By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 15 of 41

• CVE-2026-12459MEDIUM 6.1

  Google Chrome versions prior to 149.0.7827.155 contain a vulnerability in the Serial component that allows attackers to inject malicious scripts or HTML into web pages through a specially crafted HTML file. The attack requires user interaction (clicking or otherwise engaging with the malicious page) but does not require the victim to have special privileges. The injected content can compromise page integrity and access sensitive user data within the affected browser context.

• CVE-2026-12479MEDIUM 6.1

  A flaw in Keras 3.14.0's model saving and loading functionality allows an attacker to use specially crafted layer names to write files or create directories outside the intended temporary working directory. While the code blocks forward slashes in layer names, it doesn't sanitize directory traversal sequences like `..`, enabling path escape. An attacker must trick a user into saving or loading a malicious model file for exploitation to occur.

• CVE-2026-12754MEDIUM 6.1

  The VikBooking Hotel Booking Engine & PMS plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in versions up to 1.8.12. An attacker can craft a malicious link containing JavaScript code in the 'layoutstyle' parameter. If a user clicks that link while viewing a page with the vulnerable [vikbooking view="roomslist"] shortcode, the attacker's script executes in the user's browser in the context of that website. This could allow credential theft, session hijacking, or other client-side attacks. The vulnerability requires user interaction (clicking a link) and only affects pages that use the specific shortcode.

• CVE-2026-13015MEDIUM 6.1

  The Wp Google Places Review Slider plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in versions 18.1 and earlier. An attacker can craft a malicious link containing JavaScript code in the 'place' parameter. When a site administrator or authorized user clicks this link, the injected script executes in their browser within the context of the WordPress admin panel, potentially allowing the attacker to steal credentials, modify site content, or perform other unauthorized actions on behalf of the victim.

• CVE-2026-13245MEDIUM 6.1

  The MaxButtons – Create buttons plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in versions up to 9.8.5. An attacker can craft a malicious link containing JavaScript code that executes in a victim's browser when they click it. Because the plugin doesn't properly sanitize the 'view' parameter, the injected script runs in the context of the WordPress site, potentially allowing the attacker to steal session tokens, modify page content, or perform actions on behalf of the victim. This requires social engineering—the attacker must trick someone into clicking a crafted link—but no user authentication is needed to create the attack.

• CVE-2026-13334MEDIUM 6.1

  The Mang Board plugin for WordPress has a flaw that allows attackers to inject malicious code into web pages. An unauthenticated attacker can craft a deceptive link containing malicious script in the 'stag' parameter. When a user clicks the link, the injected script runs in their browser, potentially stealing session cookies, credentials, or performing actions on their behalf. The vulnerability affects all versions up to 2.3.4.

• CVE-2026-13836MEDIUM 6.1

  Google Chrome versions before 150.0.7871.47 contain a CSS handling flaw that allows attackers to inject malicious scripts or HTML into pages you visit. An attacker would craft a deceptive webpage and trick you into opening it; the browser's CSS parser would then execute the attacker's code in the context of a legitimate site you trust. This is a 'universal cross-site scripting' (UXSS) vulnerability—more severe than typical XSS because it bypasses the normal boundaries between websites.

• CVE-2026-14000MEDIUM 6.1

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser processes XML within HTML pages. An attacker can craft a malicious webpage that, when visited, injects unauthorized scripts or HTML content that executes with the privileges of the current webpage—a technique known as Unintended Cross-Site Scripting (UXSS). This allows attackers to steal data, manipulate page content, or perform actions on behalf of the user without additional user interaction beyond viewing the page.

• CVE-2026-14001MEDIUM 6.1

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser handles network-related content that allows attackers to inject malicious scripts or HTML code into web pages you visit. An attacker would craft a specially designed webpage; when you visit it, the injected code runs in your browser with the privileges of the website you're viewing, potentially stealing data or performing actions on your behalf. This type of attack, known as UXSS (Universal XSS), bypasses Chrome's normal security boundaries.

• CVE-2026-14068MEDIUM 6.1

  Google Chrome on iOS contains a flaw in how it handles the Omnibox (address bar) that can allow an attacker to inject malicious scripts or HTML content into a webpage you're viewing. The vulnerability requires a user to perform specific gestures in the browser interface—such as interacting with the address bar in a particular way—after visiting a specially crafted webpage. This is a cross-site scripting variant (UXSS) that affects Chrome versions before 150.0.7871.47 on iOS devices.

• CVE-2026-14083MEDIUM 6.1

  Google Chrome versions before 150.0.7871.47 contain a vulnerability that allows attackers to inject malicious scripts or HTML into web pages through insufficient input validation. An attacker would need to trick a user into visiting a specially crafted webpage, but once successful, the injected code can run with the same privileges as the visited site, potentially stealing session data, modifying page content, or performing actions on behalf of the user.

• CVE-2026-14145MEDIUM 6.1

  Google Chrome versions prior to 150.0.7871.47 contain a vulnerability in how CSS (Cascading Style Sheets) is processed that allows attackers to inject malicious scripts or HTML content into web pages. An attacker would need to trick a user into visiting a specially crafted webpage; if successful, the injected code runs with the privileges of the visited site, potentially compromising user data or enabling further attacks. This is classified as a Universal XSS (UXSS) vulnerability, meaning the attack bypasses normal browser security boundaries.

• CVE-2026-14147MEDIUM 6.1

  Google Chrome versions before 150.0.7871.47 contain a flaw in CSS handling that allows an attacker to inject malicious scripts or HTML into web pages viewed by users. The vulnerability requires user interaction (clicking a link or visiting a crafted page) and affects the security boundary between websites, potentially allowing one site to compromise another or steal sensitive data. While Chromium classified this as low severity internally, the cross-site nature of the exploit and the ease of triggering it via a simple crafted HTML page elevate the practical risk.

