By severity

High-severity vulnerabilities

CVEs rated High by CVSS, with SEC.co remediation and prioritization guidance.

4140 published vulnerabilities · page 41 of 42

• CVE-2026-53044HIGH 7.1

  A memory access vulnerability exists in the Linux kernel's Tegra SoC cross-bar (CBB) fabric code. The vulnerability stems from incorrect array size calculations in lookup tables used during target timeout operations. When the kernel attempts to access fabric configuration data during a timeout event, it may read memory outside the intended table boundaries. This could allow a local attacker with minimal privileges to read sensitive kernel memory or cause a system crash.

• CVE-2026-53068HIGH 7.1

  A vulnerability exists in the Linux kernel's display driver (DRM/Komeda) where a math error during framebuffer validation can allow a user to trick the system into accepting an undersized memory buffer. When the kernel adds two numbers together to check buffer size requirements, it doesn't protect against arithmetic overflow—if the sum wraps around to a small number, a malformed request passes validation when it shouldn't. This could lead to memory access outside the intended buffer boundaries, potentially exposing sensitive data or causing system instability.

• CVE-2026-53076HIGH 7.1

  A flaw in the Linux kernel's BPF (Berkeley Packet Filter) subsystem allows an unprivileged local user to read memory beyond intended boundaries. The vulnerability arises when copying data between certain kernel map types—specifically from a CGROUP_STORAGE map into a per-CPU map when both have non-standard sizes (not aligned to 8 bytes). The kernel incorrectly assumes all source memory is rounded up to 8 bytes, causing it to read extra data it shouldn't access. This could leak sensitive kernel memory to an attacker with local access.

• CVE-2026-53132HIGH 7.1

  A flaw in the Linux kernel's vsock (virtual socket) transport layer could allow an attacker to exhaust system memory by flooding the network queue with malformed packets. An attacker with local access can craft packets with zero payload length but marked as end-of-message (EOM), bypassing the kernel's normal quota checks. Because these packets consume almost no actual data bytes, the kernel's safeguards fail to detect the buildup, allowing an unbounded number of empty packets to accumulate in the receive queue. This eventually starves legitimate network traffic and system processes of available memory, causing a denial of service.

• CVE-2026-53138HIGH 7.1

  A flaw in the Linux kernel's AMD display driver can cause the system to loop indefinitely when processing a corrupted graphics firmware (VBIOS) image. During system startup, the driver reads firmware records to configure the display hardware. If the firmware is malformed and missing the expected end-marker, the driver keeps reading memory in 256-byte increments until it either crashes or exhausts resources. An attacker with physical access to replace the firmware, or a supply-chain compromise affecting pre-installed firmware, could trigger this condition. Local users with sufficient privilege to load modified firmware could also exploit it. The fix limits the loop to a reasonable maximum of 256 records, preventing runaway iteration.

• CVE-2026-53146HIGH 7.1

  A memory disclosure vulnerability exists in the Linux kernel's Thunderbolt XDomain (cross-domain) communication handler. When a system receives a shorter-than-expected response packet over Thunderbolt, the kernel incorrectly reads beyond the legitimate frame data into stale memory contents from previous transactions. This allows an attacker with adjacent network access to extract sensitive information from kernel memory, such as cryptographic keys or other data processed in prior Thunderbolt communications.

• CVE-2026-53149HIGH 7.1

  A flaw in the Linux kernel's Thunderbolt driver allows a local user with restricted privileges to read sensitive memory or crash the system. The vulnerability exists in how the kernel validates directory structures when parsing Thunderbolt property data. When a malformed directory header claims to contain more content than the allocated memory block actually holds, the kernel fails to reject it and instead reads beyond the intended boundaries, potentially exposing kernel memory or causing a denial of service.

• CVE-2026-53179HIGH 7.1

  A buffer over-read vulnerability exists in the Linux kernel's RTL8723BS wireless driver. The rtw_update_protection() function is called with a pointer that references a specific position within a buffer, but it is passed the total length of the entire buffer rather than the remaining bytes from that position. This causes the function to read beyond the intended region of memory, potentially exposing sensitive kernel data. The flaw affects the staging driver and requires local access to trigger.

• CVE-2026-53187HIGH 7.1

  A vulnerability exists in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem where user-supplied CPU IDs are not properly validated before being used in system operations. An attacker with local access can supply an invalid CPU ID that causes the kernel to read memory outside the valid CPU bitmap range, potentially exposing sensitive information or crashing the system. This is particularly dangerous on systems configured to panic when kernel warnings are triggered.

• CVE-2026-53203HIGH 7.1

  A buffer overflow vulnerability exists in the Linux kernel's Intel VPU (Vision Processing Unit) acceleration driver. When the driver queries metric stream information from firmware, it does not properly validate whether the returned data size exceeds the allocated buffer. An attacker with local access could trigger this condition, potentially leading to information disclosure or system instability. The vulnerability affects systems running vulnerable Linux kernel versions with the Intel VPU driver enabled.

• CVE-2026-53205HIGH 7.1

  The Linux kernel contains a vulnerability in the Intel VPU (Video Processing Unit) acceleration driver where firmware-supplied log buffer indices are not properly validated. When the firmware provides read or write indices that fall outside the valid range of the log buffer, the kernel does not catch this before using them to access memory. This can lead to the kernel reading from or writing to unintended memory locations, potentially exposing sensitive data or causing system instability. The fix adds validation to ensure indices stay within bounds and clamps out-of-range values to safe defaults.

• CVE-2026-53223HIGH 7.1

  A flaw in the Linux kernel's network stack allows a local attacker to misuse socket timestamping features to read or leak adjacent kernel heap memory. The vulnerability arises from incorrect classification of packet socket buffers, where the kernel mistakenly treats outgoing AF_PACKET frames as error-queue messages when timestamping is enabled. This confusion causes the kernel to read control buffer state from the wrong location, potentially exposing sensitive data or triggering memory protection mechanisms.

