By severity

High-severity vulnerabilities

CVEs rated High by CVSS, with SEC.co remediation and prioritization guidance.

4140 published vulnerabilities · page 34 of 42

• CVE-2026-59935HIGH 7.5

  A crafted PDF file can cause pypdf to hang indefinitely when processing its contents. The attack works by embedding a malformed inline image in the PDF that uses compression filters (ASCII85 or ASCIIHex) but lacks proper termination markers. When pypdf attempts to extract text or parse the page, it enters an infinite loop trying to decode this image data. This denial-of-service condition affects pypdf versions before 6.14.2.

• CVE-2026-59936HIGH 7.5

  A vulnerability in pypdf, a popular open-source Python PDF library, allows an attacker to crash or hang applications that process PDFs. By crafting a malicious PDF with a malformed inline image in the page content, an attacker can trigger an infinite loop when the library tries to extract text or process the page. This causes a denial of service, making the application unresponsive. The flaw affects all versions before 6.14.1 and has been patched in that release.

• CVE-2026-59937HIGH 7.5

  pypdf, a popular open-source Python library for PDF manipulation, contains a denial-of-service vulnerability in versions prior to 6.14.0. An attacker can create a specially crafted PDF file containing repeated malformed cross-reference streams that force pypdf into excessive processing loops while attempting to recover broken table entries. This causes the application to hang or consume CPU resources, effectively denying service to legitimate users. The vulnerability requires no authentication or user interaction—simply opening the malicious PDF triggers the issue.

• CVE-2026-59939HIGH 7.5

  httplib2, a widely-used Python HTTP client library, contains a flaw that allows attackers to crash applications using it. When an HTTP server returns a response with gzip or deflate compression, httplib2 decompresses the entire payload into memory without checking its final size. An attacker controlling the server (or intercepting traffic) can send a tiny compressed file that expands to gigabytes in memory, overwhelming the client and causing it to run out of memory. This affects all versions before 0.32.0.

• CVE-2026-60108HIGH 7.5

  Zeek, a popular open-source network security monitoring platform, contains a denial-of-service vulnerability in its FTP analyzer component. An unauthenticated attacker on the network can trigger excessive memory consumption by sending a specially crafted FTP command sequence that forces Zeek to allocate memory without limit, eventually crashing the sensor. This affects Zeek versions before 8.0.9 and requires no credentials or user interaction to exploit.

• CVE-2026-60109HIGH 7.5

  Zeek, an open-source network security monitoring platform, contains a crash vulnerability in its Kerberos protocol analyzer. An attacker can send a specially crafted Kerberos error message to port 88 without authentication, causing the Zeek sensor to crash and stop monitoring network traffic. This is a denial-of-service attack that requires only a single packet and no credentials.

• CVE-2026-6101HIGH 7.5

  The AMP for WP plugin, a WordPress extension used to optimize mobile page performance, contains a flaw in how it handles file uploads. When the plugin processes compressed ZIP files containing fonts, it doesn't properly clean up temporary files and directories after extraction. An authenticated WordPress user with Author-level permissions or higher can exploit this to upload malicious files—including PHP scripts—to the server's uploads directory. If the web server is configured to execute PHP files from that directory, an attacker could achieve remote code execution.

• CVE-2026-6230HIGH 7.5

  The Tainacan plugin for WordPress contains a SQL injection vulnerability that allows attackers to query the site's database without authentication. By manipulating the 'geoquery' parameter, an attacker can inject malicious SQL commands to extract sensitive data such as user credentials, post content, and configuration details. The vulnerability affects all versions up to 1.0.3 and requires no user interaction or authentication to exploit.

• CVE-2026-6325HIGH 7.5

  A memory corruption vulnerability exists in WolfSSL's signature algorithm processing code. When the library receives a specially crafted TLS message with an abnormally large list of signature algorithms, it writes data beyond the allocated buffer boundaries. This out-of-bounds write can corrupt adjacent memory, potentially allowing an attacker to modify application behavior or crash the service. The flaw requires no authentication and can be triggered over the network during the TLS handshake.

• CVE-2026-6331HIGH 7.5

  A cryptographic validation weakness in WolfSSL's HMAC verification allows forged or truncated message authentication codes to be accepted as valid. The vulnerability exists in the EVP_DigestVerifyFinal function, where the system fails to strictly validate that a supplied signature matches the full expected length. An attacker can craft a zero-length or shortened tag that passes verification when it should be rejected, potentially allowing tampered messages to be accepted as authentic.

• CVE-2026-6679HIGH 7.5

  A memory corruption flaw exists in wolfSSL's DTLS 1.3 implementation that allows an unauthenticated remote attacker to crash affected services. The vulnerability stems from incorrect math when calculating the size of a data structure, resulting in a smaller buffer being allocated than needed. When the code then writes data into this undersized buffer, it corrupts adjacent memory and triggers a denial of service. This can happen before the connecting peer has proven its identity, making it exploitable by anyone on the network.

• CVE-2026-6731HIGH 7.5

  CVE-2026-6731 is a flaw in how X.509 certificate name constraints are validated. Specifically, when a certificate's Subject Common Name (CN) is processed as a DNS hostname, an attacker can bypass the name constraints that a trusted certificate authority imposed. This means a certificate could be issued that violates the CA's policy—for example, claiming to be for a domain it should not be allowed to represent. The flaw affects wolfSSL and has a CVSS score of 7.5 (HIGH), indicating moderate-to-high risk due to the integrity impact on certificate validation.

