API requests to sensitive organization management functions—such as editing organization details or inviting new users—and those requests will be accepted without verifying 2FA status. An attacker with admin credentials could potentially capture a legitimate API request and replay it, or craft new requests to perform unauthorized organizational changes.

• CVE-2026-56257HIGH 7.1

  Capgo versions before 12.128.2 contain a critical authorization flaw that allows authenticated users to directly modify app ownership records through PostgREST without using the proper transfer workflow. This creates a dangerous split-brain scenario where an application's metadata appears owned by one organization, but version data remains accessible to the original organization's API keys. An attacker with valid credentials can exploit this to maintain persistent unauthorized access to application versions even after nominally transferring the app to a different organization.

• CVE-2026-56275HIGH 7.1

  Flowise versions before 3.1.0 contain a server-side request forgery (SSRF) vulnerability in the Execute Flow node. An authenticated attacker can manipulate the base URL field to bypass security controls and force the application to make HTTP requests to internal network addresses, cloud metadata endpoints, and other sensitive systems that should not be directly accessible. This allows reconnaissance and potential lateral movement within your infrastructure.

• CVE-2026-56280HIGH 7.1

  Cap-go versions before 12.128.2 contain a privilege escalation flaw in their build log streaming feature. An attacker with a read-only API key—which should only permit viewing logs—can actually cancel active native builds by connecting to the log stream and then disconnecting. This happens because the server uses its own privileged credentials to clean up when clients disconnect, rather than checking whether the client itself has permission to cancel builds. The vulnerability allows repeated disruption of build pipelines and CI/CD workflows without requiring elevated API credentials.

• CVE-2026-56314HIGH 7.1

  Capgo, a mobile app deployment and update platform, contains a flaw that allows attackers with valid credentials to push outdated or intentionally removed app versions to end-user devices. The vulnerability stems from incomplete data filtering when retrieving available app versions during update checks. An authenticated attacker can exploit this by deploying bundles that were previously deleted, potentially exposing users to known bugs, security issues, or malicious code embedded in those older versions. This is a moderate-to-significant risk because it requires authentication but can affect the integrity of deployed software at scale.

• CVE-2026-57303HIGH 7.1

  The Jenkins Assembla Plugin up to version 1.4 contains a weakness in how it parses XML responses from Assembla servers. An attacker who can intercept or control responses from the Assembla service could inject malicious XML that tricks the Jenkins controller into reading sensitive files from the system or making unauthorized network requests on behalf of Jenkins. This requires the attacker to have some control over network traffic to the Assembla server or the ability to compromise the Assembla service itself.

• CVE-2026-6858HIGH 7.1

  The Transbank Webpay WordPress plugin before version 1.14.0 contains a stored cross-site scripting (XSS) vulnerability in its logging functionality. An unauthenticated attacker can inject malicious code into plugin logs, which is then executed in the browser of any administrator who views those logs. This allows attackers to steal administrative credentials, modify site content, or perform actions as if they were a logged-in administrator.

• CVE-2026-8035HIGH 7.1

  CVE-2026-8035 is a denial-of-service vulnerability in National Instruments' PAL kernel driver that allows authenticated local users to crash the system. The flaw stems from inadequate input validation that fails to check for NULL pointers before dereferencing them in memory. An attacker with local system access can exploit this by supplying malformed input to the driver, causing an immediate kernel panic. The vulnerability affects NI-PAL version 26.3.0 and all earlier releases across both Windows and Linux platforms.

• CVE-2026-8036HIGH 7.1

  NI-PAL, National Instruments' process abstraction layer, contains an input validation flaw that allows authenticated local users to read and modify arbitrary memory regions on affected systems. An attacker with local access could exploit this to escalate their privileges. The vulnerability affects NI-PAL version 26.3.0 and earlier on both Windows and Linux platforms.