• CVE-2026-53253HIGH 7.1

  A flaw in the Linux kernel's Bluetooth BNEP (Bluetooth Network Encapsulation Protocol) handler allows a remote Bluetooth peer to trigger a memory access violation by sending malformed frames. The vulnerability stems from the kernel reading packet fields without first verifying that enough data is present in the incoming frame. When an attacker sends a truncated BNEP packet, the code attempts to access memory beyond the actual packet contents, leading to a crash or potential information disclosure. The issue affects systems with Bluetooth connectivity that process BNEP traffic.

• CVE-2026-53255HIGH 7.1

  The Linux kernel contains a flaw in how it validates Bluetooth advertising data when processing management commands. A malformed advertising request can cause the kernel to read memory beyond the bounds of the supplied data buffer. This out-of-bounds read is triggered when a length field points past the actual data, allowing an attacker with local access to crash the system or potentially leak sensitive memory contents.

• CVE-2026-53303HIGH 7.1

  A race condition exists in the Linux kernel's f2fs filesystem implementation that can occur when sysfs operations access extension list data without proper synchronization. When one process modifies the extension list while another reads it via sysfs, the reader may encounter inconsistent data—such as mismatched counts and array contents—potentially causing out-of-bounds memory access or displaying stale information. This requires local access to exploit and affects systems where untrusted local users can access sysfs interfaces.

• CVE-2026-53330HIGH 7.1

  A flaw exists in the Linux kernel's AMD display driver that allows code to read memory outside the bounds of a small array. The bug occurs when certain graphics hardware reports the maximum number of signal repeaters allowed by the DisplayPort specification. Because the array is sized one element too small, accessing data for the 8th repeater reads into adjacent memory. An attacker with local access could exploit this to leak sensitive kernel memory or trigger a system crash.

• CVE-2026-53346HIGH 7.1

  A flaw in how the Linux kernel's Rust compiler toolchain handles unwinding information for ARM64 systems can cause boot failures when certain kernel security features are enabled. Specifically, when the kernel is built with both Rust support and address sanitizer (KASAN) constructor patching enabled, compiler-generated initialization functions may be patched incorrectly, leading to a crash during system startup. The issue stems from a rustc compiler bug where the unwind table flag is not properly applied to all generated functions, only to explicitly declared ones.

• CVE-2026-53361HIGH 7.1

  A race condition flaw was found in the Linux kernel's Unix domain socket garbage collection mechanism. When multiple threads attempt to schedule garbage collection simultaneously, the gc_in_progress flag can become desynchronized, allowing garbage collection to run while the flag is incorrectly set to false. This creates a window where other socket operations relying on accurate garbage collection state can behave unpredictably, potentially leading to data corruption or denial of service. The issue affects local unprivileged users who can trigger socket operations.

• CVE-2026-53674HIGH 7.1

  BuddyPress 14.4.0 has a flaw in how it processes @mention names when a specific username compatibility feature is enabled. Attackers can craft malicious mention text containing special regex characters that slip past the software's input sanitization, allowing them to probe the database for usernames or crash the system through resource exhaustion. The vulnerability requires an attacker to be logged in but poses meaningful risk to information disclosure and availability.

• CVE-2026-53689HIGH 7.1

  A vulnerability in libnfs (an open-source NFS client library) allows attackers to trigger an integer overflow by connecting to a malicious NFS server that sends specially crafted data. The flaw stems from insufficient validation of string sizes during data parsing, potentially allowing an attacker to cause memory corruption, information disclosure, or limited system unavailability. An attacker would need to trick a user into connecting to a compromised or attacker-controlled NFS server, making this a network-based but not trivially exploitable threat.

• CVE-2026-53703HIGH 7.1

  GStreamer's RealMedia file parser has a buffer-reading flaw that can crash applications or leak memory contents. When a malicious or malformed RealMedia (.rm) file contains an undersized audio header, the parser reads past the end of its data buffer, potentially accessing uninitialized or sensitive memory. The vulnerability requires user interaction—someone must open a crafted file—but poses a meaningful risk to applications that automatically process media files or expose the parser to untrusted sources.

• CVE-2026-53704HIGH 7.1

  GStreamer, a popular multimedia framework, contains a vulnerability in its RealMedia file parser that can be triggered by opening a malicious .rm file. The parser fails to properly validate boundaries when reading metadata, allowing crafted files to cause the application to hang indefinitely, crash, or leak memory. An attacker simply needs to trick a user into opening a specially constructed RealMedia file—no special network access or authentication is required. The flaw affects the gst-plugins-ugly package, which is commonly installed alongside GStreamer for handling restricted multimedia formats.

• CVE-2026-53840HIGH 7.1

  OpenClaw versions before 2026.5.12 inadvertently leak sensitive authentication headers—such as API keys and tenant-routing credentials—when handling cross-origin redirects through its streamable-http Model Context Protocol (MCP) servers. An attacker who controls or compromises an MCP endpoint can exploit this by redirecting requests to an attacker-controlled domain, capturing those headers in transit. This is a credential exfiltration risk that requires authentication to trigger but carries significant impact once exploited.

• CVE-2026-53842HIGH 7.1

  OpenClaw versions before 2026.5.2 contain a flaw that allows attackers with repository access to inject malicious environment variables into workspace configuration files. When users run Gmail setup commands through gcloud, the tool may be tricked into using an attacker-controlled Python interpreter instead of the legitimate one, potentially leading to arbitrary code execution on the developer's machine. The vulnerability requires user interaction (a developer running the setup process) but no special system privileges.

