By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 16 of 41

• CVE-2026-50184MEDIUM 6.1

  Angular's Service Worker package has a flaw where it unintentionally reverses security settings you've configured for network requests. When your application tells the browser not to send credentials (like cookies) on a particular request, or marks a response as non-cacheable, the Service Worker strips those instructions and applies default settings instead. This can leak session data or cache sensitive pages in local storage even after logout. The issue affects Angular versions prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

• CVE-2026-50229MEDIUM 6.1

  Apache Tomcat contains a cross-site scripting (XSS) vulnerability in its bundled number-guessing example application. An attacker can inject malicious scripts into web pages served by this example, which execute in the browsers of users who interact with it. This affects multiple Tomcat versions across several release branches. The vulnerability requires user interaction (such as clicking a link) to trigger, and impacts confidentiality and integrity rather than availability.

• CVE-2026-50230MEDIUM 6.1

  Lyrion Music Server version 9.2.0 has a cross-site scripting (XSS) vulnerability in its server logging endpoint. An attacker can craft a malicious URL containing JavaScript code and trick a user into clicking it. When the user visits the link, the JavaScript runs in their browser with the same permissions as the Lyrion application, potentially allowing the attacker to steal session cookies, redirect the user, or perform actions on their behalf. No authentication is required to exploit this vulnerability, making it accessible to anyone who can send a link to a target user.

• CVE-2026-50235MEDIUM 6.1

  Lyrion Music Server 9.2.0 has a reflected cross-site scripting (XSS) vulnerability in its advanced search feature. An attacker can craft a malicious link containing JavaScript code in the search parameters. When a user clicks the link or is tricked into visiting it, the malicious script executes in their browser, potentially allowing the attacker to steal session cookies, hijack accounts, or perform actions on behalf of the user. The vulnerability requires user interaction—the victim must click a malicious link—but no special privileges or complex setup are needed to exploit it.

• CVE-2026-50555MEDIUM 6.1

  Angular's server-side rendering (SSR) feature includes a vulnerability in how it handles the serialization of raw-text HTML elements like <script>, <style>, and <iframe> tags. When dynamic content containing certain Unicode characters (specifically astral characters like emojis) appears before a closing tag, the server fails to properly escape that closing tag. This allows an attacker to break out of the raw-text context and inject arbitrary JavaScript that executes in the victim's browser with the same origin privileges. The flaw affects Angular versions prior to specific patched releases and requires user interaction (such as clicking a link) to exploit.

• CVE-2026-50556MEDIUM 6.1

  Angular applications using Server-Side Rendering (SSR) are vulnerable to Cross-Site Scripting attacks when dynamic text is bound inside <noscript> elements. The vulnerability stems from a gap in how the underlying DOM emulation library (domino) escapes closing tags during HTML serialization. An attacker who can control content rendered within a <noscript> element can inject a closing tag that terminates the noscript block prematurely, allowing arbitrary JavaScript to execute in the user's browser with the application's privileges. The issue affects Angular versions prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.

• CVE-2026-50557MEDIUM 6.1

  Angular versions prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.22 contain a template sanitization bypass vulnerability that allows attackers to inject malicious scripts through specially crafted namespace-based HTML elements. By using namespaced variants like <svg:script> or <:svg:script>, attackers can circumvent Angular's built-in protections against script injection, potentially leading to cross-site scripting (XSS) attacks. The vulnerability also extends to namespaced attributes in SVG and MathML elements, which can bypass attribute sanitizers. Any application using a vulnerable Angular version that processes user-supplied or dynamically rendered templates is at risk.

• CVE-2026-5071MEDIUM 6.1

  A vulnerability in the SocketCAN network socket implementation allows a local user to trigger an out-of-bounds memory read by sending a specially crafted network frame with a truncated buffer. The flaw stems from insufficient validation—the code relies on a disabled assertion to catch buffer length issues, but in production builds where assertions are turned off, this check is bypassed entirely. An attacker can then cause the system to crash or leak sensitive memory contents to the network.

• CVE-2026-50745MEDIUM 6.1

  A cross-site scripting vulnerability exists in Revive Adserver's stats-video.php script. The application fails to properly sanitize and encode user-supplied input before displaying it back to visitors. An attacker could craft a malicious link that, when clicked by a user, executes arbitrary JavaScript in the context of the affected domain. This is a reflected XSS vulnerability—the payload doesn't persist on the server, but requires social engineering to trick a user into clicking a specially crafted URL.

• CVE-2026-50765MEDIUM 6.1

  Koha Library Management System contains a stored cross-site scripting (XSS) vulnerability in its patron restriction type administration interface. An authenticated administrator can inject malicious JavaScript into restriction type labels, which is then stored and executed in the browsers of other users who view that page. This allows an insider threat to compromise other administrators' sessions or steal sensitive library data without requiring additional user interaction beyond normal administrative activities.

• CVE-2026-50813MEDIUM 6.1

  SQLite's Session Extension contains a vulnerability in how it merges changeset and changegroup data, allowing local attackers to read sensitive information from the database. The flaw affects versions before Fossil check-in 869a51ae84df and requires user interaction to trigger. While the vulnerability does not enable data modification or direct service disruption, the information disclosure risk is paired with a high availability impact potential, making it a moderate-severity issue requiring attention in environments where SQLite handles sensitive data.