• CVE-2026-14358MEDIUM 6.1

  The Wikimedia Foundation's MediaWiki Charts Extension contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. An attacker can craft a specially designed chart parameter or input that, when processed by the extension, executes arbitrary JavaScript in the browsers of users viewing that content. This requires user interaction—specifically, a user must view the affected page—but does not require authentication. The vulnerability affects multiple version branches of the Charts Extension and has been patched in versions 1.43.9, 1.44.6, and 1.45.4.

• CVE-2026-1450MEDIUM 6.1

  The rognone WordPress plugin contains a reflected cross-site scripting (XSS) flaw that allows unauthenticated attackers to inject malicious scripts into web pages. The vulnerability exists in how the plugin handles the 'mode' parameter—it fails to properly sanitize user input and escape output, creating an opening for attackers to craft malicious links. If a user clicks such a link while using a site running the vulnerable plugin, the attacker's script executes in their browser with access to session data and sensitive information.

• CVE-2026-1451MEDIUM 6.1

  The rognone plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript into pages viewed by unsuspecting users. An attacker could craft a malicious link containing JavaScript in the 'a' parameter and trick a user into clicking it, causing the script to execute in their browser within the context of the WordPress site. This works because the plugin fails to properly sanitize user input or escape output before displaying it. The vulnerability affects versions up to and including 0.6.2.

• CVE-2026-15127MEDIUM 6.1

  A flaw in how Google Chrome handles WebGL—a web technology for rendering graphics—allows attackers to inject malicious scripts or HTML into pages you visit. An attacker could craft a deceptive webpage that, when opened in a vulnerable Chrome browser, executes unauthorized code with the privileges of the web page you're viewing. This is a form of cross-site scripting (XSS) attack. The vulnerability affects Chrome versions prior to 150.0.7871.115.

• CVE-2026-15128MEDIUM 6.1

  A flaw in how Google Chrome handles web forms before version 150.0.7871.115 allows attackers to inject malicious scripts or HTML into pages viewed by users. An attacker would craft a specially designed webpage and trick a user into visiting it, at which point the injected code runs in the user's browser with access to sensitive page content. This is a cross-site scripting (XSS) variant that bypasses normal browser protections.

• CVE-2026-15297MEDIUM 6.1

  The Brevo email marketing plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in versions up to 3.1.77. An attacker can craft a malicious link containing injected scripts that execute in a victim's browser if the victim clicks the link while logged into WordPress. The vulnerability stems from the plugin's failure to properly sanitize and escape user input in the 'page' parameter. No authentication is required to exploit this, and the attack relies on social engineering—tricking a user into clicking a malicious link.

• CVE-2026-20175MEDIUM 6.1

  A remote attacker can trick a user into clicking a malicious link that causes their browser to load files from an attacker-controlled location while interacting with Cisco Finesse. Because the application doesn't properly validate where those files come from, an attacker can inject malicious scripts or steal sensitive information visible in the user's active session—all without needing to authenticate first.

• CVE-2026-20233MEDIUM 6.1

  Cisco Webex Meetings contained a cross-site scripting (XSS) vulnerability in its web interface that could allow an attacker to inject malicious scripts if a user clicked a crafted link. The vulnerability resulted from weak input validation. Cisco has already patched the service, and users do not need to take action—the fix has been deployed automatically.

• CVE-2026-21825MEDIUM 6.1

  HCL Digital Experience and Digital Experience Compose contain a reflected cross-site scripting (XSS) vulnerability in their search center functionality. An attacker can craft a malicious link containing JavaScript code and trick a user into clicking it. When the victim visits the link, the attacker's script executes in their browser with their privileges, potentially stealing session cookies, credentials, or performing actions on their behalf. This vulnerability requires user interaction—the victim must click a malicious link—which somewhat limits its reach, but the ability to target any user makes it a meaningful risk for organizations relying on these platforms.

• CVE-2026-21826MEDIUM 6.1

  HCL Digital Experience and HCL Digital Experience Compose contain a host header injection vulnerability that allows an attacker to manipulate how the application processes the Host header in HTTP requests. By injecting a malicious Host value, an attacker can trigger unexpected application behavior, potentially leading to phishing attacks, cache poisoning, or credential theft. The vulnerability requires user interaction—such as clicking a malicious link—to be exploited, which moderates the overall risk profile.

• CVE-2026-2425MEDIUM 6.1

  The hiWeb Migration Simple WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability in how it handles the 'new_domain' parameter. An attacker can craft a malicious link and trick a WordPress administrator into clicking it, causing arbitrary JavaScript to execute in the admin's browser session. This could allow the attacker to steal session tokens, modify site content, or perform administrative actions on behalf of the compromised admin. The vulnerability affects all versions through 2.0.0.1.

• CVE-2026-25688MEDIUM 6.1

  Apache Answer versions through 2.0.0 contain a cross-site scripting (XSS) vulnerability in how AI-generated response content is displayed to users. When Answer generates responses using AI, the application fails to properly clean this content before showing it in the browser. This allows an attacker to inject malicious scripts that execute in a user's browser when they view the generated response. The vulnerability requires user interaction (clicking a link or viewing a page with the malicious content) but can affect multiple users if the generated response is shared or cached.

• CVE-2026-25699MEDIUM 6.1

  Apache Answer versions up to 2.0.0 contain an authorization bypass in timeline-related APIs that allows any authenticated user to view content they shouldn't have access to—including deleted items, private submissions, and unapproved materials, along with their full revision history. An attacker with a regular user account can exploit this by directly calling these APIs without needing elevated privileges. The vendor has released version 2.0.1 to address the flaw.

• CVE-2026-25779MEDIUM 6.1

  Gitea, a self-hosted Git service, contains a redirect validation flaw that allows attackers to bypass intended redirect protections by embedding raw or percent-encoded backslashes in redirect_to parameters. This enables attackers to redirect users to untrusted external sites after authentication, potentially leading to credential theft or phishing. The vulnerability affects Gitea versions 1.25.4 and earlier.