• CVE-2026-53846HIGH 7.1

  OpenClaw before version 2026.4.29 contains a vulnerability that allows attackers to hijack the package manager used during dependency installation. An attacker with access to a workspace can craft a malicious .env file that tricks the install process into running an unauthorized package manager executable. This could enable them to inject malicious code into the build environment and compromise software artifacts.

• CVE-2026-53858HIGH 7.1

  OpenClaw versions before 2026.5.2 contain a vulnerability that allows attackers to manipulate how the application loads software dependencies. By controlling an environment variable called STATE_DIRECTORY in a workspace configuration file, an attacker can trick OpenClaw into loading malicious code from attacker-controlled locations on the same computer. This attack requires local access and user interaction (such as a developer opening a project), but if successful, it can lead to arbitrary code execution during the dependency resolution process.

• CVE-2026-53863HIGH 7.1

  OpenClaw versions before 2026.4.25 have a flaw in how they validate group identifiers when making access control decisions for tool invocations. An attacker with basic authentication credentials can supply a crafted group ID that the system fails to properly validate, leading to incorrect policy enforcement. This could allow the attacker to invoke tools or perform actions they should not have permission to access, effectively bypassing the intended security controls that restrict who can use what tools.

• CVE-2026-53865HIGH 7.1

  OpenClaw versions before 2026.5.2 contain a vulnerability that allows a local attacker with user-level access to execute arbitrary executables on the system. The flaw exists in how the maintenance task system handles file paths: an attacker can manipulate workspace-derived environment paths to trick the system into running their chosen command instead of the intended maintenance cleanup utility. This gives an attacker the ability to run code with the privileges of the OpenClaw process during routine maintenance operations.

• CVE-2026-53904HIGH 7.1

  MCO (mycomplianceoffice) contains a flaw in its password reset mechanism that allows attackers to repeatedly lock victims out of their accounts. If an attacker knows a victim's email address and can answer their security question, they can trigger unlimited password resets that continuously invalidate all active credentials—including both regular passwords and temporary reset tokens. This turns a feature meant to help users regain access into a weapon for account denial of service. The attack requires one successful security question answer, though MCO does limit the number of wrong attempts.

• CVE-2026-53905HIGH 7.1

  A security vulnerability in MyComplianceOffice (MCO) allows authenticated users with basic privileges to access sensitive administrator permission structures they shouldn't be able to see. The vulnerability exists in a specific web endpoint that manages access control hierarchies. When exploited, it exposes internal security configuration details that could be leveraged by an attacker to understand the system's administrative structure and potentially plan further attacks. The issue was identified in version 25.3.3.1, though other versions may be affected as well.

• CVE-2026-53915HIGH 7.1

  JetBrains GoLand before version 2026.1.3 contains a remote code execution vulnerability triggered when developers open untrusted project configurations. An attacker can craft a malicious project file that executes arbitrary code on a developer's machine without requiring any special permissions or complex user interaction beyond opening the project. This affects GoLand across all network environments.

• CVE-2026-54012HIGH 7.1

  Open WebUI, a self-hosted AI platform, contains a flaw in how it manages file access permissions tied to AI models. Before version 0.9.6, a user who creates or imports a model can attach references to files belonging to other users without any verification. This allows the malicious model owner to read or delete those private files by manipulating how the system validates file access. The vulnerability requires an authenticated attacker but poses a direct threat to data confidentiality and integrity within shared Open WebUI deployments.

• CVE-2026-54070HIGH 7.1

  SiYuan, an open-source personal knowledge management system, contains a cross-site scripting (XSS) vulnerability in how it displays README files from Bazaar marketplace packages. When an administrator views a package in the Settings → Marketplace interface, malicious code embedded in a package README can execute with full administrative privileges in the user's SiYuan workspace. The attack requires no installation—viewing the package listing is sufficient. This affects versions prior to 3.7.0.

• CVE-2026-54198HIGH 7.1

  Media Library Assistant versions 3.35 and earlier contain an unauthenticated cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application without requiring a login. An attacker can craft a malicious link and trick a user into clicking it, causing the victim's browser to execute the injected code within the context of the Media Library Assistant application. This could lead to session hijacking, credential theft, or malware distribution.

• CVE-2026-54290HIGH 7.1

  Hono, a JavaScript web framework supporting multiple runtimes, has a cross-origin request forgery vulnerability in its CORS middleware. When CORS is configured to allow credentials (a common requirement for authenticated APIs) without explicitly restricting which origins can access the application, the middleware will mirror back whatever origin made the request and grant it credential access. This means any website can trick a user's browser into making authenticated requests to a Hono application and read the responses—essentially stealing the user's session. The flaw affects versions before 4.12.25 and is particularly dangerous because the vulnerable configuration may feel like a reasonable default to developers unfamiliar with CORS security nuances.

• CVE-2026-54318HIGH 7.1

  Home Assistant's companion app for Android contains a flaw that allows any installed application to spoof your device's GPS location without needing special permissions. An attacker can trick Home Assistant into believing you're at a different location than where you actually are, potentially triggering automations tied to your real-world position—such as unlocking doors, disarming alarms, or opening garages. Because this vulnerability bypasses Android's built-in mock location protections, even apps that appear benign could exploit it. The issue is fixed in version 2026.5.3.

• CVE-2026-54369HIGH 7.1

  A vulnerability in the acl library before version 2.4.0 allows local users to escalate their privileges by exploiting how the library handles file paths. An attacker who can control any part of a file path—such as a directory name—can replace it with a symbolic link to redirect the library's ACL (Access Control List) operations to different files or directories than intended. This misdirection lets them read or modify access permissions on files they shouldn't be able to touch, ultimately gaining higher privileges on the system.