• CVE-2026-6734HIGH 7.5

  A vulnerability in Node.js undici's Socks5ProxyAgent causes it to reuse a single connection pool across multiple destination origins without validation. This means when an application makes requests to different servers through a proxy, undici incorrectly routes requests intended for one destination through a connection pool established for another destination. The result is that sensitive credentials and data meant for origin B get sent to origin A instead, responses from the wrong server are trusted as legitimate, and HTTPS connections may be downgraded to unencrypted HTTP. This affects applications that use Socks5ProxyAgent (either directly or through the global dispatcher) and communicate with more than one origin. The defect was introduced in version 7.23.0 and persists through version 8.1.0.

• CVE-2026-6854HIGH 7.5

  The My Calendar – Accessible Event Manager WordPress plugin contains a SQL injection flaw that allows attackers to query and extract sensitive data from affected websites without any authentication. By manipulating the 'mc_auth' parameter, an attacker can inject malicious SQL commands directly into database queries. The vulnerability exists in all versions through 3.7.8 and poses a high risk because it requires no special access or user interaction to exploit.

• CVE-2026-6893HIGH 7.5

  A vulnerability in dracut, a critical tool used during Linux system boot, allows an attacker on the same local network to inject malicious commands during the DHCP configuration process. By crafting specially designed DHCP responses (for example, containing a hostile hostname), an attacker can execute arbitrary code with root privileges while the system is still booting. This happens because dracut fails to properly escape DHCP data before inserting it into temporary shell scripts used during initialization. The attack requires network proximity but no authentication, making it a practical threat in shared network environments such as offices, data centers, or cloud infrastructure.

• CVE-2026-7250HIGH 7.5

  GitLab Community Edition and Enterprise Edition contain a vulnerability that allows unauthenticated attackers to disrupt service availability. The issue stems from insufficient validation of API requests in the request parsing middleware. An attacker can send specially crafted requests to trigger a denial-of-service condition without needing authentication or user interaction. This affects multiple version lines, but patches have been released.

• CVE-2026-7459HIGH 7.5

  A flaw in the Simple History WordPress plugin allows low-privilege users (Subscribers) to take over administrator accounts. The vulnerability exists in how the plugin checks permissions when users react to logged events. Instead of enforcing the proper permission checks, the plugin only verifies that someone is logged in. An attacker with a basic account can read sensitive event details—including password-reset links—that should only be visible to authorized administrators. By combining this with a forced password reset, an attacker can hijack an admin account. Notably, this only affects sites that have enabled the plugin's experimental features option, which is not the default configuration.

• CVE-2026-7511HIGH 7.5

  A flaw in PKCS#7 signature verification allows an attacker to forge digital signatures by manipulating which signer is associated with a signature. The vulnerability fails to correctly bind the signer identity to the signature itself, meaning a forged signature can be validated as authentic. This undermines the core trust mechanism of digital signatures—non-repudiation and identity verification.

• CVE-2026-7532HIGH 7.5

  A vulnerability in wolfSSL allows certificates with invalid IP address restrictions to be accepted when a specific compile-time flag is not enabled. Certificate authorities can impose IP address constraints to limit where a certificate is trusted; this flaw bypasses that protection, potentially allowing a fraudulent certificate to be used from unauthorized network locations.

• CVE-2026-7787HIGH 7.5

  IBM Langflow OSS versions 1.0.0 through 1.9.1 contain a flaw that allows authenticated users to access or alter sensitive data by exploiting insecure direct object references (IDOR). An attacker with valid credentials can bypass intended access controls to view or modify information they should not have permission to access. This represents a classic authorization weakness where the application relies on user-supplied identifiers without properly validating ownership or access rights.

• CVE-2026-7797HIGH 7.5

  The Appointment Booking Calendar plugin for WordPress contains a SQL injection vulnerability that allows unauthenticated attackers to query the site's database and extract sensitive information. The vulnerability exists in how the plugin processes appointment booking requests through a REST API endpoint, accepting malicious SQL code without proper validation. Attackers can exploit this remotely without needing a user account on the WordPress site.

• CVE-2026-8023HIGH 7.5

  Zephyr's HTTP server has a path-traversal vulnerability in its static file serving feature. When configured to serve files from a specific directory, the server fails to properly validate request paths, allowing an attacker to use sequences like ../../ to escape the intended directory and read arbitrary files on the system. An unauthenticated remote attacker can exploit this over the network without encryption or authentication—they simply craft a specially-formed HTTP request to retrieve sensitive files they shouldn't have access to.

• CVE-2026-8050HIGH 7.5

  SignalRGB, a popular lighting control application, contains a critical flaw in its driver software that can crash your system. The vulnerability exists in seven of the driver's thirteen command handlers, which fail to check whether input data is actually present before attempting to use it. An attacker can send a specially crafted command with no data, causing the driver to attempt to access invalid memory and trigger a complete system crash (blue screen). This requires network access but no authentication or user interaction.

• CVE-2026-8176HIGH 7.5

  The LatePoint calendar booking plugin for WordPress contains a chain of three separate vulnerabilities that can be combined by an authenticated Agent user to gain full Administrator access. An attacker with Agent-level credentials can manipulate the plugin's functionality to reset an Administrator's password without triggering any Administrator-only security checks, effectively hijacking the WordPress site. This is particularly dangerous because Agent accounts are typically granted to lower-privileged users like appointment schedulers or booking managers—not full site administrators.

• CVE-2026-8293HIGH 7.5

  A vulnerability in the Really Simple Security WordPress plugin allows attackers to bypass two-factor authentication (2FA) on two of its REST API endpoints. An attacker with a user's password can obtain a valid WordPress session without completing the required email one-time password (OTP) challenge, effectively circumventing a key security control. This affects plugin versions prior to 9.5.10.1.

• CVE-2026-8379HIGH 7.5

  A WordPress plugin called Frontend File Manager has a security weakness that allows anyone on the internet to download files without permission. The plugin fails to properly verify user identity before allowing file downloads. An attacker can systematically guess or iterate through file identifiers to download files that other users uploaded, potentially exposing sensitive documents, images, or other data stored through the plugin.