• CVE-2026-8089HIGH 7.1

  The weMail WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to trick authenticated users—including administrators—into clicking malicious links. When a victim clicks a crafted URL, malicious JavaScript executes in their browser with their privileges, potentially allowing attackers to perform actions on their behalf, steal session tokens, or modify site content. The vulnerability exists because user input is not properly sanitized before being inserted into HTML attributes in AJAX responses, and the vulnerable endpoint lacks nonce protection to validate legitimate requests.

• CVE-2026-8172HIGH 7.1

  The Simple Basic Contact Form WordPress plugin fails to properly sanitize user input when displaying form validation errors, allowing attackers to inject malicious JavaScript code into the page. An attacker can craft a malicious link or form that, when visited by a site user, executes arbitrary JavaScript in that user's browser within the context of the vulnerable website. This type of attack, known as Reflected Cross-Site Scripting (XSS), can be used to steal session cookies, perform actions on behalf of the user, or redirect them to phishing sites.

• CVE-2026-8874HIGH 7.1

  Securly Chrome Extension version 3.0.7 downloads security configuration files—specifically crisis alert keywords and filtering rules—over plain HTTP instead of the encrypted HTTPS protocol. While the same extension correctly uses HTTPS for other sensitive data (IWF and CIPA filtering data), this inconsistency leaves downloaded crisis alert configurations vulnerable to interception and modification by network-positioned attackers. An attacker on the same network could intercept these files and inject malicious keywords or rules, potentially disrupting the extension's security functionality or causing it to behave unexpectedly.

• CVE-2026-9154HIGH 7.1

  A vulnerability in Rapid7 InsightConnect's Sed Plugin allows authenticated users to write malicious files to any location on Linux systems. An attacker with valid credentials can exploit the 'expression' parameter to place arbitrary content at arbitrary file paths, potentially overwriting critical system or application files. This is a file-write vulnerability rather than code execution, but the impact depends heavily on what files an attacker targets.

• CVE-2026-9570HIGH 7.1

  The Taskbuilder WordPress plugin before version 5.0.8 contains a reflected cross-site scripting (XSS) vulnerability in its frontend shortcode functionality. An attacker can craft a malicious URL containing JavaScript code that, when visited by a logged-in user, executes in the context of that user's browser session. The vulnerability stems from inadequate sanitization of a URL parameter before it is output directly into inline JavaScript code on the page. This allows an attacker to hijack user sessions, steal sensitive data, or perform actions on behalf of the victim within WordPress.

• CVE-2026-9808HIGH 7.1

  Mautic 7's API has a flaw where user permission restrictions aren't being honored properly. Specifically, permissions designed to let users only see or edit their own resources (called 'owner-scope' restrictions) are being bypassed. An attacker with low-level API access can exploit this to view or modify other users' data, even though they shouldn't have that permission.

• CVE-2024-38487HIGH 7.0

  CVE-2024-38487 is a container escape vulnerability affecting api-gateway containers that run with root privileges. An attacker with local access to a system running a vulnerable api-gateway container could break out of the container and gain access to the underlying host system, potentially allowing them to modify, delete, or disable critical services and data. The vulnerability requires local access and some effort to exploit, but the consequences—full host compromise—are severe.

• CVE-2026-0083HIGH 7.0

  A race condition in Android's NFC (Near Field Communication) event handling code allows a local attacker with basic system access to escalate their privileges to access sensitive data or modify system files. The vulnerability requires precise timing exploitation but no special permissions or user interaction to trigger, making it a significant local security concern.

• CVE-2026-0125HIGH 7.0

  CVE-2026-0125 is a race condition vulnerability in Android's VPU (Video Processing Unit) driver that allows a local attacker to escalate their privileges. An attacker with a low-privilege local account can trigger a use-after-free condition in the vpu_ioctl.c file by timing requests carefully, potentially gaining higher-level access to the device without needing special permissions or user interaction. This is a serious flaw because it requires only local access and basic user privileges to exploit.

