By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 14 of 41

• CVE-2026-35717MEDIUM 6.3

  A stack-based buffer overflow exists in the export_language.cgi binary on VIVOTEK FD8136 IP cameras running firmware FD8136-VVTK-0300a. An authenticated attacker can send a specially crafted POST request to the language export endpoint with a malicious Content-Length value that causes the application to read more data than a 60-byte stack buffer can hold, overwriting critical return address information. This allows the attacker to execute arbitrary code with root privileges on the affected device. The vulnerability requires valid credentials to exploit but succeeds because the binary lacks stack protection mechanisms.

• CVE-2026-39107MEDIUM 6.3

  Kimi AI v1.0 has a cross-site scripting (XSS) vulnerability in its Preview feature. When the AI generates code and displays it in the Preview tab, the application fails to sanitize the output properly. An attacker can embed malicious JavaScript in AI-generated responses, which then executes in a user's browser with the privileges of that session. This could allow theft of session cookies, unauthorized actions on behalf of the user, or credential harvesting.

• CVE-2026-39170MEDIUM 6.3

  SemCms 5.0 contains a cross-site request forgery (CSRF) vulnerability in its user administration interface. An attacker can craft a malicious webpage or email that, when visited by a logged-in administrator, silently performs unauthorized actions on the SemCms instance—such as creating new admin accounts, modifying permissions, or deleting users. The vulnerability requires an authenticated admin to be tricked into visiting the attacker's content, but no additional user interaction (like clicking a button) is needed once they arrive.

• CVE-2026-39178MEDIUM 6.3

  SOGo, a groupware and collaboration platform, contains a SQL injection flaw in its contact search functionality. An authenticated attacker can craft malicious input through the search parameter to execute arbitrary database queries, potentially extracting sensitive information or modifying data. The vulnerability affects versions before 5.12.7 and requires valid user credentials to exploit.

• CVE-2026-39179MEDIUM 6.3

  SOGo before version 5.12.7 contains a SQL injection vulnerability in its password change feature. An authenticated user can manipulate the password field during a password change request to inject malicious SQL commands directly into the database. This requires the attacker to have valid login credentials, which limits the initial attack surface, but once inside the system, an attacker could read sensitive data, modify records, or disrupt database operations.

• CVE-2026-39451MEDIUM 6.3

  An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in WP Google Review Slider version 18.0 and earlier. The flaw allows attackers to inject malicious scripts without needing to authenticate, potentially affecting site visitors and administrators. If exploited, an attacker could steal session cookies, redirect users, deface content, or perform actions on behalf of victims through their browsers.

• CVE-2026-41116MEDIUM 6.3

  Dell Inventory Collector Client versions before 13.8.0 contain a vulnerability that allows attackers with low-level local access to write arbitrary files to a system by exploiting unsafe symbolic link handling. The vulnerability stems from the application's failure to properly verify symbolic links before accessing files, potentially allowing an attacker to redirect file operations to sensitive locations and corrupt or overwrite critical data.

• CVE-2026-41975MEDIUM 6.3

  CVE-2026-41975 is a permission management flaw in a network management module that could allow a local attacker with limited privileges to compromise service integrity. The vulnerability requires user interaction and specific system conditions to exploit, making it a moderate-risk issue that organizations should address but not treat as an emergency.

• CVE-2026-42538MEDIUM 6.3

  IRIS is a collaborative platform designed to help incident responders coordinate during security investigations by sharing technical findings. A file validation flaw in versions before 2.4.28 allows authenticated users to upload files without proper checks. This can enable attackers to host malicious content—such as phishing pages—directly within the platform, and also introduces a Cross-Site Scripting (XSS) vulnerability that could compromise other users' sessions or steal credentials when they interact with uploaded files.

• CVE-2026-44171MEDIUM 6.3

  MariaDB's mbstream backup utility contains a path traversal vulnerability that could allow an attacker to write files outside the intended backup directory when unpacking a specially crafted archive. The flaw affects multiple MariaDB versions across the 10.6, 10.11, 11.4, 11.8, and 12.3 release branches. An attacker would need local access and elevated privileges to exploit this, but successful exploitation could result in arbitrary file creation on the system, potentially compromising system integrity or enabling privilege escalation.

• CVE-2026-44275MEDIUM 6.3

  Dell and Alienware's Purchased Apps service contains a vulnerability in versions before 1.1.32.0 that allows a low-privileged local user to write arbitrary files to the system by exploiting improper handling of file system links. An attacker with local access could redirect file operations through symbolic links or similar mechanisms to overwrite sensitive files, potentially compromising system integrity or enabling privilege escalation.

• CVE-2026-44287MEDIUM 6.3

  FastGPT, an AI Agent building platform, contains a sandbox escape vulnerability in versions before 4.15.0-beta1. The issue stems from an incomplete regex filter designed to block dynamic imports in a JavaScript sandbox environment. An attacker with valid platform access can craft a specially formatted import statement using block comments to bypass the filter, gaining the ability to execute arbitrary system commands within the sandbox container. This allows an authenticated user to break out of the intended sandbox isolation and run code with the permissions of the sandbox process.

• CVE-2026-44911MEDIUM 6.3

  Apache NiFi versions 1.15.0 through 2.9.0 contain an authorization flaw in how configuration verification requests are handled. Users with only read access to component configurations can submit modified configuration properties that override the current settings, effectively letting them invoke verification methods with alternative parameters they shouldn't be allowed to change. This bypasses the intended separation between who can view configurations and who can modify them. The fix requires upgrading to NiFi 2.10.0, which enforces write access requirements for configuration verification requests.