• CVE-2026-54371HIGH 7.1

  CVE-2026-54371 is a local privilege escalation flaw in the attr package (getfattr and setfattr tools) versions before 2.6.0. An attacker with local access can exploit a symlink traversal weakness to redirect these utilities to operate on arbitrary files. When a privileged process runs getfattr or setfattr over a path the attacker controls, the attacker can substitute a symbolic link in the directory chain to make the operation target a different file—effectively gaining elevated privileges without additional authentication.

• CVE-2026-54528HIGH 7.1

  JupyterLab Git, a popular Git integration extension for JupyterLab notebooks, contains a path-matching flaw that allows authenticated users to bypass access restrictions on sensitive directories. By slightly altering the capitalization of URLs on case-insensitive filesystems (like Windows or macOS), an attacker can read files that administrators intended to exclude from access. This affects versions before 0.54.0 and requires authentication but no user interaction to exploit.

• CVE-2026-54761HIGH 7.1

  Traefik, a widely-deployed reverse proxy and load balancer, contains a flaw in how it enforces access controls when Kubernetes HTTPRoutes specify multiple backend services. An attacker with the ability to create HTTP routes in a non-allowed namespace can exploit a namespace validation bypass to expose sensitive internal Traefik services—including the admin API, dashboard, and REST interface—to the network. The vulnerability stems from Traefik checking permissions against the wrong namespace when evaluating cross-provider service references, allowing an attacker to pivot through an allow-listed namespace to reach forbidden internal endpoints. This affects versions prior to 3.6.21 and 3.7.5.

• CVE-2026-55153HIGH 7.1

  mchange-commons-java, a widely-used Java utility library, contains a critical flaw in how it handles JNDI object construction. Before version 0.6.0, the library's ObjectFactory can be tricked into creating and configuring arbitrary Java objects. An attacker who can control serialized data reaching your application can exploit this to trigger unsafe initialization sequences—for instance, making a Swing component fetch content from a malicious URL. This is particularly dangerous because the attack often occurs within the trusted security context of your application.

• CVE-2026-55212HIGH 7.1

  Pimcore, an open-source data and experience management platform, contains a privilege escalation vulnerability in its Studio API. An authenticated user with basic editor permissions can create new class definitions—a capability that should be restricted to administrators only. The vulnerability stems from incorrect permission validation on the class definition creation endpoint. When exploited, this allows attackers to generate new database tables and PHP class files on the server, potentially disrupting operations or establishing persistence. The issue affects versions prior to 2025.4.6 and 2026.1.6 and has been patched in those releases.

• CVE-2026-55700HIGH 7.1

  pnpm, a widely-used JavaScript package manager, contains a path traversal vulnerability in its download staging feature that could allow an attacker to overwrite files outside the intended download directory. By crafting a malicious package manifest with specially designed name and version fields, an attacker could trick pnpm into writing files to unintended locations on a developer's machine. This affects versions 11.3.0 through 11.5.2. The fix validates and sanitizes both the package name and version before deriving a safe filename, then verifies the destination path before writing any files.

• CVE-2026-56005HIGH 7.1

  WP Activity Log, a WordPress plugin used to monitor and log user activity, contains a stored cross-site scripting (XSS) vulnerability in versions 5.6.3.1 and earlier. An attacker can inject malicious scripts that execute in the browsers of subscribers viewing activity logs, potentially allowing credential theft, session hijacking, or malware distribution. The vulnerability requires user interaction but affects a broad audience since it impacts any subscriber with access to the plugin's logging interface.

• CVE-2026-56011HIGH 7.1

  MapPress Maps, a WordPress plugin for embedding and managing interactive maps, contains an unauthenticated cross-site scripting (XSS) vulnerability affecting versions 2.97.3 and earlier. An attacker can inject malicious JavaScript code through the plugin without needing to log in, and if a site visitor interacts with the crafted payload, the attacker's script executes in the victim's browser. This can lead to session hijacking, credential theft, malware distribution, or defacement of site content.

• CVE-2026-56039HIGH 7.1

  Quick Interest Slider, a WordPress plugin, contains an unauthenticated cross-site scripting (XSS) vulnerability affecting versions 3.1.6 and earlier. An attacker can inject malicious JavaScript into the plugin's interface without requiring authentication, potentially executing arbitrary code in the browsers of site administrators and visitors. The vulnerability is made more dangerous by its unauthenticated nature—attackers need no valid credentials to exploit it.

• CVE-2026-56042HIGH 7.1

  A cross-site scripting (XSS) vulnerability exists in the Advanced Order Export For WooCommerce plugin in version 4.0.9 and earlier. An attacker can inject malicious JavaScript code into the plugin, which executes in the browsers of customers or administrators who interact with affected features. This allows the attacker to steal session cookies, redirect users, deface content, or perform actions on behalf of the victim without their knowledge.

• CVE-2026-56043HIGH 7.1

  A cross-site scripting (XSS) vulnerability exists in the Customer Reviews for WooCommerce plugin (versions 5.110.1 and earlier) that allows attackers to inject malicious scripts without authentication. An attacker can craft a malicious review that, when viewed by site visitors, executes JavaScript in their browsers. This can lead to session hijacking, credential theft, malware distribution, or defacement of the WooCommerce storefront.

• CVE-2026-56209HIGH 7.1

  A critical flaw exists in libaom, the open-source reference implementation of the AV1 video codec. An attacker can craft malicious video frames that exploit a missing validation check in the Scalable Video Coding layer, allowing them to write data to arbitrary memory locations on a system running a vulnerable encoder. This could crash the encoder (denial of service) or potentially allow the attacker to execute arbitrary code. The vulnerability is particularly dangerous because it requires no prior information disclosure to exploit—an attacker who can feed frames to a network-accessible encoder, such as in a transcoding service or live stream ingestion pipeline, can trigger the flaw reliably.