• CVE-2026-52725MEDIUM 6.1

  Angular's dynamic component creation feature contains a security flaw that allows attackers to bypass script-execution protections. When an Angular application dynamically creates a component, the framework should prevent mounting that component onto dangerous HTML elements like <script> tags. This vulnerability fails to enforce that restriction, meaning an attacker who can control where a component is mounted could force it onto a script tag, causing arbitrary JavaScript code to execute in the user's browser. This is a client-side XSS vulnerability that requires user interaction and control over component placement to exploit.

• CVE-2026-52760MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Apache ActiveMQ's Web Console browse page. An authenticated message producer can craft a JMS message ID containing malicious HTML or JavaScript. When an administrator browses the queue through the Web Console, that payload executes in their browser, potentially allowing the attacker to steal session tokens, modify queue contents, or perform actions as the administrator. The vulnerability requires authentication to trigger but exploits a trust boundary between producer and administrator roles.

• CVE-2026-53737MEDIUM 6.1

  Juicer, a plugin or tool for managing remote feeds, contains a stored cross-site scripting (XSS) vulnerability in versions through 1.12.18. When an administrator visits the plugin's settings page, the plugin fails to properly sanitize data pulled from a connected remote feed before displaying it. An attacker who controls or can manipulate that feed source can inject malicious JavaScript code that will execute in the administrator's browser session. This runs with the privileges of the logged-in admin, potentially allowing the attacker to perform unauthorized actions or steal sensitive information.

• CVE-2026-53765MEDIUM 6.1

  Chrome DevTools for agents (chrome-devtools-mcp) is a tool that allows coding agents to control and inspect a live Chrome browser. Versions 0.20.0 through 1.0.x contain a local privilege escalation vulnerability affecting macOS and Linux systems. An attacker with local access to the same machine can exploit predictable file paths to write a symlink that causes the application to overwrite files belonging to higher-privileged users when the daemon starts. The vulnerability has been fixed in version 1.1.0.

• CVE-2026-53766MEDIUM 6.1

  Chrome DevTools for agents (chrome-devtools-mcp) contains a path validation flaw that allows an attacker with local access to bypass workspace boundary restrictions. By placing symbolic links inside an authorized workspace directory that point to files outside that boundary, an attacker can read sensitive files or overwrite files they should not have access to. This circumvents the security controls meant to confine agent operations to specific directories. The vulnerability affects versions 0.24.0 through 1.0.x and is resolved in version 1.1.0.

• CVE-2026-53841MEDIUM 6.1

  OpenClaw versions prior to 2026.5.12 contain a cross-site scripting (XSS) flaw in the exported session HTML feature. When users export session data, the resulting HTML file retains unsafe JavaScript and data URI links that have not been sanitized. If an operator opens this exported file in a browser and interacts with a malicious link, an attacker can execute arbitrary JavaScript in the operator's browser context. This is a social engineering attack requiring user action but can compromise an operator's session, credentials, or browser security.

• CVE-2026-53878MEDIUM 6.1

  Django's domain name validator accepts newlines in domain values, which can lead to HTTP header injection when those values are included in responses. While Django's own `HttpResponse` class protects against this, applications that validate domains with `DomainNameValidator` and then use those values directly in HTTP headers could inadvertently inject malicious headers. The issue affects Django 6.0 before version 6.0.7 and 5.2 before version 5.2.16, though older unsupported versions may also be vulnerable.

• CVE-2026-54264MEDIUM 6.1

  Angular's Service Worker—a component that helps web applications work offline—has a flaw in how it handles redirects across different websites. When a Service Worker follows a redirect to another domain, it should remove sensitive information like login tokens before sending the request. Instead, it's currently passing those credentials along, potentially exposing them to untrusted external sites. An attacker can exploit this by crafting a scenario where a user's browser is redirected through the vulnerable Service Worker to a site the attacker controls, capturing credentials in the process. This affects Angular versions before 22.0.1, 21.2.17, and 20.3.25.

• CVE-2026-54265MEDIUM 6.1

  Angular versions prior to 22.0.1, 21.2.17, and 20.3.25 contain a vulnerability in the compiler that allows developers to accidentally create XSS vulnerabilities in their applications. The issue occurs when developers use Angular's two-way binding syntax (a shorthand for linking data both into and out of a component) on sensitive HTML properties like innerHTML or src. Under normal circumstances, Angular automatically cleans these properties to prevent malicious code injection. However, the two-way binding syntax bypasses that automatic cleaning, leaving applications vulnerable if they bind user-controlled data to these properties. An attacker who can influence what data gets bound could inject malicious JavaScript that runs in users' browsers.

• CVE-2026-54266MEDIUM 6.1

  Angular's server-side rendering (SSR) feature uses a weak caching mechanism to avoid repeating HTTP requests during client hydration. The cache relies on a 32-bit hash to identify which responses belong to which requests. Because this hash is weak, an attacker can craft a specially constructed URL with a query parameter that produces the same hash value as a sensitive endpoint. When a victim visits the attacker's link, both requests execute, but due to the collision, the wrong response gets cached and returned to the user. This could expose sensitive data like profile information by replacing it with attacker-controlled content, or vice versa.