• CVE-2026-45157MEDIUM 6.3

  A vulnerability in Nextcloud Server allows a malicious user who has been granted access to a shared file to bypass intended restrictions and view temporary upload files during an ongoing chunked file transfer. The attacker leverages the share token—credentials normally intended only for accessing the shared file—to gain unauthorized access to the file upload staging area. This exposure occurs across specific versions of both the open-source Nextcloud Server and Nextcloud Enterprise Server.

• CVE-2026-45283MEDIUM 6.3

  Nextcloud Server contains a file access control vulnerability in its files_lock app that allows authenticated users to manipulate file locks belonging to other users. By knowing the WebDAV paths of files owned by colleagues, an attacker could lock or unlock those files without authorization. Additionally, the vulnerability exposes lock tokens in error messages, enabling attackers to remove locks that other users' applications have legitimately placed. This requires an attacker to be a registered user with valid credentials, but does not require special privileges. The issue affects Nextcloud Server versions 32.0.0 through 32.0.1 and 33.0.0 through 33.0.0, with enterprise deployments on version 31 also at risk.

• CVE-2026-45626MEDIUM 6.3

  Arcane, a Docker management interface, contains a command injection vulnerability in its volume browsing feature. When authenticated users request to browse files within a Docker volume, the application constructs a shell command that includes user-supplied path input. Although the application attempts to block directory traversal attacks using `../`, it fails to remove shell metacharacters like `$()` and backticks. This oversight allows an attacker to inject arbitrary commands that execute within the Arcane helper container. The results of injected commands are returned in error messages, effectively giving attackers a channel to execute code and exfiltrate output.

• CVE-2026-46416MEDIUM 6.3

  Microsoft UFO, an open-source intelligent automation framework, has a flaw in how it manages WebSocket connections used for remote automation across devices and platforms. The vulnerability stems from improper reuse of a shared connection handler that processes authenticated user requests. When multiple users connect simultaneously, their connection contexts get mixed up—specifically, responses intended for one user can be delivered to another user who connected most recently. This allows an authenticated attacker to intercept and view responses that were meant for a different authenticated session, potentially exposing sensitive automation results or command outputs.

• CVE-2026-47909MEDIUM 6.3

  Dreamweaver Desktop versions 21.7 and earlier contain a flaw that allows attackers to read files from your computer that they shouldn't be able to access. The vulnerability requires social engineering—an attacker must trick you into opening a malicious file. Once opened, the attacker gains read access to sensitive data outside the application's normal boundaries. This is a local attack that doesn't require special permissions, but it does depend on user action.

• CVE-2026-47910MEDIUM 6.3

  Dreamweaver Desktop versions 21.7 and earlier contain an authorization flaw that allows attackers to read files from your computer that they shouldn't have access to. The attacker must trick you into opening a malicious file, but once you do, they can potentially access sensitive documents and system files. This is a local attack that doesn't require special permissions to execute.

• CVE-2026-48946MEDIUM 6.3

  K2, a popular Joomla extension for content management, contains a file upload vulnerability in its article attachment feature. Authors can upload PHP files that the web server will execute, allowing them to run arbitrary code with the privileges of the web server. This is a privilege escalation risk: a user with basic author permissions can gain code execution on the server.

• CVE-2026-48980MEDIUM 6.3

  pam_usb is a Linux authentication module that uses removable hardware devices (like USB keys) as a second factor. In versions before 0.9.2, the module trusts environment variables—specifically XRDP_SESSION, DISPLAY, and TMUX—to determine whether a user is logging in locally or remotely. A local attacker can manipulate these variables to fool the module into thinking a remote session is actually local, bypassing the USB hardware check. This is dangerous because pam_usb runs as part of privileged operations like sudo and su, where environment variable pollution is a known attack vector.

• CVE-2026-49093MEDIUM 6.3

  CVE-2026-49093 is a Server-Side Request Forgery (SSRF) vulnerability in Kibana that allows authenticated users with connector management privileges to circumvent network egress controls. An attacker with these privileges can craft malicious connector configurations that cause the Kibana server to make outbound requests to internal or otherwise-blocked destinations, defeating the intent of operator-configured allowlists. This requires authentication and specific administrative permissions, but poses a meaningful risk to organizations using Kibana connectors for alerting, webhooks, or integrations.

• CVE-2026-49943MEDIUM 6.3

  CZ.NIC BIRD Internet Routing Daemon versions up to 2.19.0 contain a stack-based buffer overflow vulnerability in its BGP AS_PATH filtering logic. When BIRD processes BGP UPDATE messages containing exceptionally long AS_PATH attributes—particularly when RFC 8654 Extended Messages are enabled—a mismatch between the fixed buffer size and the actual incoming data can cause the daemon to crash. An authenticated BGP peer can trigger this by sending a specially crafted UPDATE with an AS_PATH longer than what the code expects, leading to denial of service of the routing daemon.

• CVE-2026-50552MEDIUM 6.3

  Koel, a free open-source music streaming platform, has a vulnerability in how it validates URLs when users create radio stations. An authenticated user (but not an admin) can trick the server into making web requests to internal systems by providing a URL that points to private network addresses. The validation logic fails to properly block these requests because it checks for audio content *after* attempting to reject private addresses—and doesn't stop processing even when the address check fails. This allows an attacker to probe internal infrastructure, potentially discovering sensitive systems or services. The issue is fixed in version 9.7.1.

• CVE-2026-5066MEDIUM 6.3

  A vulnerability exists in Zephyr's TLS socket implementation where attackers with network access and authenticated credentials can trigger an out-of-bounds memory access. When TLS session caching is enabled, the system copies network address data into a fixed buffer without checking if the caller-supplied size matches the actual buffer capacity. An attacker can specify an artificially large address size, causing the copy operation to overwrite adjacent memory. This can crash the system, disrupt network services, or potentially allow code execution if memory corruption is leveraged effectively.