• CVE-2026-56210HIGH 7.1

  A bounds-checking flaw in libaom, the reference implementation of the AV1 video codec, allows attackers to read unintended memory from the heap. An attacker who can send specially crafted video encoding parameters—particularly by setting an SVC (Scalable Video Coding) layer identifier beyond the legitimate range—can trigger the vulnerability. The result is either exposure of sensitive data resident in heap memory or a crash of the encoder process. This matters most to services that accept untrusted video input and run libaom on network-facing infrastructure.

• CVE-2026-56211HIGH 7.1

  A vulnerability in libaom, the open-source AV1 video codec library, allows an attacker to execute arbitrary code on systems that process untrusted video files with scalable video coding (SVC) features enabled. An attacker crafts malicious video frames that bypass safety checks in the encoder, allowing them to corrupt memory structures that control how the encoder operates. In services that spawn separate processes to handle video encoding, this memory corruption can be leveraged to discover the process layout in memory and ultimately redirect execution to attacker-controlled code. Exploitation requires that the target application uses libaom with SVC encoding active and processes video frames from an untrusted source.

• CVE-2026-56244HIGH 7.1

  Capgo versions prior to 12.128.2 contain a security flaw where webhook signing secrets can be exposed to users with standard (non-admin) API keys. This happens because the underlying database does not properly restrict access to sensitive webhook configuration data. An attacker with a basic API key can retrieve these secrets, then use them to forge legitimate-looking webhook messages that your systems will accept as authentic, potentially allowing them to trigger unauthorized actions in any application listening to your webhooks.

• CVE-2026-56256HIGH 7.1

  Capgo versions before 12.128.2 have a critical authentication bypass where the two-factor authentication (2FA) requirement is only enforced in the user interface, not in the backend API. This means an authenticated admin user who hasn't actually enabled 2FA can send direct API requests to sensitive organization management functions—such as editing organization details or inviting new users—and those requests will be accepted without verifying 2FA status. An attacker with admin credentials could potentially capture a legitimate API request and replay it, or craft new requests to perform unauthorized organizational changes.

• CVE-2026-56257HIGH 7.1

  Capgo versions before 12.128.2 contain a critical authorization flaw that allows authenticated users to directly modify app ownership records through PostgREST without using the proper transfer workflow. This creates a dangerous split-brain scenario where an application's metadata appears owned by one organization, but version data remains accessible to the original organization's API keys. An attacker with valid credentials can exploit this to maintain persistent unauthorized access to application versions even after nominally transferring the app to a different organization.

• CVE-2026-56275HIGH 7.1

  Flowise versions before 3.1.0 contain a server-side request forgery (SSRF) vulnerability in the Execute Flow node. An authenticated attacker can manipulate the base URL field to bypass security controls and force the application to make HTTP requests to internal network addresses, cloud metadata endpoints, and other sensitive systems that should not be directly accessible. This allows reconnaissance and potential lateral movement within your infrastructure.

• CVE-2026-56280HIGH 7.1

  Cap-go versions before 12.128.2 contain a privilege escalation flaw in their build log streaming feature. An attacker with a read-only API key—which should only permit viewing logs—can actually cancel active native builds by connecting to the log stream and then disconnecting. This happens because the server uses its own privileged credentials to clean up when clients disconnect, rather than checking whether the client itself has permission to cancel builds. The vulnerability allows repeated disruption of build pipelines and CI/CD workflows without requiring elevated API credentials.

• CVE-2026-56314HIGH 7.1

  Capgo, a mobile app deployment and update platform, contains a flaw that allows attackers with valid credentials to push outdated or intentionally removed app versions to end-user devices. The vulnerability stems from incomplete data filtering when retrieving available app versions during update checks. An authenticated attacker can exploit this by deploying bundles that were previously deleted, potentially exposing users to known bugs, security issues, or malicious code embedded in those older versions. This is a moderate-to-significant risk because it requires authentication but can affect the integrity of deployed software at scale.

• CVE-2026-56320HIGH 7.1

  Capgo before version 12.128.2 has a security flaw that allows authenticated users to create device records for applications they don't own. The vulnerability exists in the device creation endpoint, which fails to verify that the organization identifier provided by the user actually matches the organization that owns the target application. An attacker with valid credentials can exploit this to inject device records into someone else's app, crossing organizational boundaries that should be protected.

• CVE-2026-57303HIGH 7.1

  The Jenkins Assembla Plugin up to version 1.4 contains a weakness in how it parses XML responses from Assembla servers. An attacker who can intercept or control responses from the Assembla service could inject malicious XML that tricks the Jenkins controller into reading sensitive files from the system or making unauthorized network requests on behalf of Jenkins. This requires the attacker to have some control over network traffic to the Assembla server or the ability to compromise the Assembla service itself.

• CVE-2026-57317HIGH 7.1

  A cross-site scripting (XSS) vulnerability exists in Simply Schedule Appointments plugin versions 1.6.12.2 and earlier that allows attackers to inject malicious code into web pages without requiring authentication. An attacker can craft a malicious link or embed code on a compromised or attacker-controlled website, and when users visit the affected Simply Schedule Appointments installation, the injected script executes in their browser. This can lead to session hijacking, credential theft, or malware distribution.

• CVE-2026-57332HIGH 7.1

  A vulnerability in the Wallet System for WooCommerce plugin allows authenticated subscribers to bypass access controls and perform actions they shouldn't be authorized to perform. The issue affects versions 2.7.6 and earlier. An attacker with a subscriber account—the lowest privilege level in WordPress—can escalate their capabilities to modify or delete wallet data, affecting the integrity of transaction records and potentially causing financial discrepancies for merchants and customers.