• CVE-2026-34335HIGH 7.0

  A use-after-free memory vulnerability exists in Windows Ancillary Function Driver for WinSock (AFD.sys), affecting Windows 10 and Windows 11 across multiple versions, as well as Windows Server 2012 through 2025. An authenticated local attacker can exploit this flaw to escalate their privileges to SYSTEM level. The vulnerability requires local access and specific conditions to trigger, but once exploited, grants complete control over the affected system.

• CVE-2026-41108HIGH 7.0

  A memory safety flaw in Windows DNS could allow someone with local system access to break out of normal restrictions and gain full control of the computer. The vulnerability exists because DNS processes input in a way that can overflow a memory buffer, and an attacker positioned locally—such as a low-privilege user or service—could exploit this to run code with elevated permissions. This is not a remote vulnerability, but it poses a significant risk in multi-user or shared-system environments.

• CVE-2026-42462HIGH 7.0

  Fedify, a TypeScript library for building federated applications using ActivityPub, contains a vulnerability that allows attackers to manipulate cryptographically signed activities without invalidating the signatures. By exploiting JSON-LD (JSON Linked Data) restructuring techniques, an attacker who receives a validly signed activity from a third party can alter its meaning and content while the Linked Data Signature remains valid. This breaks the integrity guarantee that signatures are supposed to provide, enabling attackers to forge or modify federated messages in a way that appears authentic.

• CVE-2026-42836HIGH 7.0

  A race condition in Windows' Function Discovery Service (fdwsd.dll) allows a user already logged into a machine to escalate their privileges to administrator level. The vulnerability exists because the service does not properly synchronize access to shared resources when multiple processes run concurrently, creating a narrow window where an attacker can manipulate the process. An authorized user would need local access and specific timing to exploit this, but successful exploitation grants full system-level permissions.

• CVE-2026-42911HIGH 7.0

  A use-after-free memory vulnerability exists in Windows' Ancillary Function Driver for WinSock (AFD.sys). An attacker who already has local access to a machine can exploit this flaw to gain elevated privileges, potentially running code with system-level permissions. The vulnerability requires specific conditions to trigger—it is not trivially exploitable—but once successful grants significant control over the affected system.

• CVE-2026-42912HIGH 7.0

  A race condition in Windows Telephony Service allows an attacker who already has local user access to exploit improper synchronization of shared resources and gain system-level privileges. The vulnerability requires the attacker to perform specific timing-dependent actions during concurrent operations—making it moderately difficult to exploit in practice, but reliably escalatable once triggered. No user interaction is required beyond the attacker's ability to run code as a local user.

• CVE-2026-42984HIGH 7.0

  A use-after-free memory vulnerability exists in the Windows Kernel that allows an authorized local user to escalate their privileges to a higher level of access. An attacker with standard user permissions could exploit this flaw to gain system-level control on an affected machine. The vulnerability requires local access and specific conditions to trigger, but successful exploitation would grant complete compromise of the target system.

• CVE-2026-44495HIGH 7.0

  Axios, a widely-used HTTP client library for JavaScript applications, contains prototype-pollution gadgets that can be exploited if another vulnerability in the same process has already poisoned JavaScript's Object.prototype. The issue affects versions 0.19.0 through 0.31.0 in the 0.x branch and version 1.15.1 in the 1.x branch. By itself, Axios does not cause the initial prototype pollution; instead, it becomes a secondary target once an attacker has already compromised Object.prototype through a separate vulnerability. When this occurs, Axios may incorrectly interpret inherited properties as legitimate request configuration, leading to potential code execution or data exposure. The vulnerability is addressed in Axios 0.31.1 and 1.15.2.

• CVE-2026-44604HIGH 7.0

  A flaw in RPM's archive extraction tool allows an attacker to run arbitrary commands on a system by crafting a malicious archive with shell metacharacters embedded in its folder name. When a user extracts such an archive using the rpmuncompress utility, the unsanitized folder name is passed directly into a shell command, enabling code execution with the privileges of the extracting user. The vulnerability affects ZIP, 7z, and GEM archive formats.