• CVE-2026-8441HIGH 7.5

  The WP Review Slider Pro WordPress plugin contains a SQL injection vulnerability in its 'load more reviews' feature that allows unauthenticated attackers to extract sensitive data from a site's database. The vulnerability exists because user input is not properly validated before being used in database queries. Since the vulnerable AJAX endpoint is accessible to anyone without authentication and the security token is publicly visible on pages using the plugin, an attacker can craft malicious requests to read arbitrary information from the database.

• CVE-2026-8451HIGH 7.5

  Citrix NetScaler ADC and NetScaler Gateway contain an input validation flaw that can cause the system to read beyond intended memory boundaries when configured to act as a SAML Identity Provider. An unauthenticated network attacker can exploit this condition to extract sensitive data from system memory, potentially including authentication tokens, encryption keys, or other confidential information. The vulnerability requires specific SAML IDP configuration but no user interaction.

• CVE-2026-8705HIGH 7.5

  The ClearSale Total plugin for WordPress contains a SQL injection flaw in its AJAX handler that can be exploited by unauthenticated attackers to extract data from the site's database. The vulnerability exists because the plugin fails to properly validate user input before using it in database queries. While the code includes a security check (nonce verification), that check is ineffective due to a commented-out error handler. Additionally, on older PHP versions (before 8.0), type juggling allows attackers to bypass a safety check that should restrict which values are processed. This means any website running the vulnerable plugin on PHP < 8.0 can have its database queried and read by anyone on the internet without credentials.

• CVE-2026-8720HIGH 7.5

  wolfSSL's HMAC-BLAKE2 implementation contains a critical flaw where oversized cryptographic keys cause the authentication mechanism to ignore the actual message content. When a key exceeds BLAKE2's block size, the library discards previously accumulated message data and resets its internal state, resulting in a message authentication code (MAC) that depends only on the key—not on what is being authenticated. This means an attacker could substitute arbitrary data and still produce a valid MAC if they know or control the key, fundamentally breaking message authentication for affected implementations. The vulnerability is confined to HMAC-BLAKE2 APIs introduced in wolfSSL 5.9.0 and later.

• CVE-2026-8829HIGH 7.5

  HTML::Entities, a widely-used Perl library for encoding and decoding HTML entities, contains a use-after-free vulnerability in versions before 3.84. The flaw occurs in the internal _decode_entities function when processing specially crafted entity-reference strings. Under specific conditions—when the input string matches a cached entity value that contains a self-referential entity—the library can read from memory that has already been freed. This potentially exposes adjacent heap contents to an attacker, creating a limited information disclosure risk.

• CVE-2026-8858HIGH 7.5

  IBM WebSphere Application Server and WebSphere Application Server Liberty contain a flaw in their Web Server Plug-in component that allows attackers to execute arbitrary code or trigger denial of service. The vulnerability is triggered when an attacker impersonates a legitimate application server and delivers specially crafted responses to the plug-in. This represents a meaningful risk to organizations deploying these products in network environments where an attacker could position themselves on the communication path.

• CVE-2026-8878HIGH 7.5

  The Securly Chrome Extension version 3.0.7 contains a serious security flaw where multiple web endpoints can be accessed by anyone on the internet without authentication. These endpoints expose sensitive data in the form of SHA-1 password hashes. The hashes are protected only by a Caesar cipher—an extremely weak encryption method dating back centuries—making them trivial to decrypt. An attacker can recover the original hash values, which could then be used in further attacks or to compromise user accounts.

• CVE-2026-8879HIGH 7.5

  The Securly Chrome Extension version 3.0.7 contains a critical availability issue where a content script (content13.min.js) is loaded dynamically at runtime instead of being declared upfront in the extension's manifest file. This hidden script blanks out all web pages and displays a full-page overlay while it waits for Securly's servers to verify whether the page is safe. If Securly's servers cannot be reached or become unresponsive, affected users see nothing but a blank page with no way to access content—effectively breaking browsing until the service recovers or the extension is disabled.

• CVE-2026-8881HIGH 7.5

  The Securly Chrome Extension version 3.0.7 uses weak cryptographic practices to encrypt data. Specifically, it relies on MD5—a hash algorithm broken for over two decades—combined with a single-iteration key derivation process to generate encryption keys. This means an attacker with network access could potentially recover encrypted data without needing valid credentials, as modern computing power can reverse the weak key derivation quickly.

• CVE-2026-8888HIGH 7.5

  The Securly Chrome Extension version 3.0.7 has a vulnerability that allows attackers on the network path between a user and Securly's servers to inject malicious patterns into configuration files. When the extension processes these patterns as regular expressions, it can trigger a computational flaw that freezes the browser during all web activity. This requires the attacker to be positioned to intercept traffic (such as on a shared network or through DNS hijacking) but does not require user interaction or authentication.

• CVE-2026-8889HIGH 7.5

  Securly's Chrome Extension version 3.0.7 relies on SHA-1 hashing—a cryptographically weak algorithm—to validate URLs against two critical blocklists: the Internet Watch Foundation (IWF) CSAM database and CIPA compliance rules. SHA-1's collision vulnerabilities mean an attacker could craft a malicious URL that hashes to the same value as a legitimate blocked URL, potentially bypassing content filtering controls that organizations depend on for legal compliance and child safety.

• CVE-2026-8932HIGH 7.5

  libcurl, a widely-used open-source library for transferring data via URLs, contains a vulnerability in how it manages connections across multiple operations. When you configure client certificate authentication (mTLS), libcurl caches connections for reuse to improve performance. However, the library fails to account for changes in client certificate and private key settings when deciding whether a cached connection is safe to reuse. This means an attacker could potentially cause libcurl to use a connection authenticated with the wrong certificate or key, bypassing intended security controls.