• CVE-2026-52885MEDIUM 6.3

  Notepad++ versions before 8.9.6.4 contain a time-of-check-time-of-use (TOCTOU) vulnerability in how it validates user-defined commands. The application verifies the integrity of the shortcuts.xml configuration file at the moment a command executes, but it uses the command payload that was loaded into memory when the application started. An attacker with local write access to the shortcuts.xml file can exploit this gap by placing a malicious command definition before Notepad++ launches, then replacing the file with a legitimate version before any command runs. The integrity check passes because it validates the now-clean file, but the malicious command from memory executes anyway. This requires local file system access and user interaction to trigger a command, limiting but not eliminating the practical risk.

• CVE-2026-54021MEDIUM 6.3

  Open WebUI, a self-hosted AI platform designed to run offline, contains a privilege escalation flaw in versions before 0.9.6. Authenticated users can manipulate a path parameter to bypass backend access controls and route requests to Ollama servers they should not be able to reach—including internal systems, higher-privilege backends, or administratively disabled instances. The vulnerability requires a valid user account but no additional authentication or interaction, making it a straightforward post-authentication attack.

• CVE-2026-54370MEDIUM 6.3

  The acl package before version 2.4.0 contains a race condition vulnerability that allows a local attacker with standard user privileges to escalate to higher privilege levels. The flaw exists in how the package checks file permissions: it verifies a file's access control list at one moment, then performs an operation on it moments later. An attacker can exploit the time between these two steps by swapping a symbolic link into place, causing the privileged process to operate on a file the attacker chooses rather than the intended target. Tools like getfacl, setfacl, and chacl become attack vectors when run by privileged processes over paths an attacker controls.

• CVE-2026-54601MEDIUM 6.3

  FastGPT, an open-source AI knowledge base platform, contains a cross-tenant data isolation flaw affecting versions 4.14.17 through 4.15.0-beta3. An authenticated user in one tenant can exploit a dataset collection creation endpoint to gain unauthorized access to datasets belonging to another tenant. Once the attacker knows or discovers dataset identifiers from another tenant, they can read, modify, or delete that data. The vulnerability stems from inconsistent authorization logic that trusts ownership information from mixed or corrupted dataset objects rather than validating against the calling user's actual tenant context.

• CVE-2026-55249MEDIUM 6.3

  @rtk-ai/rtk-rewrite is a plugin that translates shell commands into RTK-equivalent operations. Version 1.0.0 contains a command injection flaw: when the plugin processes input for shell execution, it fails to properly escape shell metacharacters like $() and backticks. An attacker who can control command input—through a prompt injection, tool-call manipulation, or similar avenue—can inject arbitrary shell commands that execute with the privileges of the plugin or gateway process. The vulnerability requires an authenticated user or external input route, but the technical bar for exploitation is low once that access exists.

• CVE-2026-55448MEDIUM 6.3

  mise is a popular tool for managing development dependencies across projects—handling installations of Node.js, Python, CMake, Terraform, and similar tools. Versions from 2026.3.15 through 2026.6.3 contain a critical ordering flaw: when you run a GitHub-related mise command (such as authenticating to GitHub), the tool reads configuration from a local .mise.toml file and executes any credential command specified there without first checking whether you trust that configuration. An attacker can exploit this by placing a malicious .mise.toml in a repository; when you clone and work in that repository, simply running a GitHub command in mise will execute arbitrary shell code on your machine. The vulnerability only triggers if you don't already have a higher-priority GitHub token set via an environment variable. Fixed in 2026.6.4.

• CVE-2026-55668MEDIUM 6.3

  File Browser is a web-based file management application. Versions before 2.63.16 contain a flaw in how they validate symbolic links (symlinks) during file creation. When a user with file creation and modification permissions attempts to create a file via a dangling symlink—one pointing to a non-existent target—the application checks whether the symlink's nearest existing parent directory is within the user's allowed scope. If it passes that check, the application follows the symlink and creates the file at the symlink's target location, which may lie outside the user's intended scope. An authenticated attacker can exploit this to write files to directories they should not have access to.

• CVE-2026-5589MEDIUM 6.3

  A flaw in Zephyr's Bluetooth Mesh implementation allows a nearby attacker to send a malicious wireless advertisement that triggers memory corruption. The vulnerable code fails to validate that certain length values are reasonable before using them in calculations, leading to reads and writes far outside intended memory boundaries. Devices with Bluetooth Mesh enabled and the optional proxy server feature active are at risk. No authentication or pairing is required—an attacker simply broadcasts a specially crafted BLE packet.

• CVE-2026-56295MEDIUM 6.3

  Capgo versions before 12.128.2 have a security gap in how they enforce API key policies. Organizations can set a rule requiring all API keys to expire, but the webhook management feature doesn't check this rule properly. This means someone with an old API key that never expires can still manage webhooks—listing, creating, and deleting them—even though the organization's policy forbids non-expiring keys. The vulnerability requires authenticated access, so it affects users or systems within your organization rather than external attackers, but it does undermine a specific security control you may have put in place.

• CVE-2026-56350MEDIUM 6.3

  n8n versions before 2.8.0 contain an authentication bypass flaw that affects organizations using single sign-on (SSO). Authenticated users can exploit this vulnerability to disable SSO enforcement through the API and create local password credentials, allowing them to circumvent both SSO policies and any multi-factor authentication requirements mandated by your identity provider. This means an attacker with legitimate credentials could establish a persistent backdoor account that sidesteps your organization's centralized identity controls.