• CVE-2026-54267MEDIUM 6.1

  Angular applications using server-side rendering (SSR) with client hydration are vulnerable to a DOM Clobbering attack that could allow attackers to inject or manipulate cached application state. When an Angular app serializes its runtime state (like HTTP responses) into an HTML script tag during SSR, the client-side code retrieves this state by searching for an element with the ID 'ng-state'. If an attacker can control user input or CMS content that sets element IDs before the legitimate script tag loads, they can create a fake 'ng-state' element. When Angular's hydration process looks for this element, it finds the attacker's version instead and attempts to parse its content as application state, potentially leading to information disclosure or application manipulation.

• CVE-2026-54276MEDIUM 6.1

  AIOHTTP, a widely-used Python framework for building asynchronous HTTP applications, contains a flaw in its DigestAuthMiddleware component that can leak user credentials across domain boundaries. When a server redirects an authenticated user to a different domain (via an open redirect or similar vulnerability), AIOHTTP may automatically resend the digest authentication response to the attacker-controlled destination. An attacker cannot directly extract plaintext passwords from the digest alone, but the digest itself becomes a credential an attacker can attempt to crack or replay if cryptography is weak or if users reuse passwords across services.

• CVE-2026-54386MEDIUM 6.1

  marimo, a notebook environment for Python, contains a reflected cross-site scripting (XSS) vulnerability in versions before 0.23.9. An attacker can craft a malicious link containing malicious code in the file query parameter. When a user visits this link while accessing their marimo server, the injected JavaScript executes in the user's browser without being blocked by standard security protections. No authentication is required to exploit this vulnerability—any user who clicks a crafted link is at risk. The impact is limited to the attacker's ability to read or modify data visible to the victim within that marimo session, or perform actions on their behalf.

• CVE-2026-55423MEDIUM 6.1

  Langflow, a platform for building AI workflows and agents, has a session management flaw in versions before 1.7.0. When a user clicks logout, their session token is not properly cleared from the system. This means the previous user remains authenticated until someone else logs in with different credentials. In shared or multi-user environments, this creates a window where an attacker with brief physical or remote access could maintain unauthorized access to the account and its data after the legitimate user believes they've logged out.

• CVE-2026-55590MEDIUM 6.1

  CakePHP Authentication, a plugin used to handle user login flows in CakePHP and PSR-7 applications, has a flaw in how it validates redirect destinations after login. An attacker can craft a malicious link that tricks the redirect logic into sending users to an attacker-controlled website instead of a legitimate destination. The vulnerability exists because the code fails to properly block backslash characters used to disguise malicious URLs. Users who click a specially crafted link could be redirected to a phishing site or other attacker infrastructure, putting credentials or session data at risk.

• CVE-2026-55877MEDIUM 6.1

  Symfony UX, a popular JavaScript framework for the Symfony PHP framework, contains a cross-site scripting (XSS) vulnerability in how it renders SVG icons. The ux_icon() Twig function treats icon content as safe HTML without sanitizing it first. This means if an SVG file or icon data from the Iconify service contains malicious code—such as embedded script tags or event handlers—that code will execute in a user's browser. An attacker could exploit this by serving a malicious SVG or by compromising icon sources to run unauthorized JavaScript in the context of the affected application.

• CVE-2026-56236MEDIUM 6.1

  Capgo CLI, a command-line tool used by developers, has a flaw that allows attackers to trick it into overwriting files or exposing sensitive credentials. If a developer clones or works in a repository controlled by an attacker, the attacker can plant symbolic links (shortcuts to files) that cause the CLI to write to unintended locations on the developer's computer when they log in or build their application. The credentials file may also end up readable by anyone on that machine.

• CVE-2026-56263MEDIUM 6.1

  Crawl4AI, a web crawling framework, contains a stored cross-site scripting (XSS) vulnerability in its monitoring dashboard. An attacker can craft a malicious crawl request containing JavaScript code. When a dashboard operator views the crawl results, the malicious code executes in their browser without being sanitized, potentially allowing the attacker to steal session tokens, redirect the operator to phishing sites, or perform actions on their behalf. The vulnerability affects versions prior to 0.8.7.

• CVE-2026-56317MEDIUM 6.1

  Nuxt, a popular Vue.js framework, has a cross-site scripting (XSS) vulnerability in its NoScript component. When developers use the NoScript component to render untrusted data—such as user-supplied query parameters—the framework writes that content directly to the DOM without sanitizing it. An attacker can craft a malicious URL containing JavaScript that executes in the victim's browser when they visit the page, potentially stealing session tokens, modifying page content, or redirecting users to phishing sites.

• CVE-2026-56326MEDIUM 6.1

  Nuxt, a popular JavaScript framework for building web applications, contains a vulnerability in its `navigateTo` function that can be tricked into redirecting users to attacker-controlled websites. The vulnerability affects Nuxt 4.0.0 through 4.4.6 and all 3.x versions before 3.21.7. Attackers exploit this by crafting specially formatted URLs that bypass the framework's validation of external redirect targets, allowing them to send victims to phishing sites or steal authentication tokens. The attack requires user interaction—a victim must click a malicious link—but is otherwise straightforward to execute.

• CVE-2026-56347MEDIUM 6.1

  AVideo's TopMenu plugin version 26.0 and earlier allows attackers to inject malicious code into menu items that will execute when site visitors view the page. The plugin fails to properly sanitize user-supplied text in menu configurations, enabling stored cross-site scripting attacks. Once injected, the malicious code runs in visitors' browsers, potentially compromising their session security or enabling unauthorized site modifications.