• CVE-2026-9071HIGH 7.5

  IBM WebSphere Application Server versions 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.6 contain a vulnerability that allows remote attackers to crash or severely degrade server performance by sending specially crafted requests. The vulnerability causes the affected server to consume excessive memory, leading to denial of service. No authentication is required to exploit this issue, and attackers can trigger it over the network.

• CVE-2026-9076HIGH 7.5

  CVE-2026-9076 is a denial-of-service vulnerability in OpenSSL's CMS password-based decryption functionality. When processing specially crafted CMS messages, an attacker can trigger a heap buffer over-read that may crash the application. The vulnerability exists because OpenSSL's key unwrapping code assumes the cipher used for key encryption is block-based, but an attacker can specify a stream-mode cipher instead, bypassing length checks. No password knowledge is required to attempt the attack, and the vulnerability affects any application that decrypts untrusted CMS data using password-based key recovery. The FIPS modules are unaffected.

• CVE-2026-9096HIGH 7.5

  Casdoor, an open-source identity and access management platform, fails to validate SAML assertion expiration times in versions 2.362.0 and earlier. While the underlying gosaml2 library correctly computes whether SAML assertions have expired or are not yet valid, Casdoor discards these timing checks before granting user sessions. This means an attacker could replay or reuse expired SAML assertions to gain unauthorized access, bypassing a critical security boundary in federated authentication.

• CVE-2026-9178HIGH 7.5

  The WP Forms Connector plugin for WordPress has a flaw that allows attackers to steal sensitive user information without needing valid credentials. The plugin exposes a REST API endpoint that is supposed to require authentication, but its password check is broken—it accepts any password as long as you know an admin username (typically 'admin'). This means an attacker can retrieve password hashes, email addresses, and other private data for any user on the site by making a simple web request.

• CVE-2026-9179HIGH 7.5

  The WP Forms Connector plugin for WordPress contains a SQL injection vulnerability that allows unauthenticated attackers to extract sensitive data from the WordPress database. The flaw exists in how the plugin handles the 'order' parameter in a REST API endpoint, failing to properly sanitize user input before using it in database queries. An attacker can craft a malicious request to inject additional SQL commands and read unauthorized information from the database.

• CVE-2026-9185HIGH 7.5

  The 6Storage Rentals WordPress plugin contains an authorization flaw that allows unauthenticated attackers to access and modify sensitive tenant information without permission. By sending a simple web request with a guessed tenant ID number, an attacker can read or change names, email addresses, phone numbers, physical addresses, and social security numbers belonging to any tenant in the system. The vulnerability exists in two plugin functions that were incorrectly exposed to unauthenticated users and fail to verify that the requester actually owns the account they're trying to access.

• CVE-2026-9220HIGH 7.5

  Setracker2, an Android companion app for managing smartwatches and wearable devices, uses the same encryption keys for all instances of the app. This means an attacker intercepting network traffic between the app and Setracker2's backend servers can decrypt and read sensitive data being transmitted. The vulnerability affects version 3.1.5 and all earlier releases. While an attacker cannot modify the data in transit (integrity is not compromised) or disrupt service, they can see what information is being communicated—potentially including user location, device data, account identifiers, or other personal information stored on or synced by the watch.

• CVE-2026-9221HIGH 7.5

  Setracker2, an Android companion app for fitness trackers and personal devices, uses an outdated cryptographic method (MD5) to sign communications between your phone and its servers. This weakness allows attackers to potentially crack the signature and steal your session ID—essentially a digital key that proves you're you. Once stolen, an attacker could log into your account and make changes on your behalf without needing your password.

• CVE-2026-9290HIGH 7.5

  The WP User Manager plugin for WordPress contains a flaw that allows anyone on the internet to include and run arbitrary PHP files from the server. An attacker doesn't need a login or any special access—they can craft a request that tricks the plugin into loading a PHP file and executing whatever code is inside it. If the server already has a malicious PHP file (from a previous upload or misconfiguration), this vulnerability turns it into a direct path to taking over the site or stealing data. The vulnerability affects all versions through 2.9.17.

• CVE-2026-9375HIGH 7.5

  urllib3 2.6.3 contains a flaw that allows remote servers to crash applications by sending specially crafted compressed files. When an application uses urllib3's streaming mode to download data without checking the decompressed size, a malicious server can send a compressed payload that expands into enormous amounts of data in memory, exhausting system resources and causing the application to become unavailable. This affects users of popular Python libraries like `requests` that rely on urllib3 for HTTP communication.

• CVE-2026-9516HIGH 7.5

  Cpanel::JSON::XS, a popular Perl library for JSON processing, contains a vulnerability that can crash applications when they process JSON documents that start with a UTF-8 byte order mark (BOM) and use callback filters during decoding. The issue stems from incorrect memory pointer management: when a decode filter throws an exception, the library fails to properly restore the input scalar's internal pointer, leaving it in an invalid state. This corrupted state causes a crash when the memory is eventually freed. An attacker can trigger this denial of service by sending a specially crafted JSON document to any application using the vulnerable library with filtering enabled.

• CVE-2026-9545HIGH 7.5

  CVE-2026-9545 is a flaw in libcurl that can leak sensitive data when making HTTPS requests to servers after a connection has been compromised or replaced by an attacker. The vulnerability occurs because libcurl may transmit request data before fully validating the server's certificate if certain caching and optimization features are enabled. An attacker who can intercept network traffic—such as one positioned on the same network or controlling network infrastructure—could position themselves between the client and server, and libcurl would send sensitive information before detecting the fraudulent certificate.