• CVE-2026-58518MEDIUM 6.3

  A cross-site request forgery (CSRF) vulnerability exists in the Mediawiki RedirectManager Extension. This flaw allows an attacker to trick a logged-in user into performing unintended actions on a Mediawiki instance without the user's knowledge or consent. The vulnerability affects versions before 1.3.3 and can result in unauthorized changes to redirects or other modifications depending on the attacker's objectives and the target user's permissions.

• CVE-2026-6517MEDIUM 6.3

  Mattermost Desktop App versions 6.1 and earlier contain a credential leakage vulnerability affecting systems without image proxy enabled. When a user opens a message containing an embedded image pointing to an attacker's server, the application automatically forwards the user's NTLM credentials to that external domain. This occurs because the app fails to maintain a strict allowlist of trusted domains for credential forwarding, enabling attackers to harvest authentication material from any user on the server.

• CVE-2026-7299MEDIUM 6.3

  Appsmith, a low-code application development platform, contains a stored cross-site scripting (XSS) vulnerability in its SQL query editor. An authenticated developer can craft malicious database object names (table or column names) that, when rendered by the autocomplete feature, inject and execute arbitrary JavaScript in the browsers of other workspace members. This is a *persistence* risk—the malicious payload lives in the database schema itself and activates whenever a colleague accesses the same data source, potentially compromising their sessions and Appsmith workspace access.

• CVE-2026-9831MEDIUM 6.3

  A timing vulnerability in Extreme Platform ONE's identity and access management (IAM) gateway could occasionally allow an authenticated user to view data belonging to a different customer organization. The issue occurs only under specific high-traffic conditions where concurrent API requests overlap, and only affects API-key-based authentication—not Extreme's newer token or OAuth methods. An attacker would need valid API credentials to attempt this, and success is not guaranteed; the flaw is triggered by race conditions in how the gateway validates which tenant's data should be returned.

• CVE-2026-9989MEDIUM 6.3

  Google Chrome contained a flaw in how it handles media files that allowed attackers to bypass the same-origin policy—a critical browser security boundary. An attacker could craft a malicious video file that, when opened by a user in Chrome, would enable unauthorized access to sensitive data from other websites the user was visiting. The vulnerability requires user interaction (clicking a link or opening a file) but does not require special privileges or complex attack setup.

• CVE-2016-20064MEDIUM 6.2

  WP Vault version 0.8.6.6 contains a local file inclusion (LFI) vulnerability that allows unauthenticated attackers to read arbitrary files from the server. An attacker can manipulate the wpv-image GET parameter to include directory traversal sequences (such as ../../../etc/passwd) and access sensitive files including system configuration files, credentials, and other protected data. No user authentication is required to exploit this vulnerability.

• CVE-2016-20077MEDIUM 6.2

  A vulnerability in WordPress Plugin Photocart Link version 1.6 allows attackers to read arbitrary files from a website without authentication. The flaw exists in the plugin's decode.php file, which fails to properly validate user input in the 'id' parameter. Attackers can exploit this by providing base64-encoded file paths to retrieve sensitive configuration files, such as wp-config.php, which typically contains database usernames, passwords, and other critical site settings.

• CVE-2016-20078MEDIUM 6.2

  WordPress IMDb Profile Widget version 1.0.8 contains a flaw that lets unauthenticated attackers read files from your web server by crafting special web requests. An attacker can manipulate the `url` parameter sent to the `pic.php` file using directory traversal techniques (like `../../../` sequences) to escape intended directories and access sensitive files such as `wp-config.php`, which typically contains database usernames, passwords, and other critical configuration data. No authentication is required to attempt this attack.

• CVE-2016-20079MEDIUM 6.2

  A local file inclusion vulnerability in WordPress Dharma Booking plugin versions 2.28.3 and earlier allows attackers without authentication to read sensitive files from a server by exploiting the gateway parameter. Attackers can use directory traversal sequences or null byte injection techniques to bypass path restrictions and access configuration files, database credentials, and other sensitive system information. The attack requires local access to the vulnerable server.

• CVE-2016-20080MEDIUM 6.2

  The Brandfolder plugin for WordPress (versions 3.0 and earlier) contains a vulnerability that lets unauthenticated attackers read sensitive files from a website's server. By manipulating a parameter called wp_abspath in the plugin's callback.php file, an attacker can trick the plugin into including arbitrary files—either by supplying path traversal sequences (like "../../") or by pointing to remote URLs. This could expose critical configuration files such as wp-config.php, which typically contains database credentials and security keys.

• CVE-2016-20082MEDIUM 6.2

  The Abtest WordPress plugin contains a flaw that allows attackers without credentials to read sensitive files from your server and potentially execute arbitrary code. The vulnerability exists in how the plugin handles the 'action' parameter in its admin interface file. By crafting a malicious request, an attacker can trick the plugin into loading files it shouldn't, potentially exposing configuration data or executing unauthorized commands.

• CVE-2018-25423MEDIUM 6.2

  Arm Whois version 3.11 has a buffer overflow flaw that allows local users to crash the application by entering an extremely long string into IP address or domain input fields. An attacker with local access can supply a malicious 700-byte input to trigger a denial of service, making the tool temporarily unavailable but without risking data theft or system compromise.

• CVE-2019-25760MEDIUM 6.2

  Joomla's Easy Shop component version 1.2.3 has a local file inclusion flaw that lets attackers read sensitive files directly from the server without needing to log in. An attacker can craft special web requests that trick the component into exposing files like database credentials and configuration data by encoding file paths in base64 format. This is a straightforward attack that requires no authentication or user interaction.

• CVE-2022-50953MEDIUM 6.2

  The admin-word-count-column WordPress plugin version 2.2 contains a flaw that lets unauthenticated attackers read files they shouldn't be able to access. An attacker can craft a specially formed web request to the plugin's download-csv.php file, using directory-traversal tricks and null-byte injection to bypass the plugin's file-access controls. This allows them to download sensitive configuration files and other data directly from the server.