• CVE-2026-25860MEDIUM 6.1

  OpenClinic GA version 5.351.19 contains a reflected cross-site scripting (XSS) vulnerability in its DICOM image upload functionality. An attacker can craft a malicious DICOM medical image file containing JavaScript code in metadata fields like Study Description. When a user uploads and processes this file through the application's DICOM upload feature, the embedded script executes in their browser without restriction, potentially allowing the attacker to steal session cookies, redirect users to malicious sites, or perform unauthorized actions on behalf of the victim.

• CVE-2026-29170MEDIUM 6.1

  Apache HTTP Server versions 2.4.67 and earlier contain a cross-site scripting (XSS) vulnerability in the mod_proxy_ftp module. When the server is configured to proxy FTP directory listings—whether forwarding traffic to an upstream FTP server or presenting one via reverse proxy—it fails to properly sanitize HTML generated for directory contents. An attacker can craft malicious FTP directory entries or filenames containing JavaScript code. When an administrator or user views the directory listing in a browser, the malicious script executes in their session, potentially allowing session hijacking, credential theft, or administrative actions.

• CVE-2026-30586MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in usememos Memos version 0.26.0 that allows an attacker to inject malicious code into memo pages. When a user views a compromised memo—whether public or private—the attacker's script executes in the user's browser, potentially exposing sensitive information. The vulnerability stems from improper sanitization of user input in the memo rendering component, meaning the application fails to adequately strip or encode dangerous HTML and JavaScript before displaying memo content.

• CVE-2026-32856MEDIUM 6.1

  Ellucian Banner Self-Service is vulnerable to a reflected cross-site scripting (XSS) attack before its April T2 2025 release. An attacker can craft a malicious URL and send it to an unauthenticated user. When clicked, the URL injects malicious JavaScript into the victim's browser through an unsanitized parameter in the dateConverter endpoint. This could allow the attacker to steal session cookies, hijack accounts, or perform actions on behalf of the victim.

• CVE-2026-33553MEDIUM 6.1

  Northern.tech CFEngine Enterprise contains a cross-site scripting (XSS) vulnerability in versions 3.24.3 before 3.24.4 and 3.27.0 before 3.27.1. An attacker can inject malicious scripts that execute in the browser context of users interacting with the CFEngine Enterprise interface, potentially compromising user sessions or stealing sensitive information without requiring authentication.

• CVE-2026-34416MEDIUM 6.1

  OSCAL-GUI contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to execute malicious JavaScript in users' browsers without authentication. An attacker crafts a deceptive URL containing specially crafted input in the project request parameter. When a victim clicks the link, the malicious payload executes in their browser, bypassing security filters. This attack requires social engineering—tricking someone into clicking a malicious link—but the impact can include session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

• CVE-2026-34417MEDIUM 6.1

  OSCAL-GUI contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript into a victim's browser. An unauthenticated attacker can craft a malicious URL containing JavaScript code in the project request parameter. When a victim visits this URL, the injected code executes in their browser with the same privileges as the victim, potentially allowing attackers to steal session cookies, perform actions on behalf of the user, or redirect them to phishing sites. The vulnerability requires user interaction—specifically clicking a malicious link—but no authentication is required to exploit it.

• CVE-2026-34915MEDIUM 6.1

  Revive Adserver versions up to 6.0.6 contain a vulnerability in the zone-include.php script where user input is not properly validated before being used in database queries. An attacker with low privileges can manipulate the clientid parameter to inject malicious SQL commands, potentially reading or modifying sensitive data in the database. The attack does not require special access rights and is triggered via a web request, though user interaction is needed for successful exploitation.

• CVE-2026-35212MEDIUM 6.1

  OpenCTI, an open-source threat intelligence platform, contains a cross-site scripting (XSS) vulnerability in how it renders email message data. An attacker can craft a malicious email observable with unsanitized content in the message body, which executes JavaScript in a victim's browser when they view it. Because threat intelligence is often shared across teams via STIX files or automated ingesters, this could be weaponized to steal session cookies at scale, potentially compromising multiple analysts' accounts. The vulnerability requires user interaction—someone must view the crafted email observable—but the attack surface is broad given how threat intelligence is typically distributed.

• CVE-2026-36324MEDIUM 6.1

  SourceCodester Doctor Appointment System version 1.0 contains a Cross-Site Scripting (XSS) vulnerability in its user registration form. An attacker can inject malicious scripts into the registration page, which are then executed in the browsers of other users who view that registration data. This allows the attacker to steal session cookies, redirect users to phishing sites, or perform actions on behalf of legitimate users without their knowledge.

• CVE-2026-36521MEDIUM 6.1

  PublicCMS V5.202506.d contains a cross-site scripting (XSS) vulnerability in its site configuration management module. An attacker can inject malicious scripts into the configuration interface, which are then executed in the browsers of administrators and other users who view the affected settings. This allows attackers to steal session tokens, redirect users to phishing sites, or perform unauthorized administrative actions without requiring authentication to the CMS itself.

• CVE-2026-36725MEDIUM 6.1

  FastapiAdmin version 2.2.0 contains a vulnerability where attackers can inject malicious scripts into system notices. When an administrator or authorized user views a crafted notice through the notice creation endpoint, the injected code executes in their browser, potentially allowing attackers to steal session tokens, modify page content, or perform actions on their behalf. The attack requires user interaction—the victim must view the malicious notice—but no authentication is needed to craft and inject the payload.

• CVE-2026-37216MEDIUM 6.1

  Ruoyi version 4.8.2 contains a cross-site scripting (XSS) vulnerability in its system notice creation interface. An attacker can inject malicious JavaScript code through the /system/notice/add endpoint, which will execute in the browsers of users who view the crafted notice. This vulnerability requires user interaction—specifically, a victim must view a notice containing the malicious payload—but does not require authentication to create the notice. The impact is limited to information disclosure and minor modifications visible to end-users; system availability is not affected.