• CVE-2026-57333HIGH 7.1

  Link Whisper Free versions 0.9.4 and earlier contain an unauthenticated cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. Because no authentication is required, an attacker can craft a malicious link and trick users into clicking it, causing arbitrary JavaScript to execute in the context of affected WordPress installations. This could lead to session hijacking, credential theft, or malware distribution.

• CVE-2026-57337HIGH 7.1

  Landing Page Builder versions up to and including 1.5.3.5 contains an unauthenticated cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious scripts into the application without requiring credentials. When a user visits a compromised landing page, the injected code executes in their browser, potentially enabling session hijacking, credential theft, or malware distribution. The vulnerability is rated HIGH severity with a CVSS score of 7.1.

• CVE-2026-57343HIGH 7.1

  Real Estate 7 versions 3.5.9 and earlier contain an unauthenticated cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application without requiring authentication. An attacker can trick users into visiting a crafted link or page, causing their browser to execute arbitrary JavaScript in the context of the Real Estate 7 application. This could lead to session hijacking, credential theft, or redirection to malicious sites.

• CVE-2026-57345HIGH 7.1

  Internal Links Manager versions 3.0.3 and earlier contain an unauthenticated cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. Because the flaw requires no authentication and can affect multiple users through a single crafted request, it presents meaningful risk to any organization deploying this plugin. The vulnerability is triggered through user interaction—typically clicking a malicious link—making social engineering a viable attack vector.

• CVE-2026-57346HIGH 7.1

  Epiphyt Embed Privacy versions up to 1.12.3 contain a path traversal vulnerability that allows authenticated users to access files and directories outside of intended boundaries. An attacker with login credentials can manipulate file path inputs to read or write to sensitive locations on the server, potentially causing service disruption or data integrity issues. The vulnerability requires authentication to exploit, reducing immediate risk from external attackers but creating a meaningful insider threat.

• CVE-2026-57349HIGH 7.1

  WPeMatico RSS Feed Fetcher, a WordPress plugin for importing RSS feeds, contains an unauthenticated cross-site scripting (XSS) vulnerability in versions 2.8.17 and earlier. An attacker can inject malicious scripts through the plugin without requiring authentication, and if a site administrator visits a crafted page, the malicious code executes in their browser. This could lead to unauthorized actions, credential theft, or further compromises of the WordPress installation.

• CVE-2026-57351HIGH 7.1

  HandL UTM Grabber version 2.9.2 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts without authentication. Because this flaw does not require user login, any attacker can craft a malicious link or embed code that, when clicked or loaded by a victim, executes arbitrary JavaScript in their browser. This can lead to session hijacking, credential theft, or malware distribution.

• CVE-2026-57356HIGH 7.1

  A cross-site scripting (XSS) vulnerability exists in MC Woocommerce Wishlist plugin versions 1.9.19 and earlier. An attacker can inject malicious scripts that execute in a visitor's browser without needing any authentication or special access to the plugin. If a site admin or customer visits a compromised wishlist page, the attacker's code runs in their session, potentially stealing session tokens, modifying page content, or redirecting users to malicious sites.

• CVE-2026-57357HIGH 7.1

  Search Atlas SEO contains an unauthenticated cross-site scripting (XSS) vulnerability affecting versions 2.6.6 and earlier. An attacker can inject malicious scripts through the search functionality without requiring prior authentication. When a user visits a crafted link, the injected code executes in their browser with the privileges of the website, potentially stealing session cookies, redirecting users, or performing actions on their behalf. The vulnerability requires user interaction—specifically clicking a malicious link—but the attacker needs no prior access to the application.

• CVE-2026-57358HIGH 7.1

  A cross-site scripting (XSS) vulnerability exists in Customize My Account for WooCommerce versions 4.3.9 and earlier. An attacker can inject malicious scripts into the plugin without needing authentication, which are then executed in the browsers of site visitors. This happens because user input is not properly validated or sanitized before being reflected in the page. A victim would need to click a malicious link or visit a compromised page, but once they do, the attacker gains the ability to steal session cookies, capture credentials, or perform unauthorized actions on behalf of the logged-in user.

• CVE-2026-57360HIGH 7.1

  An unauthenticated cross-site scripting (XSS) vulnerability exists in eCommerce Product Catalog versions 3.5.4 and earlier. Because the flaw requires no authentication, an attacker can craft a malicious link or webpage that, when visited by a victim, injects arbitrary JavaScript into the application. This can lead to session hijacking, credential theft, defacement, or malware distribution. The vulnerability is classified as HIGH severity due to its network-reachable attack surface and the ability to affect multiple users simultaneously through a single payload.

• CVE-2026-57426HIGH 7.1

  Modula - PRO versions up to 2.10.8 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. Because authentication is not required and the attack crosses site boundaries, an attacker can craft a malicious link or embed code on an external site that, when visited by a Modula user, executes arbitrary JavaScript in their browser. This could lead to credential theft, session hijacking, or defacement depending on the attacker's intent and the user's privilege level.

• CVE-2026-57520HIGH 7.1

  Bitwarden Server versions before 2026.5.0 contain a privilege escalation flaw that allows authenticated users with limited ManageUsers permissions to remove administrator accounts from an organization. An attacker with a Custom user role could exploit a gap in the bulk user-removal endpoint to delete Admin accounts that would normally be protected, potentially compromising organizational access controls and administrative oversight.

• CVE-2026-57670HIGH 7.1

  Google Maps CP versions 1.2.5 and earlier contain an unauthenticated Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. Because no authentication is required and user interaction (such as clicking a link) triggers the attack, this poses a meaningful risk to organizations and end-users relying on affected versions. An attacker could steal session cookies, capture user input, redirect users to malicious sites, or perform actions on behalf of the victim.