• CVE-2026-56697MEDIUM 6.1

  Nuxt, a popular web framework, has a vulnerability in its `reloadNuxtApp` function that allows attackers to trick users into visiting malicious websites. The flaw stems from how the function validates URLs—it checks whether a path starts with a script protocol (like `javascript:`), but protocol-relative URLs (those beginning with `//`) slip through this check. When a user-supplied path like `//evil.com` is processed, the browser resolves it using the current page's protocol (http or https), redirecting to the attacker's domain instead. This enables phishing attacks or theft of sensitive authorization codes from OAuth flows. Affected versions are Nuxt 4.0.0 through 4.4.6 and all 3.x versions before 3.21.7.

• CVE-2026-56698MEDIUM 6.1

  Nuxt, a popular JavaScript framework, has a security flaw in its navigateTo function that fails to block certain types of links when users can control where they navigate. If an attacker tricks a user into clicking a specially crafted link or can inject malicious input into the navigation destination, the attacker's JavaScript code executes within the legitimate application's security context. This affects Nuxt 4.0.0 through 4.4.6 and all 3.x versions before 3.21.7. The vulnerability requires user interaction and is rated as medium severity because the impact is limited to information disclosure and minor manipulation within the page, though it can affect multiple users if hosted on shared origins.

• CVE-2026-56809MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in Ricoh Web Image Monitor, a web-based management interface found on multiple laser printers and multifunction printers (MFPs). An attacker can craft a malicious URL that, when visited by a printer administrator or authorized user, executes arbitrary JavaScript in their browser. This allows the attacker to perform actions on behalf of the logged-in user, such as modifying printer settings, accessing sensitive information, or pivoting into the network.

• CVE-2026-57241MEDIUM 6.1

  A vulnerability in Foxit PDF Editor and Reader allows an attacker to crash the application by crafting a malicious PDF file containing JavaScript. When the PDF is opened, the JavaScript code modifies page-related data structures in memory, causing them to become out of sync with what the renderer believes to be the current state. The application continues to trust an outdated page count and eventually attempts to access memory beyond valid bounds, leading to a denial of service. This requires user interaction (opening a PDF file) and affects only the local system, but can reliably crash the application.

• CVE-2026-57243MEDIUM 6.1

  A flaw in how Foxit's PDF applications handle JavaScript during document opening and form formatting can cause the application to crash. The vulnerability stems from a reentrancy issue—where JavaScript code is executed recursively before the previous execution completes—leaving the document in an inconsistent state. When the application then tries to access memory addresses based on outdated page information, it attempts to read from invalid locations, triggering a denial-of-service condition. An attacker would need to trick a user into opening a malicious PDF file to exploit this issue.

• CVE-2026-57253MEDIUM 6.1

  A flaw in Foxit PDF Editor and Reader allows a specially crafted PDF with an abnormal image object to crash the application. When the renderer processes the image's scan lines, it follows an incorrect code path and attempts to read from an invalid memory location, causing an immediate denial of service. The issue requires user interaction—opening a malicious PDF—but poses a genuine availability risk in environments where PDF handling is routine.

• CVE-2026-57255MEDIUM 6.1

  A vulnerability in PDF reader and editor applications allows a specially crafted PDF file with a malformed color space function to trigger an out-of-bounds memory access. When the application processes the PDF, the unvalidated function output creates an illegal pointer that crashes the application. This requires user interaction—the PDF must be opened—but poses a local denial-of-service risk and potential information disclosure through memory leakage.

• CVE-2026-57257MEDIUM 6.1

  CVE-2026-57257 is a memory safety flaw in Foxit PDF Editor and Reader that crashes the application when processing a specially crafted PDF file. The vulnerability stems from insufficient validation of entity indices during PRC (a PDF internal format) parsing, allowing an attacker to read memory beyond array boundaries. When a user opens a malicious PDF, the application crashes due to an out-of-bounds read, resulting in a denial of service. This is a local attack that requires user interaction—the victim must open the malicious file.

• CVE-2026-57258MEDIUM 6.1

  A vulnerability in PRC file parsing affects Foxit PDF Editor and Reader, as well as certain Windows and macOS systems. The issue stems from unsafe handling of file structure metadata: when a PRC file is opened, the application trusts the header information describing the file's array layout without validating it. An attacker can craft a malicious PRC file with misleading structure data that causes the application to read beyond allocated memory boundaries. This leads to crashes and potential information disclosure. User interaction is required—the victim must open the specially crafted file.

• CVE-2026-57454MEDIUM 6.1

  Vim versions 9.2.0320 through 9.2.0678 contain a memory safety flaw in how they handle undo and swap files. When a crafted file contains specially malformed virtual-text properties—metadata that Vim uses to annotate text—the editor fails to validate that the offset and length values actually point to valid memory locations. This causes Vim to read data outside the intended memory region, potentially crashing the application or exposing sensitive information from adjacent heap memory. The vulnerability is triggered when a user opens or restores such a malicious file, making it a user-interaction risk rather than a network-based threat.

• CVE-2026-5793MEDIUM 6.1

  BiEticaret, an e-commerce platform by Inrove Software and Internet Services, contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. When a user clicks a crafted link, the attacker's code executes in the victim's browser within the context of the BiEticaret application, potentially stealing session tokens, redirecting to phishing pages, or performing unauthorized actions on behalf of the user. Versions before 3.3.57 are affected.