• CVE-2026-44818HIGH 7.0

  A race condition vulnerability in Microsoft Office Excel could allow an attacker to execute code on a user's computer. The flaw arises from improper synchronization when multiple processes access shared resources simultaneously. An attacker would need to trick a user into opening a malicious Excel file, but once triggered, the vulnerability can grant full control over the affected system. The vulnerability affects multiple versions of Excel and Office across 365 subscriptions, on-premises deployments, and older perpetual licenses.

• CVE-2026-45596HIGH 7.0

  A use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD) allows an authenticated attacker to elevate their privileges on a local system. The vulnerability requires the attacker to already have user-level access and involves a race condition during memory management. Successfully exploiting it grants the attacker full system-level control.

• CVE-2026-45597HIGH 7.0

  A race condition vulnerability in Windows UI Automation Manager allows an authorized local user to escalate privileges on affected systems. The flaw arises from improper synchronization when multiple processes access shared resources simultaneously. An attacker with existing local access can exploit timing windows to gain system-level privileges. This is not a remote vulnerability and requires prior authentication or local access, which narrows but does not eliminate the risk in shared computing environments.

• CVE-2026-45598HIGH 7.0

  A race condition in Windows' Ancillary Function Driver for WinSock (AFD.sys) allows an attacker who already has local access to a system to escalate their privileges to a higher level. The vulnerability stems from improper synchronization when the driver handles shared resources, meaning that under specific timing conditions, an attacker can exploit the flaw to gain elevated permissions. This is not a remote attack—the attacker must already have a foothold on the machine, such as a low-privileged user account or compromised application context.

• CVE-2026-45601HIGH 7.0

  A race condition in the Windows Ancillary Function Driver for WinSock allows someone already logged into a Windows system to escalate their privileges to a higher level of access. The vulnerability arises from improper synchronization of shared resources, meaning two processes can interfere with each other when accessing the same data simultaneously. An attacker with local user privileges can exploit this timing-dependent flaw to gain elevated system rights, though doing so requires specific conditions and is not trivial to reproduce reliably.

• CVE-2026-45603HIGH 7.0

  A race condition vulnerability exists in Windows' Ancillary Function Driver for WinSock (AFD) that allows an authorized local user to escalate privileges to a higher level on the system. The flaw arises from improper synchronization when multiple processes access a shared resource simultaneously, creating a narrow window of opportunity for an attacker to manipulate the driver's behavior. An authenticated user with basic local access can exploit this to gain elevated privileges, potentially achieving full system compromise. This is not a remote vulnerability and requires the attacker already has some level of access to the target machine.

• CVE-2026-45640HIGH 7.0

  A use-after-free vulnerability in the Windows Bluetooth Port Driver permits a user with local system access to escalate their privileges to a higher level. The flaw exists because the driver fails to properly manage memory when Bluetooth port operations conclude, leaving a freed memory region accessible for malicious manipulation. An attacker must already have some level of local authentication and user rights to exploit this issue, but successful exploitation grants full system control.

• CVE-2026-45653HIGH 7.0

  A heap-based buffer overflow vulnerability in the Windows Kernel allows a user with local system access to overflow a memory buffer, enabling them to execute code with elevated privileges. The attack requires an authenticated user account and moderate technical effort to exploit, but if successful grants attacker control over the affected system. This is a local privilege escalation issue, not a remote attack vector.

• CVE-2026-46154HIGH 7.0

  A race condition exists in the Linux kernel's scheduler extension (sched_ext) cgroup interface that can lead to use-after-free memory access. When system administrators adjust cgroup scheduling parameters like weight, idle status, or bandwidth, the kernel reads a pointer to the scheduler without proper synchronization. If another process simultaneously disables and re-enables a different scheduler, the cached pointer becomes stale and points to freed memory. When the original operation tries to use this pointer, it dereferences already-freed kernel memory, potentially allowing local privilege escalation.