• CVE-2023-43686MEDIUM 6.2

  Malwarebytes versions 4.x and 5.x contain a denial-of-service vulnerability triggered when a large number of Firefox preference files are present on a system. The parser becomes overwhelmed and stops processing other browser configuration files, effectively disabling Malwarebytes' ability to scan certain browser-based threats. This is a local issue requiring no special privileges to trigger.

• CVE-2026-0046MEDIUM 6.2

  CVE-2026-0046 is a local privilege escalation vulnerability affecting Google Android that exploits a weakness in the InputInterceptor component of Letterbox.java. An attacker can overlay malicious UI elements on top of legitimate permission prompts, tricking users into granting permissions they did not intend to approve. What makes this particularly concerning is that exploitation requires no special system privileges and occurs without user awareness—the victim merely sees what appears to be a normal permission dialog. The result is unauthorized elevation of the attacker's application privileges within the Android system.

• CVE-2026-0055MEDIUM 6.2

  A path traversal vulnerability in Android's PackageInstallerService allows an attacker to write a Device Policy Controller (DPC) application to an unintended directory. By exploiting this flaw, an unprivileged local process can escalate its privileges without requiring user interaction or additional system permissions. The vulnerability affects multiple Android versions and could allow an attacker with local access to gain elevated capabilities on the device.

• CVE-2026-10648MEDIUM 6.2

  A null-pointer dereference vulnerability exists in Zephyr's MCUmgr serial transport handler. When an attacker sends multiple MCUmgr packets in quick succession over a serial/UART connection, they can exhaust the device's shared packet buffer pool (which holds only 4 buffers by default). Once exhausted, the code attempts to reset a null buffer without first checking if allocation succeeded, causing a crash. This is a denial-of-service attack requiring only local serial access; no authentication or user interaction is needed.

• CVE-2026-12086MEDIUM 6.2

  IBM UrbanCode Deploy and DevOps Deploy store sensitive information—such as credentials, API keys, or other authentication material—in log files that are readable by any local user on the system. An attacker with local access can read these logs to extract secrets without needing elevated privileges. This is a local-only attack vector with no network component, but the confidentiality impact is significant because it can expose credentials used to access other systems.

• CVE-2026-12488MEDIUM 6.2

  GeoVision GV-VMS V20 version 20.0.2 contains a memory corruption flaw in its GV-Cloud component that can be exploited to cause service disruption. An attacker who can impersonate a legitimate server or send a specially crafted network request can trigger a denial-of-service condition. The vulnerability requires high privilege level and user interaction to exploit, limiting its attack surface but still warranting attention for environments relying on GV-Cloud functionality.

• CVE-2026-13757MEDIUM 6.2

  p11-kit, a library that manages cryptographic objects like keys and certificates, contains a flaw in how it processes template attributes in RPC messages. An attacker with local access to the p11-kit server can craft a malicious request with deeply nested template attributes that causes the server to exhaust its stack and crash. This denial-of-service attack requires local access and cannot lead to data theft or corruption, but it can disrupt services that depend on p11-kit for cryptographic operations.

• CVE-2026-36909MEDIUM 6.2

  A flaw in MPC-BE, a popular media player, can cause it to crash when opening a specially crafted MP4 video file. An attacker could exploit this by distributing a malicious MP4 that triggers a crash whenever the player tries to read it. While this doesn't expose sensitive data or let an attacker take control of your system, it does disrupt the availability of the application. The issue stems from a NULL pointer dereference—essentially, the player tries to access data that doesn't exist—in the code that reads track identification information from MP4 files.

• CVE-2026-39245MEDIUM 6.2

  The decompress package before version 4.2.2 contains a path validation flaw that allows attackers to write files outside the intended extraction directory. When decompressing archives, the library checks whether extracted files stay within a safe folder, but the check uses a string-matching approach that can be bypassed. For example, a path like '/tmp/app_config' would incorrectly pass validation for the directory '/tmp/app' because the string '/tmp/app' appears at the start of it—even though they are different directories. An attacker can exploit this to place malicious files in adjacent directories, potentially compromising the application or system.

• CVE-2026-42771MEDIUM 6.2

  CVE-2026-42771 is a vulnerability in OpenSSL's email address validation logic that can cause an application to crash when processing crafted email addresses. The flaw lies in how OpenSSL validates the local part (the part before the '@' symbol) of email addresses, particularly during S/MIME message validation. An attacker who can supply a malicious email address in an S/MIME message can trigger an out-of-bounds read that most likely results in a denial of service. The vulnerability does not allow data theft or system compromise beyond availability impact.

• CVE-2026-45491MEDIUM 6.2

  A flaw in .NET's file handling allows an attacker with local access to manipulate files through improper link resolution. The vulnerability stems from the system failing to properly validate symbolic links or similar path references before opening files, which means an attacker could redirect file operations to unintended targets. While this requires local access and does not compromise confidentiality, it can lead to unauthorized modification of sensitive data or system files.

• CVE-2026-46523MEDIUM 6.2

  ImageMagick, widely used image processing software, contains a memory safety defect that can be triggered when processing specially crafted MSL (Magick Scripting Language) image files. The vulnerability allows an attacker with local file access to cause the application to crash or potentially execute code by manipulating freed memory. This affects both the maintained 7.x branch and the legacy 6.x branch before specific patch versions.

• CVE-2026-46557MEDIUM 6.2

  ImageMagick, a widely-used image editing and manipulation library, contains a stack overflow vulnerability in its fx (effects) operation. When processing specially crafted input, the affected code fails to validate recursion depth, allowing an attacker to exhaust the stack and crash the application or potentially execute arbitrary code. The vulnerability affects all versions before 7.1.2-23 and can be triggered locally without user interaction or special privileges.