• CVE-2026-9546HIGH 7.5

  libcurl, a widely-used library for transferring data via URLs, has a flaw in how it handles the HTTP Referer header. When developers attempt to clear this header by passing NULL to the CURLOPT_REFERER option—as the documentation promises—the library fails to actually remove the header from its internal state. Instead, it reuses the previous referrer string in subsequent HTTP requests. This causes sensitive information (such as URLs containing tokens, session IDs, or internal paths) to leak to servers that should never receive that data.

• CVE-2026-9563HIGH 7.5

  Eclipse Parsson, a popular JSON parsing library, contains a denial-of-service vulnerability in versions before 1.1.8. The parser lacks built-in limits on the total number of characters it will consume while processing a single JSON document. An attacker can craft an extremely large JSON payload—whether through massive arrays, deeply nested objects, enormous strings, or other valid JSON structures—that forces affected applications into excessive CPU and memory consumption, effectively freezing or crashing the service. Version 1.1.8 and later introduce a configurable parsing limit (defaulting to 15 million characters) to prevent this attack.

• CVE-2026-9638HIGH 7.5

  Crypt::PBKDF2 is a Perl library that implements PBKDF2, a password-based key derivation function widely used to securely hash and store passwords. Versions before 0.261630 contain a critical flaw: they generate salt values—random numbers meant to make each password hash unique—using Perl's built-in rand() function, which is mathematically predictable and fundamentally unsuitable for cryptographic use. An attacker who knows or can predict the salt can dramatically accelerate password cracking attacks, defeating the security benefits of PBKDF2.

• CVE-2026-9650HIGH 7.5

  CVE-2026-9650 is a credential storage vulnerability affecting Schneider Electric industrial control devices. Attackers can read poorly protected credentials directly from firmware or system files without needing to authenticate first. Once an attacker obtains these credentials, they can use them to compromise the device—though the vulnerability description notes this requires physical access to the device itself. The vulnerability carries a HIGH severity rating due to the potential for unauthorized system access and sensitive data exposure.

• CVE-2026-9675HIGH 7.5

  Undici is a widely-used WebSocket client library for Node.js. A flaw in versions 8.1.0 through 8.4.0 allows a malicious WebSocket server to exhaust memory on the client by sending many small message fragments. While each individual fragment stays within the configured size limit, the attacker can chain fragments together to accumulate data far beyond what the client should accept, eventually forcing the process to run out of memory and crash. This is a denial-of-service vulnerability that affects any application using undici's WebSocket functionality and connecting to a compromised or attacker-controlled server.

• CVE-2026-9690HIGH 7.5

  A security flaw in WP Media folder Addon version 4.0.1 and earlier allows attackers to download arbitrary files from affected WordPress installations without needing to log in. The vulnerability stems from insufficient access controls on file download functionality, enabling an unauthenticated actor to retrieve sensitive files such as configuration data, database backups, or other protected assets directly from the server.

• CVE-2026-9700HIGH 7.5

  The Eventer plugin for WordPress contains a SQL injection vulnerability that allows unauthenticated attackers to inject malicious SQL commands through the 'code' parameter. By crafting specially formed requests, attackers can bypass the plugin's input validation and execute arbitrary database queries to extract sensitive data, such as user credentials, email addresses, or other confidential information stored in WordPress databases. No authentication is required to exploit this vulnerability.

• CVE-2026-9702HIGH 7.5

  A WordPress plugin used to integrate InPost parcel-locker shipping with WooCommerce has a critical flaw: it allows anyone on the internet to change where an order gets shipped without needing to log in or prove they own that order. An attacker can intercept pending or processing orders and redirect them to a different parcel locker, effectively stealing goods or disrupting legitimate deliveries. The vulnerability affects versions of the InPost PL plugin before 1.9.1.

• CVE-2026-9716HIGH 7.5

  CVE-2026-9716 is a denial-of-service vulnerability in Schneider Electric PowerLogic P7 that occurs when the device receives malformed network requests. The flaw causes a null pointer dereference—a memory error where the application tries to access data that doesn't exist—forcing the device to crash or become unresponsive. Once triggered, the HMI (human-machine interface) and configuration tools become unavailable, potentially disrupting power monitoring and management operations until the device is restarted.

• CVE-2026-9740HIGH 7.5

  MongoDB Server contains a flaw in how it validates BSON (Binary JSON) data structures that allows anyone on the network to crash the database server without needing to log in. An attacker can send a specially crafted message that exploits recursion logic in the validation code, causing the mongod process to fail. This is a denial-of-service issue—data is not stolen or modified, but legitimate database access becomes unavailable.

• CVE-2026-9742HIGH 7.5

  CVE-2026-9742 is a pre-authentication denial-of-service vulnerability in MongoDB when OIDC (OpenID Connect) authentication is enabled. Unauthenticated attackers can crash the server by sending specially crafted values in the "mechanism" parameter of the authenticate command, disrupting service availability without requiring valid credentials.

• CVE-2026-9757HIGH 7.5

  The GEO my WP WordPress plugin contains a SQL injection vulnerability that allows attackers to extract sensitive data from a site's database. The flaw exists in how the plugin processes geographic coordinate parameters (swlatlng and nelatlng) without proper validation or sanitization. An attacker can craft a malicious URL to inject SQL commands that execute alongside legitimate queries, potentially revealing user data, posts, and other confidential information. No authentication is required, and the vulnerability affects all versions up to and including 4.5.5.

• CVE-2026-9776HIGH 7.5

  ATEN Unizon contains a directory traversal flaw that allows unauthenticated attackers to read sensitive files from the system. The vulnerability exists in a file-handling function that doesn't properly validate user-supplied file paths before accessing them. An attacker can exploit this over the network to retrieve files with SYSTEM-level privileges, potentially exposing passwords, configuration data, or other confidential information stored on the affected device.