• CVE-2026-57958MEDIUM 6.1

  Mixpost, a social media management platform, contains a reflected cross-site scripting (XSS) vulnerability in its OAuth callback handling. An attacker can craft a malicious callback URL with specially crafted error parameters that, when clicked by an authenticated user, executes arbitrary JavaScript in that user's browser. This can lead to session hijacking or unauthorized actions performed on behalf of the victim. The vulnerability affects Mixpost versions through 2.6.0 and requires no authentication to exploit, though the attack depends on tricking a logged-in user into clicking a malicious link.

• CVE-2026-58030MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Wikimedia Foundation's SyntaxHighlight_GeSHi extension, which is used to display colored code syntax highlighting on MediaWiki installations. The flaw allows an attacker to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper sanitization of user input in the SyntaxHighlight.php file before it is rendered in HTML. An attacker would need to trick a user into visiting a malicious wiki page or clicking a crafted link, but once triggered, the injected script executes in the victim's browser within the context of the MediaWiki site. This could allow theft of session cookies, credential harvesting, defacement, or redirection to malicious sites.

• CVE-2026-58032MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in MediaWiki's JavaScript API module that can allow attackers to inject malicious code into web pages viewed by other users. An attacker would need to trick a user into clicking a link or visiting a malicious page, but once executed, the injected script runs in the victim's browser with the permissions of the legitimate MediaWiki site. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

• CVE-2026-58037MEDIUM 6.1

  MediaWiki contains a cross-site scripting (XSS) vulnerability in multiple logging and language components. An attacker can inject malicious scripts into log entries or language-related output that execute in the browsers of users viewing those pages, potentially stealing session tokens, performing actions on behalf of logged-in users, or redirecting them to malicious sites. User interaction is required—the victim must view a page containing the injected payload—but no special permissions are needed to exploit this flaw.

• CVE-2026-58038MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Wikimedia Foundation's timeline component that allows attackers to inject malicious scripts into web pages. The flaw stems from improper validation of user input during page generation, affecting the Timeline.php file and EasyTimeline.pl script. An attacker can craft a malicious timeline input that, when rendered in a victim's browser, executes arbitrary JavaScript in the context of the wiki site. This requires user interaction—specifically, a victim must view or interact with a page containing the malicious timeline—but does not require authentication to exploit.

• CVE-2026-58291MEDIUM 6.1

  Microsoft Edge (Chromium-based) contains a flaw that allows attackers to access sensitive information through a network when specific conditions are met. The vulnerability stems from the application attempting to use a resource—such as memory or a file handle—after it has been released or expired. An attacker would need to trick a user into taking an action, but if successful, could potentially read confidential data without modifying or disrupting systems. This is classified as a medium-severity issue.

• CVE-2026-58303MEDIUM 6.1

  A stack-based buffer overflow has been discovered in Samsung Open Source Escargot, a JavaScript engine. The vulnerability allows an attacker to write data beyond the bounds of allocated stack memory, potentially causing application crashes or enabling localized code execution. Because exploitation requires user interaction (such as opening a malicious file or visiting a compromised website), the risk is somewhat contained, though the impact can be significant depending on how Escargot is deployed.

• CVE-2026-58304MEDIUM 6.1

  Samsung's Escargot JavaScript engine contains a memory safety vulnerability that allows an attacker to read from or write to memory locations outside the intended buffer boundaries. An attacker with local access who tricks a user into opening a malicious file or visiting a compromised page can trigger the overflow, potentially crashing the application or modifying memory to achieve unintended behavior. This is not currently a known exploited vulnerability in the wild.

• CVE-2026-58305MEDIUM 6.1

  Samsung's Escargot, an open-source JavaScript engine, contains a type confusion vulnerability that allows an attacker to manipulate memory pointers. The flaw requires local access and user interaction (such as opening a malicious file or visiting a compromised page), but once triggered, it can cause application crashes or data corruption. This is a memory safety issue stemming from improper type handling during resource access.

• CVE-2026-58306MEDIUM 6.1

  A heap-based buffer overflow has been identified in Samsung's open-source Escargot JavaScript engine. The vulnerability allows an attacker to overflow memory buffers during processing, potentially leading to application crashes or data corruption. Exploitation requires local access and user interaction, such as opening a malicious file or visiting a crafted webpage. The issue has been patched as of commit ef525f337fafddecde77a3c426212a84bb20cb98.

• CVE-2026-58307MEDIUM 6.1

  CVE-2026-58307 is a memory safety flaw in Samsung's Escargot JavaScript engine that allows an attacker to read past the end of a buffer and trigger an assertion failure. By crafting malicious input and requiring user interaction (such as opening a file or visiting a page), an attacker can cause the application to crash or potentially disclose sensitive data. The vulnerability is rated medium severity because it requires local access and user engagement, but the availability impact is substantial.

• CVE-2026-58381MEDIUM 6.1

  GIMP, a widely used open-source image editor, contains a memory safety bug in its PSP (PaintShop Pro) file parser. When GIMP opens a specially crafted PSP file, a programming error causes the application to attempt to free the same memory block twice—a condition known as a double-free. This can corrupt the application's memory state, crash the program, or in some cases allow an attacker to execute arbitrary code on the system. The vulnerability requires local file access and user interaction (opening the malicious file), limiting but not eliminating real-world risk.

• CVE-2026-58520MEDIUM 6.1

  A vulnerability in Mediawiki's UrlShortener Extension allows attackers to craft malicious URLs that redirect users to untrusted websites. When a user visits a shortened link generated by the extension, they may be sent to a phishing site, malware distribution point, or other malicious destination without clear warning. The vulnerability affects versions before 1.43.9, 1.44.6, and 1.45.4.