• CVE-2026-47902MEDIUM 6.2

  CAI Content Credentials, Adobe's implementation of Content Provenance and Authentication, contains a flaw that allows attackers to consume excessive system resources without any user action required. This can crash or severely degrade applications using affected versions of the c2pa-web library (0.7.1 and earlier) or the c2pa core library (v0.80.1 and earlier). The vulnerability is a resource exhaustion issue—an attacker sends specially crafted input that forces the application to allocate memory or processing power until the system becomes unresponsive.

• CVE-2026-47903MEDIUM 6.2

  CAI Content Credentials, Adobe's implementation for managing content provenance and authenticity, contains a flaw in how it validates input data. Versions [email protected], c2pa-v0.80.1 and earlier can be crashed by sending specially crafted input, causing a denial-of-service condition. No user interaction is required—an attacker can trigger the crash remotely, making this a network-reachable availability risk.

• CVE-2026-47904MEDIUM 6.2

  CAI Content Credentials, a component used for managing digital content authenticity and provenance, contains a flaw that allows an attacker to consume excessive system resources without requiring user action. An affected application could become unresponsive or crash, effectively denying legitimate users access to the service. This is a local-level vulnerability, meaning an attacker needs some degree of system access to trigger the condition.

• CVE-2026-47905MEDIUM 6.2

  A resource exhaustion vulnerability exists in Adobe's Content Credentials (C2PA) library that allows an attacker to consume excessive system resources and crash an application without requiring any user action. The vulnerability affects C2PA Web version 0.7.1 and earlier, as well as C2PA version 0.80.1 and earlier. An unauthenticated attacker with local access could trigger the issue remotely through the affected library, leading to a denial-of-service condition.

• CVE-2026-53465MEDIUM 6.2

  ImageMagick, a widely-used image editing and manipulation tool, contains a memory corruption vulnerability in versions before 7.1.2-25. When processing specially crafted multi-frame images using the SF3 encoder, the software can write data beyond allocated memory boundaries, potentially causing application crashes or system instability. This is a local vulnerability requiring no special privileges or user interaction to trigger.

• CVE-2026-54778MEDIUM 6.2

  CoreWCF, a .NET Core implementation of Windows Communication Foundation, contains a concurrency flaw in how it resolves user identities for Unix domain socket connections. The vulnerability stems from the use of non-thread-safe system functions (getpwuid and getgrgid) that can cause one client connection to be misidentified as another during simultaneous access, or potentially crash the service. Versions prior to 1.8.1 and 1.9.1 are affected. This is a local attack surface issue affecting systems where CoreWCF processes handle multiple concurrent Unix socket clients.

• CVE-2026-56459MEDIUM 6.2

  HCL DevOps Deploy and HCL Launch contain a local information disclosure vulnerability where sensitive data is written to application log files readable by any user on the system. An attacker with local access can read these logs to obtain confidential information, such as credentials, API tokens, or deployment secrets. This is a local-only attack that does not require authentication or user interaction.

• CVE-2026-58300MEDIUM 6.2

  Microsoft Edge for Android contains a path traversal vulnerability that allows an attacker with local access to the device to read sensitive files. The vulnerability does not require user interaction or elevated privileges, making it a concern for any Android device running the affected version of Edge. An attacker would need physical or local network access to the device to exploit this issue.

• CVE-2026-8594MEDIUM 6.2

  Text::LineFold, a Perl module for handling line breaks in text, contains a bug that causes it to duplicate output when processing strings with certain special break characters (like vertical tabs and form feeds). The module splits input by these characters but then applies its line-breaking logic to the entire original string instead of just the individual segments, resulting in unnecessary duplication. While primarily a logic error, this can cause excessive memory and CPU consumption if exploited, potentially leading to denial of service on systems processing untrusted text input.

• CVE-2026-9073MEDIUM 6.2

  Foreman-mcp-server contains two logging flaws that can expose authentication secrets. Session identifiers are logged as informational messages, and when debug logging is enabled, HTTP headers containing authorization tokens and API keys are not properly sanitized before being written to logs. These plaintext credentials in container logs create a confidentiality risk, especially if logs are shipped to centralized logging systems where they may be accessed by additional parties.

• CVE-2026-9260MEDIUM 6.2

  Canon EOS Network Setting Tool version 1.5.0 and earlier contains hard-coded cryptographic keys that are embedded directly in the application binary. An attacker with local access to an affected system can extract these keys and use them to decrypt or forge network communications intended to be protected by encryption. This is a confidentiality risk that does not require user interaction to exploit.

• CVE-2019-25731MEDIUM 6.1

  Zuz Music version 2.1 has a flaw that lets anyone send malicious code through the contact form without needing to log in. When site administrators read these messages, the injected code runs in their browsers, potentially allowing attackers to steal session data, modify settings, or trick them into performing unwanted actions. This is a persistent vulnerability, meaning the malicious payload stays stored on the server and affects every admin who views the inbox.

• CVE-2019-25737MEDIUM 6.1

  Live Chat Unlimited version 2.8.3 contains a stored cross-site scripting (XSS) vulnerability in its chat input field. An unauthenticated attacker can inject malicious JavaScript code that persists in the system and executes when administrators access the chat interface. This allows attackers to steal admin session cookies, redirect users to phishing sites, or perform unauthorized actions within the admin dashboard without requiring authentication.

• CVE-2025-40808MEDIUM 6.1

  Siemens SIPROTEC 5 protective relays contain a file upload vulnerability affecting dozens of device models across multiple control processor variants. An authenticated attacker can upload malicious configuration files through the DIGSI 5 protocol, potentially disrupting power system operations or executing unauthorized code. The vulnerability requires valid credentials but represents a meaningful risk in environments where multiple operators or contractors have access to device management interfaces.