• CVE-2026-46164HIGH 7.0

  A memory management bug in the Linux kernel's Btrfs filesystem can cause the same memory region to be freed twice when a sysfs initialization step fails. This double-free condition can lead to memory corruption and potentially allow an attacker with local access to crash the system or execute code with elevated privileges. The issue occurs in error handling code that wasn't properly coordinated between two layers of the filesystem's initialization logic.

• CVE-2026-46299HIGH 7.0

  CVE-2026-46299 is a lock-handling bug in the Linux kernel's HFS+ filesystem driver that can allow a local attacker with moderate privileges to crash the system or potentially escalate privileges. The vulnerability occurs during filesystem mount when the code acquires a lock but fails to release it properly if certain filename validation steps fail. This causes the system to detect a memory leak while a critical lock is still held, triggering a kernel warning and potential system instability.

• CVE-2026-46309HIGH 7.0

  CVE-2026-46309 is a memory access control flaw in the Linux kernel's GPU driver (xe) that can leak sensitive data. When a privileged process uses a low-coherency GPU memory mode on CPU-cached buffers, the GPU can bypass CPU caches and read stale data directly from RAM—including sensitive information from previously freed memory of other processes. The fix validates GPU memory configuration requests to prevent this dangerous combination.

• CVE-2026-47293HIGH 7.0

  A use-after-free vulnerability exists in Microsoft Office's Click-To-Run installation and update mechanism. An attacker with valid credentials on a local machine can exploit a memory management flaw to gain elevated (administrator) privileges. This is not a remote vulnerability—it requires an authorized user account and local access—but the privilege escalation risk makes it a meaningful threat in environments where credential compromise or insider activity is a concern.

• CVE-2026-47648HIGH 7.0

  CVE-2026-47648 is a privilege escalation vulnerability in Windows Storage that affects multiple versions of Windows 10, Windows 11, and Windows Server. An authorized local user can exploit an untrusted search path flaw to gain elevated privileges on a compromised system. The vulnerability requires local access and user interaction is not needed, but exploitation depends on specific system conditions. With a CVSS score of 7.0 (HIGH), this poses a meaningful risk to environments where local account compromise is plausible.

• CVE-2026-54229HIGH 7.0

  A timing vulnerability exists in the abrt-dbus D-Bus service that allows a local attacker with limited privileges to take control of crash dump files while the system is processing them. The vulnerability stems from a race condition where the ChownProblemDir method changes file ownership even though privileged event handlers are actively writing to the same directory. An attacker exploiting this can redirect, modify, or delete crash dumps before they're fully processed, potentially compromising system integrity and enabling local privilege escalation.

• CVE-2026-54230HIGH 7.0

  A vulnerability in libreport's ABRT (Automatic Bug Reporting Tool) event handler scripts allows a local attacker with limited privileges to overwrite arbitrary files on a system. The flaw occurs because event scripts use file output redirection without protective measures that would prevent following symbolic links. An attacker can replace a target file with a symlink pointing to a sensitive system file, then trigger an ABRT event. Since the event scripts run as root, they unwittingly follow the symlink and write data to the attacker's chosen location, potentially corrupting critical system files or planting malicious content.

• CVE-2026-54321HIGH 7.0

  Daytona, a platform for running AI-generated code securely, had a caching bug that allowed certain sandboxes to remain publicly accessible even after their owners switched them to private. If an organization marked a preview sandbox as private, the system's cache did not update immediately, creating a window where unauthenticated users could still access the sandbox and potentially view or interact with code and data that should have been restricted. This gap has been closed in version 0.184.0.

• CVE-2026-6090HIGH 7.0

  CVE-2026-6090 is a HIGH severity authentication bypass vulnerability in Lenovo Smart Connect for Windows that allows an authenticated local user to gain elevated system privileges and run arbitrary code. An attacker already logged into the system could exploit this to escalate their access and take full control of the machine. The vulnerability requires local access and some specific conditions to trigger, making it a meaningful risk for shared systems or environments where user accounts are provisioned broadly.