• CVE-2026-38579MEDIUM 6.1

  Damasac Thaipalliative LTE through version 3.0 contains multiple reflected cross-site scripting (XSS) vulnerabilities that allow attackers to inject malicious scripts into web pages viewed by users. The flaws exist in the /substudy/ezform.php file where user-supplied values are directly inserted into HTML without proper sanitization. An attacker can craft a malicious URL and trick a user into clicking it, causing arbitrary JavaScript to execute in that user's browser within the context of the vulnerable application.

• CVE-2026-39897MEDIUM 6.1

  Cacti, an open-source monitoring and performance management platform, contains a reflected cross-site scripting (XSS) vulnerability in its authentication footer component. An attacker can craft a malicious link that, when clicked by a user, injects arbitrary JavaScript into the victim's browser session. This could allow theft of session cookies, credential harvesting, or redirection to phishing sites. The vulnerability affects Cacti versions 1.2.30 and earlier; version 1.2.31 and later contain the fix.

• CVE-2026-39900MEDIUM 6.1

  Cacti, a widely-used open source tool for monitoring network performance and managing faults, has a reflected cross-site scripting (XSS) vulnerability in its auth_profile.php file. An attacker can craft a malicious link containing JavaScript code in the 'tab' parameter that executes in a victim's browser when they click it. The victim must be tricked into clicking the link, but once they do, the attacker gains the ability to steal session tokens, alter page content, or perform actions on behalf of the logged-in user. Cacti versions 1.2.30 and earlier are vulnerable; version 1.2.31 fixes the issue.

• CVE-2026-40080MEDIUM 6.1

  Cacti, a widely-used open-source monitoring framework, contains an open redirect vulnerability in its authentication flow. When users log in with the referer-redirect option enabled, the application fails to properly validate where it sends them after login. An attacker can craft a malicious login link that appears to reference your Cacti installation but actually redirects to an attacker-controlled site. This allows phishing attacks: an attacker could send a fake login request that looks legitimate, capture credentials, and then silently hand the user off to a malicious domain. The vulnerability affects Cacti version 1.2.30 and earlier; it is patched in version 1.2.31.

• CVE-2026-40181MEDIUM 6.1

  React Router, a widely-used navigation library for React applications, contains an open redirect vulnerability in specific versions. When certain URLs are passed to the redirect function, the library can inadvertently send users to an external website controlled by an attacker. This happens because paths beginning with double slashes (//) are misinterpreted as protocol-relative URLs, allowing an attacker to craft a malicious URL that bypasses the intended redirect destination. The vulnerability only affects applications using the programmatic redirect function; applications built with React Router's declarative mode (using <BrowserRouter>) are not impacted. The severity of the risk depends on how thoroughly the application validates URLs before redirecting.

• CVE-2026-40713MEDIUM 6.1

  Dell ThinOS 10 devices running versions before 2602_10.0765 have a flaw that allows someone with physical access to the device—without needing to log in—to view sensitive information stored on it. This is a medium-severity issue because it requires hands-on access to the hardware, but once someone has that access, the controls meant to protect data don't work properly.

• CVE-2026-41008MEDIUM 6.1

  Spring Security Authorization Server contains an open redirect vulnerability in its authorization endpoint. When processing OAuth 2.0 authorization requests, the server insufficiently validates the request_uri parameter, allowing an attacker to combine an invalid request_uri with a crafted redirect_uri to redirect users to an attacker-controlled website after authentication. This affects Spring Security versions 7.0.0–7.0.5 and Spring Authorization Server versions 1.5.0–1.5.7.

• CVE-2026-4110MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in the ultimate-woocommerce-auction-pro WordPress plugin versions up to 2.4.5. The plugin fails to properly sanitize and escape user-supplied input before displaying it in the page, allowing an attacker to inject malicious scripts. Because the vulnerability requires user interaction (clicking a crafted link) and can target high-privilege users like administrators, it poses a meaningful risk to WordPress installations using this plugin.

• CVE-2026-41539MEDIUM 6.1

  QNAP has patched a cross-site scripting (XSS) vulnerability affecting multiple versions of QTS and QuTS hero operating systems. The flaw allows remote attackers to inject malicious scripts that execute in users' browsers, potentially bypassing security controls or stealing sensitive application data. No authentication is required to attempt exploitation, but a user must be tricked into clicking a malicious link or visiting a compromised page. QNAP has released security updates addressing the issue across affected product lines.

• CVE-2026-41568MEDIUM 6.1

  A race condition vulnerability in Docker Engine and Moby allows a malicious container to create empty files or directories at arbitrary locations on the host filesystem during the docker cp operation. An attacker with container access can exploit a timing window in mount setup to place files outside intended boundaries, potentially disrupting host operations or creating persistent artifacts. The vulnerability requires local access and user interaction, limiting but not eliminating real-world risk in multi-tenant or supply-chain scenarios.

• CVE-2026-41569MEDIUM 6.1

  authentik, an open-source identity provider, contains a URL validation flaw in its WS-Federation provider that allows attackers to redirect users' login credentials to attacker-controlled domains. The vulnerability stems from incomplete validation of the wreply parameter—a redirect URL used after authentication. An attacker can craft a malicious login link where the wreply parameter points to a lookalike domain (for example, https://portal.example.com.evil.tld/) that bypasses the validation check, tricking users into sending their signed authentication response to the attacker instead of the legitimate application. This affects authentik versions prior to 2026.2.3.

• CVE-2026-41706MEDIUM 6.1

  Spring Security's request caching mechanisms (CookieRequestCache and CookieServerRequestCache) contain an open redirect vulnerability. These components store the URL users intended to visit before logging in, then redirect them there after successful authentication. The vulnerability exists because the stored URL is not validated before being used as a redirect target, allowing attackers to craft malicious login links that redirect authenticated users to arbitrary external websites. An attacker could exploit this to perform phishing attacks, credential harvesting, or malware distribution by tricking users into clicking a specially crafted link.