• CVE-2026-59710MEDIUM 6.1

  Showdown, a popular markdown-to-HTML converter, contains a stored cross-site scripting (XSS) vulnerability in how it processes table headers. When markdown containing malicious content is rendered using the default GitHub flavor configuration, an attacker can inject arbitrary HTML and JavaScript-executing SVG elements through specially crafted double-quote characters in table header text. Once injected, the malicious code persists in the rendered output and executes in the browsers of anyone viewing the content. This is particularly dangerous in applications that accept user-submitted markdown and display it to other users without sanitization.

• CVE-2026-59711MEDIUM 6.1

  Showdown, a popular markdown-to-HTML converter, has a cross-site scripting (XSS) vulnerability in how it handles metadata titles. When a specific option (completeHTMLDocument) is turned on, the library fails to properly escape special characters in markdown frontmatter metadata before inserting them into HTML title tags. An attacker can craft a markdown document with malicious code in the metadata that, when processed, breaks out of the title context and executes JavaScript in users' browsers. The vulnerability requires user interaction—someone must process the attacker's markdown—but can affect any application using Showdown with this option enabled.

• CVE-2026-59890MEDIUM 6.1

  setuptools, a core Python package management tool, contains a vulnerability in how it handles file exclusion rules when building source distributions. On macOS systems using APFS or HFS+ filesystems, attackers or malicious developers can bypass intended file exclusion directives by exploiting Unicode normalization differences. Specifically, files named with decomposed Unicode characters (NFD form) can be packed into distributed Python packages even when exclusion rules target the composed form (NFC). This allows sensitive or malicious files to be included in source distributions when they should have been excluded, potentially affecting downstream package users.

• CVE-2026-59895MEDIUM 6.1

  Hono, a JavaScript framework for building web applications, contains a flaw in its CSS class composition utility (cx() function) that fails to properly sanitize user-supplied class names during server-side rendering. When untrusted input is passed as a class attribute in JSX, an attacker can break out of the attribute context and inject arbitrary HTML markup into the rendered page. This occurs because the function marks its output as safe HTML without actually escaping the input strings. The vulnerability affects Hono versions 4.0.0 through 4.12.26 and has been patched in version 4.12.27.

• CVE-2026-59923MEDIUM 6.1

  Mistune, a widely-used Python library for converting Markdown to HTML, contains a flaw in how it validates links and image URLs. An attacker can craft Markdown that includes specially encoded JavaScript commands disguised in percent-encoded format. When a user renders this malicious Markdown through Mistune versions before 3.3.0, the library fails to block these hidden scripts, allowing them to execute in the browser. This affects any application that accepts user-supplied Markdown and displays the rendered output to other users.

• CVE-2026-59926MEDIUM 6.1

  Mistune, a popular Python library for converting Markdown into HTML, has a vulnerability in how it handles formatting directives. When users include special formatting instructions (called admonitions) in Markdown, the library failed to properly clean certain styling options before adding them to the generated HTML. This oversight allows an attacker to inject malicious code that could compromise website visitors' browsers, even if the site owner thought they had protective settings turned on. The issue affects Mistune versions before 3.2.1.

• CVE-2026-59929MEDIUM 6.1

  Mistune, a popular Python Markdown parser, contains a vulnerability in its URL sanitization logic that fails to block certain legacy and less-common URL schemes. While it successfully blocks javascript:, vbscript:, file:, and data: URLs, attackers can bypass this protection by using alternative schemes like feed:, view-source:, jar:, or others to inject malicious links into rendered HTML. When users click these links or the content is processed by certain browsers, script execution may occur. This affects Mistune versions prior to 3.3.0.

• CVE-2026-59946MEDIUM 6.1

  Composer, the PHP dependency manager, has a path traversal vulnerability in how it handles binary entry points during package installation. When a package specifies a bin entry with path segments like (..), Composer can be tricked into modifying files outside the package directory, changing their permissions to world-readable and world-executable. This happens automatically during composer install, update, or require commands. An attacker could craft a malicious package to expose sensitive files or make system binaries world-writable, creating a foothold for privilege escalation or information disclosure on affected systems.

• CVE-2026-60092MEDIUM 6.1

  AVideo's Meet plugin contains a stored cross-site scripting (XSS) vulnerability that allows an unauthenticated attacker to inject malicious JavaScript into the Participants management panel. An attacker can join any public meeting while supplying a crafted User-Agent header containing HTML and JavaScript code. This payload is saved to the database without sanitization and later displayed without encoding when the meeting host or site administrator views the participant list, causing the attacker's code to execute in their authenticated browser session. The vulnerability requires user interaction (opening the Participants panel) but affects a privileged user, making it a serious risk for meeting organizers and administrators.

• CVE-2026-7380MEDIUM 6.1

  Armiya Information Technologies' Access Control System (GKS) contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. An attacker can craft a specially designed URL or web page that, when visited by a user, executes JavaScript code in the victim's browser within the context of the GKS application. This could enable credential theft, session hijacking, or unauthorized actions performed on behalf of the victim. The vulnerability requires user interaction—a victim must click a malicious link or visit an attacker-controlled page—but the attacker does not need authentication to exploit it.