• CVE-2026-9842HIGH 7.5

  The Backstage - Customizer Demo Access plugin for WordPress contains a privilege escalation flaw affecting all versions up to 1.4.2. The plugin incorrectly grants the `manage_options` capability—which controls nearly all WordPress administrative functions—to a demo user role intended only for Customizer access. An unauthenticated attacker can exploit this to gain administrative control by modifying core WordPress options, such as reassigning the default user role to grant themselves full site privileges.

• CVE-2026-9848HIGH 7.5

  The WP Ticket plugin for WordPress contains a SQL injection vulnerability accessible to unauthenticated attackers through the search functionality. When a user performs a front-end search, the plugin fails to properly sanitize the search query parameter before inserting it into a database query. An attacker can craft a malicious search term to extract sensitive data from the WordPress database without needing to log in. This vulnerability affects WP Ticket versions up to and including 6.0.4.

• CVE-2026-9863HIGH 7.5

  Fortra BoKS Manager, a privileged access management tool, contains a command injection vulnerability in its legacy client upgrade mechanism. When a compromised or malicious tar-based client is selected for upgrade or patching, an attacker can execute arbitrary OS commands on the BoKS Master server. This vulnerability requires user interaction (an administrator initiating an upgrade) and network access, but the impact is severe—attackers gain the ability to compromise the core access control infrastructure that BoKS Manager protects.

• CVE-2026-9901HIGH 7.5

  A use-after-free flaw in ANGLE (the graphics abstraction layer used by Chrome) allows an attacker to run malicious code on a target's machine. The attack requires two conditions: the attacker must first compromise Chrome's renderer process (the component that draws web content), and the victim must then visit a specially crafted web page. Once both conditions are met, arbitrary code can execute with the privileges of the compromised renderer process. This affects Chrome versions before 148.0.7778.216.

• CVE-2026-9909HIGH 7.5

  A flaw in Skia, the graphics rendering library used by Google Chrome, can be exploited by an attacker who has already compromised Chrome's sandboxed renderer process. The vulnerability stems from improper handling of integer values, which an attacker could leverage to execute arbitrary code within the sandbox by serving a specially crafted HTML page. While the vulnerability requires prior compromise of the renderer process, it represents a critical step in a potential attack chain that could lead to full browser compromise.

• CVE-2026-9922HIGH 7.5

  A use-after-free vulnerability exists in Google Chrome's GPU rendering engine on macOS. The flaw allows an attacker who has already compromised Chrome's renderer process to execute arbitrary code by serving a specially crafted HTML page. This is a post-compromise risk: the attacker must first break into the renderer sandbox, but if successful, can then escalate to full code execution with system privileges. The vulnerability affects Chrome versions prior to 148.0.7778.216 on macOS.

• CVE-2026-9933HIGH 7.5

  CVE-2026-9933 is a use-after-free memory vulnerability in Google Chrome's input handling code that allows attackers to corrupt heap memory on affected systems. Exploitation requires an attacker to trick a user into performing specific UI interactions (such as unusual mouse or keyboard gestures) while viewing a specially crafted HTML page. This is not a passive drive-by attack; active user participation is required. If successfully exploited, an attacker could execute arbitrary code with the privileges of the Chrome process, leading to complete compromise of the affected user's system.

• CVE-2026-9934HIGH 7.5

  A use-after-free memory flaw exists in Google Chrome's Aura component (which handles window management and input) before version 148.0.7778.216. An attacker could exploit this by convincing a user to interact with a specially crafted webpage using specific mouse or keyboard gestures. Successful exploitation would allow the attacker to run arbitrary code on the victim's machine with the privileges of the Chrome process.

• CVE-2026-9954HIGH 7.5

  A use-after-free vulnerability exists in Google Chrome's TabStrip component that can lead to memory corruption. An attacker must trick a user into performing specific UI interactions (like clicking or dragging tabs in a particular sequence) on a malicious website to potentially trigger the flaw. Successful exploitation could allow the attacker to read sensitive data, modify page content, or crash the browser. The vulnerability affects Chrome versions prior to 148.0.7778.216 across Windows, macOS, and Linux.

• CVE-2026-9956HIGH 7.5

  A use-after-free vulnerability in Google Chrome on iOS allows remote attackers to execute arbitrary code if a user can be tricked into performing specific gestures on a malicious webpage. The vulnerability requires user interaction but doesn't require special privileges or system access, making it a realistic attack vector for threat actors hosting compromised or attacker-controlled sites.

• CVE-2026-9960HIGH 7.5

  A flaw in PDFium, the PDF rendering library used by Google Chrome, allows an attacker who has already compromised Chrome's renderer process to break out of the sandbox and run arbitrary code with elevated privileges by supplying a specially crafted font file. This represents a significant post-compromise risk for users who may have already been exposed to initial malware or browser exploits.

• CVE-2026-9963HIGH 7.5

  A memory initialization flaw in Google Chrome for iOS (versions before 148.0.7778.216) could allow an attacker to run malicious code within the browser's sandbox if a user visits a crafted webpage and performs specific touch interactions. The vulnerability requires active user engagement to exploit—simply landing on a malicious site is not enough. Code execution remains confined to the browser sandbox, limiting direct system compromise but still posing a meaningful threat to user data and browser security.

• CVE-2026-9990HIGH 7.5

  Google Chrome on macOS contains a use-after-free vulnerability in its web app installation feature that could allow an attacker to corrupt memory on a user's system. The vulnerability requires a user to perform specific interactions with a malicious webpage, but once triggered, it could potentially give an attacker the ability to read sensitive data, modify files, or crash the browser. The issue affects Chrome versions before 148.0.7778.216 on Mac systems.