• CVE-2026-41715MEDIUM 6.1

  Reactor Netty, a popular HTTP client library, has a credential leakage vulnerability that occurs when the client automatically follows HTTP redirects that go from a secure (HTTPS) endpoint to an insecure (HTTP) one. When this happens, authentication credentials can be transmitted in the clear over the unencrypted connection. The vulnerability only manifests in applications that have explicitly enabled redirect-following behavior. This is a configuration-dependent issue: systems using default settings or those that do not follow redirects are unaffected.

• CVE-2026-42253MEDIUM 6.1

  Apache ActiveMQ's web console contains a cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious content into HTTP response headers. The flaw exists in how the MessageServlet handles JMS message properties—it copies them directly into HTTP headers without filtering or validation. An attacker who can craft a JMS message with specially crafted properties could inject security headers, potentially leading to session hijacking, credential theft, or malware delivery when a user views the affected web console. The vulnerability requires user interaction (a victim must view the injected content) and affects versions of ActiveMQ and ActiveMQ Web released before 5.19.7 and 6.2.6.

• CVE-2026-42573MEDIUM 6.1

  Svelte, a lightweight and performance-focused web framework, contained a vulnerability in versions before 5.55.7 that allowed attackers to manipulate the browser's DOM in a way that corrupted Svelte's internal state. By exploiting DOM clobbering—a technique where attackers inject HTML elements that shadow legitimate JavaScript objects—an attacker could potentially inject malicious scripts that execute in a user's browser, leading to cross-site scripting (XSS) attacks. The vulnerability requires user interaction, such as clicking a link or visiting a malicious page, to be triggered.

• CVE-2026-42599MEDIUM 6.1

  Svelte, a popular web framework, contains a vulnerability where untrusted data rendered as HTML attributes can include malicious event handlers. If your application uses Svelte's spread syntax to render attributes from user input or external sources, attackers could inject code that runs when users interact with those elements. The risk is reduced if Svelte's hydration process completes before the injected event fires, but this shouldn't be relied upon as a defense. Version 5.55.7 and later address this issue.

• CVE-2026-4322MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability has been discovered in Destekz, a web design and digital advertising platform used by Raera, an Ankara-based agency. The flaw allows attackers to inject malicious scripts into web pages viewed by users. When a victim clicks a specially crafted link, the attacker's code runs in their browser with access to sensitive information like session cookies or personal data. Importantly, the vendor has confirmed the product is no longer supported, meaning no patches will be issued.

• CVE-2026-44644MEDIUM 6.1

  LiquidJS, a popular template engine used in Shopify and GitHub Pages, contains a cross-site scripting (XSS) vulnerability in its strip_html filter. This filter is meant to sanitize HTML by removing tags before rendering, but a flaw in its regex pattern allows attackers to bypass it by embedding newline characters within HTML tags. Because browsers treat newlines as whitespace inside tags, malicious event handlers like onerror or onload still execute. Versions 10.25.7 and earlier are affected. The vulnerability requires an attacker to control the input rendered through the vulnerable filter and assumes the application does not separately escape HTML output.

• CVE-2026-44663MEDIUM 6.1

  OpenEXR versions 3.4.0 through 3.4.11 contain a flaw in how they process HTJ2K-compressed EXR image files. When decoding a specially crafted file, an integer overflow occurs during calculation of image channel dimensions, resulting in an incorrect memory address. This address is then used to write data to the heap, potentially overwriting adjacent memory. An attacker could exploit this by distributing a malicious EXR file; a user opening it in affected software could experience a crash or, in principle, allow code execution, though the latter is not confirmed. The vulnerability has been patched in version 3.4.12.

• CVE-2026-44746MEDIUM 6.1

  SAP NetWeaver JAVA contains a reflected cross-site scripting (XSS) vulnerability in its JDBC Test Servlet component. An attacker can craft a malicious URL containing embedded script code. When an unsuspecting user clicks this link, the script executes in their browser within the context of the affected application. This allows the attacker to steal session data, modify information displayed to the user, or perform unauthorized actions on behalf of the victim—all without requiring the attacker to authenticate or exploit a server-side flaw. The vulnerability requires user interaction (clicking a link) to be triggered.

• CVE-2026-44889MEDIUM 6.1

  WebOb, a widely-used Python library for HTTP request and response handling, contains an open redirect vulnerability in how it processes redirect locations. An attacker can craft a malicious redirect URL containing whitespace characters (tabs, carriage returns, newlines) that bypass existing protections, causing users to be sent to an attacker-controlled website instead of the legitimate destination. The vulnerability affects versions before 1.8.10 and relies on the user clicking a link or visiting a page that triggers the vulnerable redirect.

• CVE-2026-44915MEDIUM 6.1

  Apache APISIX contains an open redirect vulnerability in its default CAS authentication configuration. An attacker can craft a malicious link that redirects users to an untrusted website after they authenticate, enabling phishing and credential theft. The vulnerability affects APISIX versions 3.0.0 through 3.16.0, and organizations should upgrade to version 3.17.0 to remediate the issue.

• CVE-2026-45307MEDIUM 6.1

  Speakr, a self-hosted audio transcription web application, contains an open redirect vulnerability in its post-login redirect logic. An attacker can craft a malicious URL that passes the application's safety validation but redirects authenticated users to an external attacker-controlled website. The flaw stems from a mismatch between how the validation function and the redirect function interpret scheme-relative URLs (those beginning with ////). The vulnerability affects versions prior to 0.8.20-alpha and is user-interaction dependent—victims must click a malicious link after logging in.