• CVE-2025-60465MEDIUM 6.1

  A use-after-free memory vulnerability exists in GPAC's media file processing logic. When MP4Box or the GPAC library processes a specially crafted media file, it can access memory that has already been freed, triggering a crash. An attacker needs only to trick a user into opening a malicious file locally—no network interaction required. The impact is denial of service; while the vulnerability does involve memory corruption, the specific attack vector does not lead to code execution in the current configuration.

• CVE-2025-71331MEDIUM 6.1

  Flowise, a platform for building AI chat applications, has a cross-site scripting (XSS) weakness in versions before 3.0.8. An attacker can inject malicious code through chat messages or custom agent functions, which then runs in a victim's browser when they interact with an affected Flowise instance. This could allow theft of session cookies and authentication tokens, potentially giving attackers unauthorized access to user accounts or sensitive data the victim can access.

• CVE-2025-71385MEDIUM 6.1

  Netdata versions before 2.3.1 contain a reflected cross-site scripting (XSS) vulnerability in two undocumented SVG endpoints. These endpoints (`/api/v2/ilove.svg` and `/api/v3/ilove.svg`) accept a user-supplied `love` query parameter and insert it directly into an SVG document without any sanitization. An attacker can craft a malicious URL containing JavaScript code, and when a victim visits that URL, the script executes in their browser with access to the Netdata instance's origin. Because these endpoints are accessible without authentication on default Netdata deployments, no special access is required to exploit this vulnerability.

• CVE-2025-8591MEDIUM 6.1

  CVE-2025-8591 is a reflected cross-site scripting (XSS) vulnerability affecting multiple WSO2 products. An attacker can craft a malicious URL containing script code that, when clicked by a user, executes arbitrary JavaScript in the victim's browser. While session cookies are protected by httpOnly flags (preventing token theft), an attacker can still redirect users to phishing sites, deface page content, or harvest non-sensitive browser data. The vulnerability requires user interaction—the victim must click a crafted link—making it a social engineering vector rather than a wormable flaw.

• CVE-2026-0279MEDIUM 6.1

  Palo Alto Networks PAN-OS contains multiple cross-site scripting (XSS) vulnerabilities in its User-ID Authentication Portal, GlobalProtect gateway/portal, and Clientless VPN components. An unauthenticated attacker can inject malicious JavaScript that either persists in the system or executes in a user's browser. The vulnerability requires user interaction (such as clicking a malicious link) to trigger. Palo Alto's deployment best practices—restricting management interface and Authentication Portal access to trusted internal IP addresses—significantly reduce exposure.

• CVE-2026-10305MEDIUM 6.1

  Samsung's rlottie animation library contains a vulnerability that allows reading data beyond the intended buffer boundaries. When processing specially crafted animation files, the library may access memory it shouldn't, potentially exposing sensitive information or causing the application to crash. The issue stems from insufficient bounds checking during buffer operations. While the vulnerability requires user interaction (opening a malicious animation file) and is limited to local access, the combination of integrity impact and high availability risk warrants prompt attention.

• CVE-2026-10510MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in the GeniexWebView component of Transsion's AI Assistant Lifestyle application for Android. An attacker can craft a malicious URL containing injected JavaScript code in the web_action_data parameter, which the vulnerable WebView will execute with the same privileges as the application. This allows arbitrary JavaScript execution in the context of the app, potentially compromising user data or enabling phishing attacks. The vulnerability affects all versions of the application currently in distribution.

• CVE-2026-10856MEDIUM 6.1

  MISP dashboard widgets contain a URL validation flaw that allows attackers to craft malicious buttons appearing to link within the application while actually redirecting users to external sites. The vulnerability stems from incomplete validation that accepts paths like '/\example.com', which browsers may normalize into scheme-relative URLs pointing to attacker-controlled domains. An attacker with dashboard configuration access can embed these crafted buttons to redirect legitimate users, creating phishing and credential-theft opportunities.

• CVE-2026-10857MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in AKIN Software's E-Commerce platform versions prior to 1.25.01.06. The flaw allows an attacker to inject malicious scripts into web pages viewed by users, potentially compromising user sessions, stealing credentials, or performing unauthorized actions on behalf of the victim. The attack requires user interaction—specifically clicking a crafted link—but does not require authentication.

• CVE-2026-10861MEDIUM 6.1

  MISP, a widely-used threat intelligence sharing platform, contains an open redirect vulnerability in its post-login redirect logic. When a user logs in, the application redirects them to a URL stored in the session without properly validating that the destination is actually part of the MISP application. An attacker can craft a malicious link that tricks users into visiting their legitimate MISP instance, then redirects them to an attacker-controlled website after they authenticate. This could be weaponized for phishing by appearing to come from a trusted source or to deliver malware from a domain the victim might not otherwise visit.

• CVE-2026-10916MEDIUM 6.1

  CVE-2026-10916 is a cross-site scripting vulnerability in Google Chrome's developer tools that allows an attacker to inject malicious scripts or HTML content into a webpage. The attack requires two conditions: first, the attacker must have already compromised Chrome's renderer process (the component that executes web content), and second, the user must be tricked into visiting a specially crafted HTML page. While the initial compromise is a significant prerequisite, once achieved, this vulnerability enables the attacker to execute arbitrary code with the privileges of the browser session, potentially stealing sensitive data or performing actions on behalf of the user.

• CVE-2026-11034MEDIUM 6.1

  Google Chrome on Android contains a vulnerability in its Tab Group Sync feature that allows attackers to inject malicious scripts or HTML into web pages. An attacker with network access can craft malicious traffic to exploit insufficient input validation, potentially displaying fake content or stealing user information from websites. This affects Chrome versions prior to 149.0.7827.53.