• CVE-2026-7660MEDIUM 6.1

  The Easy Updates Manager WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability in its pagination feature. Attackers can craft malicious links that inject JavaScript code into pages. When a WordPress administrator clicks such a link, the injected script executes in their browser with their privileges, potentially allowing attackers to steal credentials, modify site content, or perform unauthorized actions. The vulnerability affects versions 9.0.20 and earlier.

• CVE-2026-8059MEDIUM 6.1

  IBM Datacap and IBM Datacap Navigator versions 9.1.7, 9.1.8, and 9.1.9 contain a cross-site scripting (XSS) vulnerability in their Web UI. An unauthenticated attacker can inject malicious JavaScript code that executes in the browser of a legitimate user, potentially stealing credentials or modifying the application's behavior without the user's knowledge.

• CVE-2026-8306MEDIUM 6.1

  A stored cross-site scripting (XSS) vulnerability exists in Armiya Information Technologies' Access Control System (GKS) that allows attackers to inject malicious scripts into the application. Unlike reflected XSS attacks that require tricking a user into clicking a link, this vulnerability persists in the system, meaning any user who views the affected page will execute the attacker's code. The vulnerability requires network access and user interaction but does not demand special privileges to exploit.

• CVE-2026-8310MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in Webbeyaz Web Design's Mediküm Web product. An attacker can craft a malicious link that, when clicked by a user, executes arbitrary JavaScript in the victim's browser within the context of the Mediküm Web application. This allows theft of session cookies, credential harvesting, or malware injection. The vulnerability affects all versions through 08072026. Notably, the vendor has indicated the product is no longer supported, meaning no patches are expected.

• CVE-2026-8403MEDIUM 6.1

  SYSGUARD 6001, a security appliance from Eksagate Electronic Engineering and Computer Industry Trade Inc., contains a stored cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages served by the product. Once injected, these scripts execute in the browsers of users who access the affected pages, potentially stealing credentials, session tokens, or sensitive information. The vulnerability affects versions 2.0.2 through 6.1.3.x; version 6.1.4.0 and later are patched. A critical concern: the vendor has confirmed this product line is no longer supported, meaning no further security updates or vendor assistance should be expected.

• CVE-2026-8622MEDIUM 6.1

  The Image Sizes on Demand WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability affecting all versions through 1.3. An attacker can craft a malicious link that, when clicked by an administrator, executes arbitrary JavaScript in their browser session. The vulnerability stems from improper handling of the PHP_SELF server variable on the plugin's settings page, which fails to sanitize or escape user input. Because execution requires administrator interaction and is limited to admin context, the risk is moderate—but any successful attack grants the attacker the ability to perform administrative actions on the WordPress site.

• CVE-2026-8628MEDIUM 6.1

  The EntreDroppers WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into web pages. An attacker can craft a malicious URL and trick users into clicking it; when clicked, the injected script executes in the victim's browser within the context of the WordPress site. The flaw exists because the plugin fails to properly sanitize and escape the PHP_SELF variable, which is directly reflected into HTML form attributes without protection. All versions through 1.1.2 are affected.

• CVE-2026-8905MEDIUM 6.1

  The Osiris Signature Banner plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting all versions up to and including 0.5. An attacker can craft a malicious link or webpage that, when clicked by a logged-in site administrator, allows the attacker to change plugin settings and inject malicious scripts into the site without the administrator's knowledge or consent. The attack requires social engineering—tricking an admin into clicking a link—but once successful, it can compromise site integrity and inject persistent malicious content.

• CVE-2026-8907MEDIUM 6.1

  WP-Ultimate-Map, a WordPress plugin for displaying maps, has a security flaw that allows attackers to secretly change plugin settings and inject malicious code. The vulnerability exists because the plugin doesn't properly verify that setting changes are legitimate (a technique called CSRF protection), and doesn't clean up user input before displaying it. An attacker can trick a site administrator into clicking a malicious link, which would silently alter map zoom levels or other settings and potentially inject JavaScript that runs when the admin visits the plugin's settings page.

• CVE-2026-8910MEDIUM 6.1

  The WP Emoticon Rating plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 1.0.1. An attacker can craft a malicious link or webpage that, when clicked by an authenticated site administrator, performs unauthorized actions—specifically updating plugin settings and injecting malicious scripts. The vulnerability stems from inadequate nonce validation, a WordPress security mechanism that prevents unauthorized automated requests. Exploitation requires social engineering; the attacker cannot directly attack the site but must trick an admin into visiting a crafted page.

• CVE-2026-8916MEDIUM 6.1

  Samsung's rlottie library—an open-source animation renderer—contains a flaw that allows attackers to write data beyond the boundaries of allocated memory buffers. The vulnerability requires local access and user interaction (such as opening a crafted animation file), but once triggered, can corrupt memory and cause the application to crash or behave unpredictably. This is classified as a medium-severity issue because exploitation requires the victim to actively engage with untrusted animation content on their own system.

• CVE-2026-9280MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in the Ad Inserter – Ad Manager & AdSense Ads WordPress plugin affecting all versions up to 2.8.15. The flaw allows attackers to inject malicious scripts into web pages by crafting a deceptive link. If a user clicks the link while viewing a page with the plugin's iframe mode enabled, the attacker's script executes in their browser. This attack requires no special permissions and relies on social engineering to succeed.