• CVE-2026-45384MEDIUM 6.1

  bit7z is a C++ library used by applications to handle file compression and extraction. Before version 4.0.12, the library had a flaw in how it created temporary files when updating archives. An attacker with local access could exploit a predictable temporary file location to create a symbolic link that tricks the library into overwriting arbitrary files on the system. This is a classic symlink-attack vulnerability affecting local privilege escalation or data integrity scenarios.

• CVE-2026-45500MEDIUM 6.1

  Microsoft Exchange Server contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages served by the application. An attacker can exploit this by crafting a malicious link or embedding code in a page that, when visited by a user, executes arbitrary actions in that user's browser session—such as stealing credentials, impersonating the user, or modifying email content. The vulnerability requires user interaction (clicking a link or visiting a page) but can affect any Exchange Server deployment exposed to the internet or accessible via webmail interfaces.

• CVE-2026-45560MEDIUM 6.1

  Roxy-WI, a web-based management console for load balancers and web servers, contains a stored cross-site scripting (XSS) vulnerability in its log viewer. The vulnerability exists because the application builds HTML pages by concatenating user-controlled log data without sanitization. An attacker who can generate traffic through a managed load balancer—such as by making HTTP requests to a public-facing application—can inject malicious scripts into access logs. When an administrator opens the log viewer in Roxy-WI, the injected payload executes in their browser with the privileges of that user. This is a supply-chain risk: any internet-facing service behind a Roxy-WI-managed load balancer becomes a potential injection point.

• CVE-2026-45566MEDIUM 6.1

  Roxy-WI, a web management interface for load balancers and web servers, contains a login redirect flaw that allows attackers to bypass security checks and trick users into visiting attacker-controlled websites. The vulnerability exploits an incomplete validation rule that rejects redirect URLs containing 'https://' or 'http://', but fails to account for the userinfo syntax (user@host format). By crafting a specially formed next parameter, an attacker can inject their domain into the redirect URL in a way that modern browsers interpret as routing to the attacker's site rather than the legitimate one. Successful exploitation requires user interaction—specifically a click on a malicious link—but carries real risk for credential harvesting and session hijacking.

• CVE-2026-46406MEDIUM 6.1

  Claude Code versions 2.1.59 through 2.1.128 had a local file handling vulnerability in the /copy command that could leak sensitive information or allow file manipulation. When the command executed, it wrote responses to a predictable location (/tmp/claude/response.md) with insufficient protections. Any user on the system could read files written there, potentially exposing secrets or credentials. Additionally, an attacker could plant a symlink at that location to trick the tool into overwriting arbitrary files with command output. This vulnerability requires local system access and relies on a privileged user running the /copy command, limiting its scope but creating real risk in multi-user or containerized environments.

• CVE-2026-46417MEDIUM 6.1

  Angular's server-side rendering (SSR) engine contains a vulnerability that allows attackers to redirect application requests to attacker-controlled servers. When an Angular application accepts a malicious URL during SSR initialization, the platform can be tricked into treating that URL's domain as the legitimate application origin. This causes subsequent relative requests—such as API calls or hostname lookups—to go to the attacker's server instead of the intended destination. An attacker would need to control the initial URL passed to the rendering engine, typically through manipulation of a request parameter or similar vector. The vulnerability affects the @angular/platform-server package across multiple major versions.

• CVE-2026-46547MEDIUM 6.1

  NocoDB, a popular no-code platform for building databases with a spreadsheet-like interface, contains a reflected cross-site scripting (XSS) vulnerability in its Page Leaving Warning feature. Attackers can craft malicious URLs containing JavaScript code that execute in a victim's browser when they click a specially crafted link or are redirected to the warning page. The vulnerability affects versions prior to 2026.04.1 and requires user interaction—specifically clicking a malicious link—to trigger the attack.

• CVE-2026-46642MEDIUM 6.1

  draw.io versions before 29.7.12 contain a stored cross-site scripting (XSS) vulnerability triggered when a crafted diagram file (.drawio) is opened. A malicious diagram can embed JavaScript code disguised as image markup that executes in the editor's security context as soon as the file is imported. The vulnerability stems not from the display rendering logic—which properly sanitizes content—but from a feature-detection routine in the Text Format panel that reads raw cell labels and inserts them into the DOM without validation. Attackers can craft and distribute poisoned diagram files that execute arbitrary scripts when opened by a user.

• CVE-2026-46770MEDIUM 6.1

  Oracle Application Development Framework (ADF), a core component of Oracle Fusion Middleware, contains a security flaw that allows an attacker to access or modify sensitive data without authentication. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. An attacker needs only network access and must trick a legitimate user into taking an action—such as clicking a malicious link—to trigger the vulnerability. Once successful, the attacker gains the ability to read or alter data within the ADF application, potentially affecting downstream systems that rely on it. This is not currently a known or active exploit in the wild, but it warrants prompt attention given the data-access implications.

• CVE-2026-46812MEDIUM 6.1

  Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain an authentication flaw that allows an unauthenticated network attacker to read or modify data within the application. The vulnerability requires a user to interact with a malicious request, but successful exploitation can affect not only Access Manager itself but potentially other connected systems. This is a medium-severity issue with network-accessible attack vectors and no special privileges required for initial access.

• CVE-2026-47250MEDIUM 6.1

  mcp-server-kubernetes is a tool that helps AI agents manage Kubernetes clusters through the Model Context Protocol. A flaw in versions before 3.7.0 allows an attacker with limited cluster access—such as a developer who can deploy pods—to trick a privileged operator into leaking their Kubernetes authentication token. By injecting a specially crafted instruction into application logs, the attacker can redirect kubectl commands to their own server, capture the operator's bearer token, and then use it to gain full control of the Kubernetes cluster. The vulnerability requires both an attacker with initial limited access and a privileged operator to interact with the MCP server, but the impact is severe: complete cluster compromise.