• CVE-2022-4991HIGH 7.4

  Tychon, a Windows application, contains a vulnerability in how it configures OpenSSL. An unprivileged user can place a malicious configuration file in a location that Tychon's privileged service will read, potentially allowing that user to execute arbitrary code with SYSTEM-level privileges. This is a local privilege escalation vulnerability that requires an attacker to have filesystem write access to a specific directory on the target system.

• CVE-2025-14774HIGH 7.4

  CVE-2025-14774 is a flaw in ABB T-MAC Plus (version 4.0-24) where access control is not properly enforced, allowing an attacker on the same network to disrupt system availability without needing credentials or user interaction. The vulnerability has a CVSS score of 7.4 (HIGH) and is classified as an incorrect authorization issue.

• CVE-2025-64390HIGH 7.4

  PlayStation 4 consoles running firmware versions 13.00 through 13.02 are vulnerable to a privilege escalation attack that allows an attacker with local access to escape the Blu-ray Disc Java (BD-J) sandbox environment by crafting a malicious JAR file. Once the sandbox is bypassed, an attacker could gain elevated system privileges on the device, potentially leading to unauthorized access or control of the console.

• CVE-2026-10303HIGH 7.4

  ServerCo's getssl tool versions 2.49 and earlier fail to properly validate ACME challenge tokens received from certificate authorities. This allows an attacker positioned on the network path to the CA, or operating a malicious CA endpoint, to inject specially crafted tokens that manipulate which files getssl writes to during certificate validation. Because getssl often runs with elevated privileges, a successful exploit can lead to unauthorized file creation or modification on the system, and in some cases, execution of arbitrary commands.

• CVE-2026-10629HIGH 7.4

  Verizon's IMS (IP Multimedia Subsystem) platform handles VoLTE call signaling without proper encryption and authentication protections. An attacker positioned on the network path—such as a rogue cell tower operator, compromised router, or ISP-level adversary—can eavesdrop on, modify, or spoof VoLTE call setup messages. This breaks the confidentiality of who is calling whom and when, and enables attackers to hijack, redirect, or terminate calls by tampering with unprotected signaling traffic.

• CVE-2026-10646HIGH 7.4

  Zephyr's DNS socket implementation contains a use-after-return vulnerability in its getaddrinfo() function. When a DNS query times out and is retried, the code fails to properly clean up the previous query before starting a new one. This leaves a stale callback pointing to an expired stack memory location. When a DNS response arrives—whether from a legitimate delayed resolver or spoofed by an attacker on the network—it triggers the dangling callback, which then writes data into memory that has already been reused by other functions. An attacker can exploit this via crafted or replayed DNS responses to corrupt memory, crash the system, or potentially execute code. This affects Zephyr versions 4.0.0 through 4.4.0.

• CVE-2026-10968HIGH 7.4

  A vulnerability in Chrome's graphics rendering engine (Dawn) on Windows allows attackers to steal sensitive data from websites you're visiting. If an attacker first compromises Chrome's renderer process—the part that runs web content—they can craft a malicious webpage to leak information across website boundaries, bypassing Chrome's security isolation. This requires the attacker to have already gained control of the renderer, making it part of a multi-stage attack but with serious data-theft consequences once achieved.

• CVE-2026-10973HIGH 7.4

  A flaw in Google Chrome's Dawn graphics component allowed attackers to extract sensitive data across website boundaries through a specially crafted web page. The vulnerability required user interaction (clicking or visiting a malicious page) but did not require any special privileges. An attacker could craft HTML that exploits uninitialized memory in Chrome's graphics processing to read data from other origins that should have been isolated, potentially exposing authentication tokens, personal information, or other sensitive content loaded in the same browser session.

• CVE-2026-10976HIGH 7.4

  A memory disclosure vulnerability exists in Google Chrome's graphics engine (Dawn) that could allow an attacker to read sensitive data from Chrome's process memory. The flaw stems from uninitialized variables being used without proper initialization checks. An attacker would need to trick a user into visiting a specially crafted webpage to trigger the vulnerability. The issue affects Chrome versions before 149.0.7827.53.

• CVE-2026-11541HIGH 7.4

  IBM's WebSphere Application Server and CICS Transaction Gateway contain a flaw that allows attackers to craft specially formed HTTP requests that confuse how the server parses incoming traffic. By exploiting inconsistencies in request interpretation, an attacker can smuggle malicious requests past security controls, potentially accessing sensitive data or modifying information without proper authorization. This affects multiple versions of WebSphere Application Server and CICS Transaction Gateway deployed across enterprise environments.

• CVE-2026-12068HIGH 7.4

  Avira Password Manager has a flaw that allows attackers to steal login credentials when you're using Firefox. The vulnerability works through a cross-origin iframe trick: when a malicious website embeds a hidden frame pointing to another site, Avira's autofill feature incorrectly fills login credentials intended for the parent page into fields within that hidden frame instead. An attacker can then harvest those credentials. The issue affects Windows, macOS, and Linux users running Avira Password Manager with Firefox.

• CVE-2026-12348HIGH 7.4

  Arc Search for Android contains an address bar spoofing vulnerability that allows attackers to display a legitimate domain name in the browser's address bar while simultaneously rendering malicious content underneath. This classic phishing vector tricks users into trusting the displayed domain and interacting with attacker-controlled forms, links, or scripts. The vulnerability requires user interaction (clicking or navigating) but no special privileges, making it a practical threat to any Arc Search user on Android.

• CVE-2026-12992HIGH 7.4

  Apicurio Registry contains a server-side request forgery (SSRF) vulnerability in its WSDL document processing. When handling Web Services Description Language files, the registry can be tricked into making HTTP requests to internal URLs that an attacker specifies. This occurs because the WSDL parser doesn't restrict where it can fetch imported documents from. An attacker with Developer-level permissions can exploit this by uploading a malicious WSDL file, allowing them to probe or interact with internal systems that should be isolated from external access.