• CVE-2026-57675HIGH 7.1

  WP Photo Album Plus, a WordPress plugin for managing photo galleries, contains an unauthenticated cross-site scripting (XSS) vulnerability affecting versions 9.2.02.004 and earlier. An attacker can inject malicious JavaScript code that executes in the browsers of site visitors without requiring authentication. This could allow an attacker to steal session cookies, redirect users to malicious sites, deface the plugin's interface, or perform actions on behalf of site administrators.

• CVE-2026-57678HIGH 7.1

  ThemePunch Slider Revolution, a popular WordPress slider plugin, contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. An attacker can craft a specially designed link that, when clicked by a website visitor, executes arbitrary JavaScript in the victim's browser within the context of the affected website. This vulnerability affects versions 7.0.0 through 7.0.16 of the plugin.

• CVE-2026-57682HIGH 7.1

  Simple Link Directory versions 15.0.5 and earlier contain an unauthenticated cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. Because no authentication is required, any visitor to an affected site can exploit this flaw by crafting a malicious request or link. When other users interact with the poisoned content, their browsers execute the attacker's script, potentially compromising their sessions, stealing credentials, or performing unauthorized actions on their behalf.

• CVE-2026-57757HIGH 7.1

  pCloud WP Backup versions 2.0.2 and earlier are vulnerable to unauthenticated Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious webpage or email that, when visited by a logged-in WordPress administrator, silently performs unwanted actions on their backup configuration without their knowledge or consent. Because no authentication is required at the CSRF layer, the attack succeeds against any site running the vulnerable plugin, making this a meaningful risk for WordPress installations that use pCloud for backup storage.

• CVE-2026-57758HIGH 7.1

  A cross-site request forgery (CSRF) vulnerability exists in Permalink Manager for WooCommerce versions 1.0.8.2 and earlier. An unauthenticated attacker can trick a logged-in store administrator into performing unwanted actions—such as changing URL structures, modifying settings, or altering content—by crafting a malicious link or page that the admin visits. The vulnerability requires no authentication to exploit and can affect multiple aspects of a store's configuration, making it a meaningful risk for WooCommerce site operators.

• CVE-2026-57918HIGH 7.1

  A numeric underflow flaw exists in libnfs, an open-source NFS client library, when it receives crafted data from a malicious NFS server. The vulnerability occurs in how the library reads network packets—specifically when the server sends a smaller packet than the client expects based on the packet header. An attacker running a fake NFS server could exploit this to corrupt memory on a client system, potentially leading to information disclosure, data modification, or application crashes. User interaction is required; a person must initiate a connection to the attacker's server.

• CVE-2026-57977HIGH 7.1

  Microsoft Edge (Chromium-based) contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious code into web pages viewed in the browser. An attacker can exploit this by crafting a specially designed webpage that, when visited by a user, executes unauthorized JavaScript in the victim's browser context. The primary risk is spoofing—attackers can impersonate legitimate content, steal session tokens, redirect users to phishing sites, or harvest credentials. This requires user interaction (clicking a link or visiting a malicious site), but the ease of social engineering makes it a practical attack vector.

• CVE-2026-57988HIGH 7.1

  Microsoft Edge (Chromium-based) contains a relative path traversal vulnerability that could allow an attacker to execute arbitrary code on a user's system over the network. The vulnerability requires user interaction—such as clicking a malicious link or visiting a compromised website—but once triggered, an attacker can bypass security controls and run code with the privileges of the Edge process.

• CVE-2026-58213HIGH 7.1

  NATS Server, a widely-used message broker for cloud and edge infrastructure, contains a protocol injection vulnerability in its MQTT connector. An authenticated MQTT client can embed special control characters in subscription filters that get forwarded unchanged into the NATS protocol stream sent to other servers in the cluster or leafnode connections. This corrupts the protocol state and allows an attacker to inject arbitrary NATS commands, potentially reading or manipulating messages intended for other applications. The flaw requires an authenticated MQTT connection but no special network access, making it a meaningful risk for deployments with untrusted or compromised MQTT clients.

• CVE-2026-58296HIGH 7.1

  A privacy vulnerability in Microsoft Edge for Android can expose users' personal information to attackers over the internet. An attacker could trick a user into performing certain actions on a compromised or attacker-controlled website, potentially revealing sensitive data stored or cached within the browser. The vulnerability requires user interaction to exploit, but once triggered, it bypasses normal privacy protections.

• CVE-2026-58297HIGH 7.1

  Microsoft Edge on Android contains a privacy flaw that allows attackers to access and transmit private user information over the network without authorization. The issue requires user interaction (such as visiting a malicious site) but does not require any special system access to exploit. An attacker can leverage this vulnerability to steal sensitive personal data from affected Android devices.

• CVE-2026-58583HIGH 7.1

  A vulnerability in the FluxInk Color Management Driver (TcnPeripheral64.sys) version 1.0.7.2 allows a standard, unprivileged user to escalate their permissions to a higher privilege level on Windows systems. The attack works by enabling the user to map arbitrary physical memory, which can be exploited locally without any user interaction. An attacker with a standard user account could leverage this to gain administrative control over the machine. The vulnerability has been fixed in version 1.0.7.6.

• CVE-2026-59194HIGH 7.1

  pnpm, a widely-used Node.js package manager, contains a path traversal vulnerability in its patch-removal functionality. An attacker can craft a malicious patch entry that points outside the intended patches directory, allowing deletion of arbitrary files accessible to the user running pnpm. This occurs when using the `pnpm patch-remove` command with a compromised or attacker-controlled patch configuration. The vulnerability affects versions before 10.34.4 and 11.7.0.