• CVE-2026-47306MEDIUM 6.1

  Samsung's rlottie library contains a flaw that allows specially crafted animation files to trigger uncontrolled recursion. When processing oversized serialized data payloads, the library fails to properly limit recursion depth, which can exhaust system resources and crash applications that depend on it. The vulnerability requires user interaction—a user must open or process a malicious animation file—but once triggered, it reliably denies service to the affected application.

• CVE-2026-47318MEDIUM 6.1

  A stack-based buffer overflow has been found in Samsung's rlottie library, an open-source animation rendering engine. When processing untrusted animation files, the library can write data beyond its allocated memory on the stack, potentially causing the application to crash or allowing limited data manipulation. The vulnerability requires a user to open a malicious animation file; it cannot be exploited remotely.

• CVE-2026-47319MEDIUM 6.1

  A memory allocation flaw in Samsung's rlottie animation rendering library allows an attacker to trigger excessive memory allocation by supplying a specially crafted input with an oversized size value. When a user opens a malicious animation file, the library attempts to allocate far more memory than intended, degrading system performance or causing the application to crash. This is a local attack that requires user interaction—the victim must open or process a hostile animation file.

• CVE-2026-47320MEDIUM 6.1

  CVE-2026-47320 is a memory safety vulnerability in Samsung's rlottie animation library that combines two distinct weaknesses: uninitialized pointer access and uncontrolled recursion. An attacker can craft malicious animation files that trigger pointer manipulation or send oversized serialized payloads, leading to application crashes and potential data corruption. The vulnerability requires local access and user interaction to exploit—someone must open a specially crafted file. While not as critical as remote execution flaws, this defect threatens availability and integrity on systems that process untrusted animation content.

• CVE-2026-47328MEDIUM 6.1

  Ubuntu Linux kernels 6.8, 6.17, and 7.0 contain a memory management bug in AppArmor SAUCE patches that allows unprivileged local users to corrupt kernel memory and exhaust system resources. The vulnerability stems from incorrect pointer deallocation—the code attempts to free memory that was never properly allocated, while simultaneously leaking other allocated memory. This combination can destabilize the kernel's memory management structures.

• CVE-2026-47833MEDIUM 6.1

  CVE-2026-47833 is a privilege escalation flaw in bpm-release (all versions before 1.4.30) where a compromised container process can exploit symlink handling in the setupBpmLogs function to gain unauthorized access to host files. An attacker can trick the system into changing ownership of arbitrary files—most critically /etc/shadow—to the vcap user, then read sensitive password hashes. This represents a container-to-host boundary breach affecting every job managed by bpm.

• CVE-2026-48157MEDIUM 6.1

  Slim, a popular PHP web framework, contains a vulnerability in versions 4.4.0 through 4.15 where developers can inadvertently create reflected cross-site scripting (XSS) vulnerabilities. If an application passes user-supplied data (like a search query or request parameter) into the HttpException::setTitle() or setDescription() methods, that data will be rendered without HTML escaping when an error page is displayed to the user. An attacker could craft a malicious request containing JavaScript that executes in the victim's browser. The vulnerability exists even when error detail display is disabled. The issue is fixed in Slim 4.15.2.

• CVE-2026-48520MEDIUM 6.1

  Langflow, a platform for building AI workflows and agents, has a file-read vulnerability in its "Shareable Playground" feature that allows public access to the flow. When a flow is made public, an attacker can craft execution requests that cause Langflow to read arbitrary files from the system—either local files or cloud storage like S3—and feed their contents into the LLM. This exposure depends on how the flow is configured and what storage backends are enabled. The vulnerability is patched in version 1.10.0.

• CVE-2026-48942MEDIUM 6.1

  CVE-2026-48942 is a cross-site scripting (XSS) vulnerability in JoomlaWorks K2 version 2.26 and earlier. The vulnerability exists because user profile images are inserted directly into HTML without proper sanitization. An attacker who can upload or modify a user profile image can craft a malicious image filename or source that executes JavaScript in the browsers of anyone viewing that profile. This requires user interaction (clicking or viewing a profile page) and affects only the user's current browser session and site context, but could be used to steal session cookies, redirect users, or deface content.

• CVE-2026-48949MEDIUM 6.1

  A Joomla vulnerability allows attackers to inject malicious scripts into multi-factor authentication (MFA) management pages. Because user input isn't properly validated before being displayed, an attacker can craft a malicious link that, when clicked by an authenticated administrator, executes JavaScript in their browser context. This could allow theft of session tokens, modification of MFA settings, or other administrative actions performed without the victim's knowledge.

• CVE-2026-48950MEDIUM 6.1

  CVE-2026-48950 is a cross-site scripting (XSS) vulnerability in Joomla's template file management component (com_templates). An attacker can inject malicious scripts into file names or metadata that are displayed without proper sanitization, allowing them to steal session cookies, redirect users, or perform actions on behalf of an administrator viewing the file management interface. The vulnerability requires user interaction—specifically, an administrator must visit the vulnerable page—but affects the security of the entire Joomla installation.

• CVE-2026-48951MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Joomla due to insufficient escaping of user input in modal return layouts across various components. An attacker can craft a malicious link or form that, when clicked by an authenticated or unauthenticated user, injects arbitrary JavaScript into the page. This script executes in the victim's browser within the context of the Joomla site, potentially allowing theft of session tokens, credential harvesting, or malware distribution.

• CVE-2026-48952MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Joomla's installer component update list view. The vulnerability arises from insufficient sanitization of user-supplied input, allowing an attacker to inject malicious scripts that execute in the context of an administrator's browser session. An authenticated or unauthenticated attacker can craft a malicious link containing JavaScript code; when an admin clicks it and accesses the installer update list, the injected script runs with the privileges of that administrator account. This could lead to unauthorized actions, session hijacking, or further compromise of the Joomla installation.

• CVE-2026-48953MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Joomla's generic image output layout due to insufficient output escaping. An attacker can craft a malicious link containing JavaScript code that executes in a victim's browser when they view or interact with image content. The vulnerability requires user interaction and affects the confidentiality and integrity of user sessions, though it does not impact availability.