• CVE-2026-13341HIGH 7.4

  Kong Konnect's Model Context Protocol (MCP) server before version 1.0.0 contains a flaw that allows remote attackers to inject malicious prompts indirectly, tricking the system into executing API requests the user never intended. An attacker can exploit this by crafting input that, when processed by the MCP server, causes it to perform unauthorized actions on behalf of legitimate users. No authentication is required, and while the attack requires user interaction (such as clicking a link or viewing content), the impact crosses trust boundaries, potentially exposing sensitive data across multiple systems.

• CVE-2026-3195HIGH 7.4

  CVE-2026-3195 is a heap memory corruption vulnerability in QEMU's virtual sound device. When the virtio-snd device processes incoming audio, a code path fails to validate whether incoming data fits within its buffer, enabling an attacker to write beyond allocated memory boundaries. The vulnerability stems from an incomplete fix to an earlier flaw (CVE-2024-7730). An attacker with local access to a QEMU guest or host with audio input enabled could exploit this to corrupt heap memory, potentially achieving code execution or denial of service.

• CVE-2026-34181HIGH 7.4

  OpenSSL's PKCS#12 file parser has a validation flaw that allows attackers to forge certificates and private keys. When a service uses PKCS#12 files with password-based authentication (specifically the PBMAC1 integrity mechanism), an attacker can craft a specially designed file that bypasses validation checks with a 1-in-256 success rate. This means an attacker could inject malicious certificates and keys into systems that process these files, potentially enabling account impersonation and unauthorized access.

• CVE-2026-41720HIGH 7.4

  Spring LDAP, a widely-used library for LDAP authentication and directory operations, contains a flaw in how it validates user credentials during the authentication process. Specifically, the vulnerability allows attackers to successfully authenticate by providing a username with an empty or null password—credentials that should never be accepted. An attacker exploiting this could gain unauthorized access to systems relying on Spring LDAP for authentication, provided they can interact with the LDAP authentication flow.

• CVE-2026-44393HIGH 7.4

  OpenStack's oslo.messaging library contains a critical flaw in how it validates TLS certificates when connecting to RabbitMQ brokers. The driver accepts any certificate signed by your organization's CA without checking that it actually belongs to the RabbitMQ server you're trying to reach. This means an attacker positioned on your network could intercept traffic, present a valid (but wrong) certificate, and trick OpenStack services into sending sensitive control-plane messages to the attacker instead of RabbitMQ. The vulnerability affects all versions from 1.0.0 through 17.3.0.

• CVE-2026-44726HIGH 7.4

  Deno versions 2.0.0 through 2.7.7 contain a flaw in how they handle TLS connections when automatic address-family fallback is enabled. If an initial connection attempt fails (such as dropping IPv6 traffic), Deno may reuse stale TLS upgrade logic when establishing a replacement connection, resulting in the new TCP connection never being encrypted. An attacker who can reliably trigger the first connection attempt to fail—for example, by blocking IPv6 on a dual-stack network—could force application data to be transmitted in plaintext, allowing them to intercept or modify traffic the application believed was secure.

• CVE-2026-44946HIGH 7.4

  Rancher's SAML authentication system has a replay vulnerability that allows attackers to reuse previously captured SAML assertions. SAML assertions are security tokens sent during login; normally, they should only work once. Because Rancher's Assertion Consumer Service (ACS) handler fails to enforce this one-time-use restriction, an attacker positioned on the network could intercept a valid SAML assertion and replay it multiple times to impersonate the original user. This is a man-in-the-middle risk that affects Rancher 2.14.0 through 2.14.2.

• CVE-2026-45300HIGH 7.4

  AsyncHttpClient (AHC), a popular Java library for making HTTP requests, contains a flaw in how it handles redirects to different websites. When your application follows a redirect, the library correctly strips away sensitive authentication headers (like `Authorization` and `Proxy-Authorization`) to prevent leaking credentials to the new destination—but it fails to strip `Cookie` headers. This means session cookies and other sensitive cookie data are inadvertently sent to the redirect target, even if it's a malicious or attacker-controlled server. An attacker could exploit this by tricking a user's browser or application into following a crafted redirect chain, capturing session tokens or other sensitive cookie values. Versions 2.15.0 and 3.0.10 fix this oversight.

• CVE-2026-45310HIGH 7.4

  CodeWhale, a terminal-based AI coding agent, contains a server-side request forgery (SSRF) vulnerability in versions prior to 0.8.22. The application attempts to block requests to sensitive internal services by checking whether the initial URL points to a restricted IP address. However, attackers can bypass this protection by crafting a URL that initially resolves to an allowed address but redirects to an internal service—such as cloud metadata endpoints or localhost—because the HTTP client automatically follows redirects without re-checking the security blocklist. This allows an attacker to trick CodeWhale into making requests to internal systems that should be off-limits.

• CVE-2026-45373HIGH 7.4

  CodeWhale, a terminal-based coding agent that integrates DeepSeek and MiMo AI models, contains a server-side request forgery (SSRF) vulnerability in versions prior to 0.8.26. The vulnerability exists because SSRF validation checks fail when IPv6 addresses are specified using bracket notation (e.g., http://[::1]). An attacker can bypass the SSRF defenses by crafting URLs with IPv6 localhost or other restricted addresses in this format, potentially allowing unauthorized access to internal services or metadata endpoints that the CodeWhale process can reach from its host environment.

• CVE-2026-45389HIGH 7.4

  OCaml-TLS, a cryptographic library implementing TLS/SSL protocols, fails to properly validate client certificates before accepting them for authentication. An attacker can present a certificate that lacks the proper authorization markers (KeyUsage and ExtendedKeyUsage attributes) and still have it accepted by the server, enabling account takeover or credential impersonation in systems that rely on client certificate authentication.