• CVE-2026-59196HIGH 7.1

  pnpm, a widely-used Node.js package manager, contains a lockfile parsing vulnerability that allows a specially crafted lockfile to create directory traversal or reserved directory overwrites. An attacker who controls a lockfile (via a malicious package, compromised repository, or supply chain attack) can manipulate how pnpm installs dependencies, potentially writing files to unexpected locations or overwriting critical pnpm internal directories. The vulnerability requires user interaction—specifically, running pnpm on a malicious lockfile—but no authentication is required. Versions prior to 10.34.4 and 11.7.0 are affected.

• CVE-2026-59206HIGH 7.1

  n8n, an open source workflow automation platform, contains a prototype pollution vulnerability that allows authenticated users with basic workflow creation permissions to corrupt the platform's core object model. By crafting and saving a malicious workflow, an attacker can manipulate how the application handles object properties globally, effectively tricking the system into treating unauthenticated requests as if they came from a privileged user. This bypass exposes sensitive endpoints that list users and projects, compromising confidentiality and potentially enabling further reconnaissance for lateral movement.

• CVE-2026-59219HIGH 7.1

  Open WebUI versions 0.9.0 through 0.9.x contain a JWT token revocation bypass in their real-time WebSocket connections. When Redis is configured, the platform's Socket.IO handlers for connect, user-join, join-channels, join-note, and terminal operations fail to validate whether a JWT has been revoked. This means an attacker with a previously-issued token—even one that should no longer be valid—can maintain authenticated access to real-time features after the token has been administratively revoked. The vulnerability requires the attacker to already possess a valid token (likely from a former employee or compromised account), but enables persistence despite revocation attempts.

• CVE-2026-59261HIGH 7.1

  OpenClaw versions before 2026.5.28 have a credential exposure weakness that allows attackers with basic file system access to steal sensitive credentials. The vulnerability stems from workspace configuration files (dotenv format) being able to override legitimate provider credentials. An attacker who can place or modify files in monitored input directories can trick the application into reading malicious credential overrides, exposing secrets that should remain protected.

• CVE-2026-59691HIGH 7.1

  A flaw in GStreamer's RFB/VNC plugin (rfbsrc) allows a remote attacker to crash applications or corrupt memory when a user connects to a malicious video streaming server. The vulnerability stems from a mismatch between expected and actual data sizes: the plugin allocates a buffer for 16-bit pixel values but then writes 32-bit values into it during certain screen update operations. An attacker controlling a fake RFB server can exploit this by advertising a 16-bit display mode and sending specially crafted graphical updates, triggering a heap overflow that impacts any GStreamer-based media application using the rfbsrc plugin.

• CVE-2026-59704HIGH 7.1

  Cap's video AI metadata endpoint allows authenticated users to access private AI-generated content belonging to other users without permission checks. An attacker with valid credentials can request arbitrary video IDs and retrieve sensitive metadata like AI-generated titles, summaries, and chapters. Worse, the endpoint can be abused to trigger new AI generation tasks that drain the video owner's credit balance without their knowledge or consent.

• CVE-2026-6858HIGH 7.1

  The Transbank Webpay WordPress plugin before version 1.14.0 contains a stored cross-site scripting (XSS) vulnerability in its logging functionality. An unauthenticated attacker can inject malicious code into plugin logs, which is then executed in the browser of any administrator who views those logs. This allows attackers to steal administrative credentials, modify site content, or perform actions as if they were a logged-in administrator.

• CVE-2026-7017HIGH 7.1

  HTTP::Tiny, a Perl HTTP client library, forwards sensitive credential headers (Authorization, Cookie, Proxy-Authorization) to cross-origin redirect targets without validation. When a server responds with a redirect (3xx status), the library automatically follows the Location header and resends the caller's credentials to the new destination—even if it's a different domain, uses a different scheme, or downgrades from HTTPS to HTTP. This creates a credential leakage risk: attackers controlling a server can redirect users to attacker-controlled hosts and capture plaintext credentials.

• CVE-2026-8035HIGH 7.1

  CVE-2026-8035 is a denial-of-service vulnerability in National Instruments' PAL kernel driver that allows authenticated local users to crash the system. The flaw stems from inadequate input validation that fails to check for NULL pointers before dereferencing them in memory. An attacker with local system access can exploit this by supplying malformed input to the driver, causing an immediate kernel panic. The vulnerability affects NI-PAL version 26.3.0 and all earlier releases across both Windows and Linux platforms.

• CVE-2026-8036HIGH 7.1

  NI-PAL, National Instruments' process abstraction layer, contains an input validation flaw that allows authenticated local users to read and modify arbitrary memory regions on affected systems. An attacker with local access could exploit this to escalate their privileges. The vulnerability affects NI-PAL version 26.3.0 and earlier on both Windows and Linux platforms.

• CVE-2026-8089HIGH 7.1

  The weMail WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to trick authenticated users—including administrators—into clicking malicious links. When a victim clicks a crafted URL, malicious JavaScript executes in their browser with their privileges, potentially allowing attackers to perform actions on their behalf, steal session tokens, or modify site content. The vulnerability exists because user input is not properly sanitized before being inserted into HTML attributes in AJAX responses, and the vulnerable endpoint lacks nonce protection to validate legitimate requests.

• CVE-2026-8172HIGH 7.1

  The Simple Basic Contact Form WordPress plugin fails to properly sanitize user input when displaying form validation errors, allowing attackers to inject malicious JavaScript code into the page. An attacker can craft a malicious link or form that, when visited by a site user, executes arbitrary JavaScript in that user's browser within the context of the vulnerable website. This type of attack, known as Reflected Cross-Site Scripting (XSS), can be used to steal session cookies, perform actions on behalf of the user, or redirect them to phishing sites.