• CVE-2026-11122MEDIUM 6.1

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the keyboard input handler processes certain HTML page elements. An attacker can craft a malicious webpage that, when visited by an unsuspecting user, injects arbitrary scripts or HTML content that executes in a security context where it shouldn't be allowed—a technique called Uniform Cross-Site Scripting (UXSS). This bypasses the browser's same-origin policy protections that normally prevent cross-domain attacks. The vulnerability requires user interaction (clicking or viewing the page) but affects all major platforms where Chrome runs.

• CVE-2026-11150MEDIUM 6.1

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the browser processes XML within HTML pages. An attacker can craft a malicious webpage that, when visited, injects arbitrary scripts or HTML content that execute in the context of unrelated sites (a technique known as Universal Cross-Site Scripting or UXSS). This bypasses the same-origin policy that normally prevents one site from accessing data or performing actions on another. The vulnerability requires user interaction—a victim must visit the attacker's page—but does not require any special browser configuration or user privileges to trigger.

• CVE-2026-11186MEDIUM 6.1

  Google Chrome versions prior to 149.0.7827.53 contain a vulnerability in CSS handling that allows attackers to inject malicious scripts or HTML into web pages users visit. An attacker would craft a specially designed webpage that, when opened in a vulnerable version of Chrome, bypasses security boundaries and executes unauthorized code in the context of other websites. This type of attack, known as Universal XSS (UXSS), is particularly dangerous because it affects the browser itself rather than individual websites, potentially compromising user data across multiple domains.

• CVE-2026-11205MEDIUM 6.1

  Google Chrome on iOS versions prior to 149.0.7827.53 contain a vulnerability that allows attackers to inject malicious scripts or HTML into web pages through crafted QR codes. The attack requires user interaction—specifically, the victim must engage with certain UI gestures in response to the attacker's QR code—but once triggered, the injected content runs with the privileges of the page being viewed. This is a cross-origin scripting (UXSS) issue, meaning the injected code can affect pages from different origins, potentially stealing session cookies, credentials, or sensitive data.

• CVE-2026-11229MEDIUM 6.1

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the application handles certain enterprise features that could allow someone with physical access to your device to gain elevated privileges. The vulnerability requires an attacker to be present at the machine itself and does not need you to take any action—they can exploit it directly. This is a local-only threat and cannot be exploited remotely over the internet.

• CVE-2026-11273MEDIUM 6.1

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in the Omnibox (the address/search bar) that fails to properly validate user input. An attacker can craft a malicious HTML page that, when visited by a user who interacts with the Omnibox through specific UI actions, allows injection of arbitrary scripts or HTML content. This is a cross-site scripting variant (UXSS) that bypasses the normal security boundary between web pages. The attack requires user interaction and social engineering to be effective, but once triggered, can compromise the integrity and confidentiality of the browsing session.

• CVE-2026-11392MEDIUM 6.1

  The WP Hotel Booking plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. An attacker can craft a specially designed link containing malicious code in the check-in or check-out date parameters. If a site user clicks that link, the injected script executes in their browser, potentially stealing credentials, session tokens, or performing actions on their behalf. This vulnerability affects all versions up to and including 2.3.1 and requires no special privileges to exploit—only user interaction.

• CVE-2026-11603MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in the Product Filter Widget for Elementor WordPress plugin through version 1.0.6. An attacker can craft a malicious link and trick a user into clicking it, causing arbitrary JavaScript to execute in the victim's browser within the context of their WordPress site. The vulnerability stems from the plugin's failure to properly sanitize user input in the 'args[filterFormArray]' parameter before displaying it back to the user. No authentication is required to exploit this flaw, and the attack is delivered silently via an admin-ajax.php endpoint without requiring verification that the request is legitimate.

• CVE-2026-11798MEDIUM 6.1

  The Super Socializer WordPress plugin—a widely-used tool for social sharing, login, and comment features—contains a reflected cross-site scripting (XSS) vulnerability in versions up to 7.14.5. An attacker can craft a malicious link containing injected JavaScript code in the 'heateor_mastodon_share' parameter. If a user clicks that link while logged into their WordPress site, the malicious script executes in their browser with their privileges, potentially stealing session data, modifying content, or performing unauthorized actions. This requires social engineering—the attacker must trick the user into clicking—but requires no special privileges or technical user action beyond a click.

• CVE-2026-11878MEDIUM 6.1

  OpenText Access Manager versions 5.1 through 5.1.2 contain a cross-site scripting (XSS) vulnerability in web page generation. An attacker can inject malicious JavaScript code that executes in the browsers of users accessing the affected system. The vulnerability requires user interaction (such as clicking a crafted link) but does not require authentication, making it accessible to unauthenticated threat actors. While not currently listed in CISA's Known Exploited Vulnerabilities catalog, the combination of network accessibility and user-triggered execution means organizations should prioritize remediation.

• CVE-2026-12137MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in the SysBasics Customize My Account for WooCommerce plugin for WordPress. The flaw is in how the plugin handles the 'tab' parameter—it fails to properly sanitize and escape user input before displaying it on the admin dashboard. An attacker can craft a malicious link containing JavaScript code that executes in the browser of any logged-in Shop Manager or administrator who clicks it. The attack requires social engineering (tricking a user into clicking a link) and a valid WordPress admin session, but poses a real risk to compromised user accounts or credential-based attacks.

• CVE-2026-12425MEDIUM 6.1

  PowerSchool Employee Access Center version 23.10 contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript code into login URLs. When a user clicks a crafted link, the injected code executes in their browser with their privileges, potentially enabling session hijacking, credential theft, or unauthorized actions on their behalf.