• CVE-2026-48954MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability has been discovered in Joomla's language override feature. The vulnerability stems from inadequate input validation, allowing an attacker to inject malicious scripts that execute in users' browsers. An attacker would need to trick a user into visiting a specially crafted link or interacting with a compromised page, but no special privileges are required to exploit this flaw. The vulnerability affects the confidentiality and integrity of user sessions and data, though it does not directly impact system availability.

• CVE-2026-49294MEDIUM 6.1

  Valhalla, an open-source routing engine for OpenStreetMap data, contains a cross-site scripting (XSS) vulnerability in versions 3.6.3 and earlier. The flaw exists in how the application handles JSONP callback parameters—user-supplied values are reflected directly into responses without filtering or encoding. An attacker can inject malicious JavaScript by crafting a specially formatted URL; if a victim clicks or loads that URL, the attacker's script runs in the victim's browser with the same privileges as legitimate requests, potentially allowing theft of session tokens, credential capture, or unauthorized actions. This is a reflected XSS vulnerability requiring user interaction but with relatively broad impact potential.

• CVE-2026-49375MEDIUM 6.1

  JetBrains TeamCity versions before 2026.1 and 2025.11.5 contain a reflected cross-site scripting (XSS) vulnerability on the repository download page. An attacker can craft a malicious URL and trick a user into clicking it, allowing the attacker to steal session cookies, perform actions on behalf of the user, or redirect them to phishing sites. The vulnerability requires user interaction and does not directly compromise the server itself.

• CVE-2026-49384MEDIUM 6.1

  JetBrains PyCharm versions prior to 2025.3.4 contain a stored cross-site scripting (XSS) vulnerability in Jupyter notebook Markdown cells. An attacker can inject malicious scripts into Markdown content within a notebook, which are then executed in the browser context of users who view the notebook. This allows for session hijacking, credential theft, or malware distribution without requiring the victim to take any action beyond opening an affected notebook.

• CVE-2026-49496MEDIUM 6.1

  Ghidra, the NSA's open-source reverse engineering framework, contains a memory safety bug in its Sleigh decompilation engine that can corrupt heap memory. When processing malicious binaries, the vulnerability allows an attacker to trigger a use-after-free condition—where the software attempts to access memory that has already been freed. The flaw affects version 12.0 and earlier; upgrading to version 12.1 or later resolves the issue. While exploitation requires user interaction (opening a malicious binary), the memory corruption could lead to application crashes or, in carefully crafted scenarios, potential code execution.

• CVE-2026-49510MEDIUM 6.1

  Samsung's rlottie library, an open-source animation rendering engine, contains an integer overflow vulnerability that can be triggered when processing specially crafted input. An attacker with local access who tricks a user into opening a malicious animation file could cause the application using rlottie to crash or behave unpredictably, potentially allowing data corruption or denial of service.

• CVE-2026-50019MEDIUM 6.1

  yt-dlp is a popular command-line tool for downloading audio and video from the web. Between September 2023 and June 2026, a vulnerability existed where cookies could be sent to the wrong website if yt-dlp was configured to use curl as its external downloader. This could happen during HTTP redirects or when downloading video fragments from different hosts than the main manifest. The flaw stems from how yt-dlp passes cookies to curl—without properly activating curl's cookie handling engine, curl will blindly send cookies to any domain it connects to, regardless of the cookie's intended scope. An attacker controlling a redirect target or hosting a fragment URL could intercept these cookies, potentially gaining access to authenticated sessions. The vulnerability was fixed in version 2026.06.09.

• CVE-2026-50040MEDIUM 6.1

  Storage Concentrator (SC and SCVM) contains a reflected cross-site scripting (XSS) vulnerability in its 404 error page handling. When a user visits a specially crafted malicious link, unsanitized content is echoed back and executed as JavaScript in their browser. An attacker can exploit this to steal session credentials, redirect users to phishing sites, or perform actions within the application while impersonating the victim—but only if the victim clicks a malicious link while already logged in.

• CVE-2026-50089MEDIUM 6.1

  Aqara's IAM/SSO Gateway (gw-builder.aqara.com) contains an open redirect flaw that allows attackers to craft malicious links appearing to direct users to the legitimate Aqara domain, but actually redirecting them to attacker-controlled sites. This is a classic phishing vector: a user trusts the initial Aqara URL, clicks it, and lands on a fraudulent login page or malware distribution point. The vulnerability requires user interaction (a click) and affects the confidentiality and integrity of user sessions, making it a medium-severity network-based threat.

• CVE-2026-50133MEDIUM 6.1

  Hugo, a popular static site generator, contains a stored cross-site scripting (XSS) vulnerability in versions prior to 0.162.0. When Hugo processes HTML content files—either .html files placed in the /content directory or content generated by adapters configured with text/html media type—it outputs the body verbatim without sanitization. An attacker who can inject malicious HTML into a site's content pipeline can embed JavaScript that executes in visitors' browsers. This is particularly dangerous for sites that accept HTML content from external or user-controlled sources.

• CVE-2026-50169MEDIUM 6.1

  Angular's Service Worker has a flaw in how it handles network requests for cached assets. When the Service Worker reconstructs requests, it accidentally strips away security settings that tell the browser not to follow redirects—instead forcing all redirects to be followed automatically. This can leak sensitive data if a public page redirects to a restricted area, since cookies and session tokens travel along. The vulnerability affects Angular versions prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

• CVE-2026-50171MEDIUM 6.1

  Angular applications using number formatting features are vulnerable to a denial-of-service attack if an attacker can control the formatting instructions passed to number-display functions. An attacker crafting specially designed format strings with extremely large digit specifications can cause the application to enter an infinite loop that consumes memory and CPU, effectively freezing or crashing the app. This affects Angular's number, decimal, percent, and currency formatting pipes—features commonly used to display financial data, statistics, and user-facing numbers.