• CVE-2026-9838MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in the ICS Calendar WordPress plugin affecting all versions up to 12.0.9. An attacker can inject malicious JavaScript by crafting a specially designed link and tricking a user into clicking it. The vulnerable code path is reachable through an unauthenticated AJAX action that fails to properly sanitize user input before displaying it in the page. If successful, the injected script executes in the victim's browser with their privileges, potentially allowing the attacker to steal session cookies, perform actions on their behalf, or redirect them to malicious sites.

• CVE-2025-2669MEDIUM 6.0

  IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data contain a token validation flaw that allows privileged users to exceed their intended permissions. A user with elevated credentials can bypass authorization controls to perform unauthorized operations and access sensitive data they shouldn't be able to reach. The vulnerability requires existing elevated privileges to exploit, limiting the immediate attack surface but posing significant risk to organizations where privileged accounts may be compromised or where insider threats are a concern.

• CVE-2026-13752MEDIUM 6.0

  Snowflake CLI versions before 3.19 contain a flaw that fails to properly validate user-supplied input, allowing attackers to inject and execute arbitrary SQL commands within a user's Snowflake database session. An attacker could trick users into running malicious commands, modify repository configurations with crafted values, or compromise automation scripts to exploit this vulnerability. The risk is confined by the privileges of the affected user account—a read-only user would face lower impact than an account with write or administrative permissions.

• CVE-2026-13773MEDIUM 6.0

  IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 contain a deserialization flaw in approximately 50 auto-generated CORBA stub classes within the ogclient.jar file. When application code deserializes untrusted data using ObjectInputStream, an attacker can inject a malicious IOR (Interoperable Object Reference) string that causes the application to make outbound network connections to an attacker-controlled host. This server-side request forgery (SSRF) becomes particularly dangerous when combined with a separate flaw in IBM's Object Request Broker (ORB) that allows arbitrary class instantiation, potentially leading to remote code execution on the vulnerable JVM.

• CVE-2026-20246MEDIUM 6.0

  Cisco Umbrella Virtual Appliance contains a privilege escalation flaw in its vmadmin command-line interface. An authenticated attacker with vmadmin-level access can run specially crafted commands to gain full root privileges on the device. The vulnerability stems from insufficient input validation and requires local access and existing elevated privileges to exploit, limiting its immediate blast radius but creating a critical post-compromise risk for affected deployments.

• CVE-2026-25620MEDIUM 6.0

  A command injection flaw exists in Arista's Next Generation Firewall (NGFW) captive portal feature, allowing a high-privilege user to inject commands through what should be an encrypted password field. The vulnerability is present only in version 17.4.0. While it requires authenticated administrative access to exploit, successful attacks could compromise system integrity and confidentiality.

• CVE-2026-25621MEDIUM 6.0

  Arista's Edge Threat Management NGFW version 17.4.0 contains a weakness in how its Reports application validates user input. An authenticated attacker with high-level permissions could potentially inject malicious commands through the Reports interface, leading to unauthorized access to sensitive data or limited system integrity compromise. Earlier versions are not affected.

• CVE-2026-25622MEDIUM 6.0

  A vulnerability in Arista's Next Generation Firewall (NGFW) allows an authenticated administrator to inject arbitrary shell commands through the Captive Portal Custom Handler feature. An attacker with valid admin credentials can exploit improper input validation to execute system-level commands on the firewall, potentially compromising the security appliance itself.

• CVE-2026-25623MEDIUM 6.0

  Arista's Next Generation Firewall (NGFW) contains a command execution vulnerability in its browser-based management interface. An authenticated administrator with legitimate access to the firewall's web console can inject malicious input into the management pipeline, allowing them to execute arbitrary operating system commands on the underlying system. This bypasses normal administrative controls and grants attacker-level terminal access.

• CVE-2026-28262MEDIUM 6.0

  Dell iDRAC Tools versions before 11.4.1.0 contain a symlink-following vulnerability that allows a low-privileged user with local system access to tamper with files on the affected system. An attacker would need to already have some level of local access and user interaction to exploit this, making it a localized threat rather than a remotely exploitable vulnerability. The primary risk is unauthorized modification of system or application data rather than information disclosure.

• CVE-2026-42998MEDIUM 6.0

  OpenStack Keystone contains an authentication bypass vulnerability in its application credential system. An attacker with valid credentials can request a token while impersonating another user by manipulating the user identity in the authentication request. Keystone fails to validate that the requesting user owns the application credential being used, allowing the attacker to obtain a token attributed to a victim account. The token grants access only to projects shared between the attacker and victim, and only with roles that overlap between both users' permissions, but this is still sufficient for account takeover scenarios and audit trail manipulation.

• CVE-2026-42999MEDIUM 6.0

  OpenStack Keystone contains a critical authorization bypass vulnerability that allows any authenticated user to escalate their privileges and access resources belonging to other users or projects. The vulnerability stems from a flaw in how Keystone processes policy enforcement—it blindly merges user-supplied JSON request data into the authorization check dictionary, overwriting the trusted database-sourced security context. This means an attacker can simply inject fake user IDs or project IDs into their API request to trick the system into granting them permissions they shouldn't have. The issue affects all versions before 29.0.2 and has existed since Rocky (14.0.0).

• CVE-2026-43000MEDIUM 6.0

  An authenticated attacker with basic member-level permissions on an OpenStack Keystone project can escalate their privileges to administrator by chaining two Keystone features—application credentials and trusts—in an unintended way. The attack exploits a validation gap: when an impersonated token is created, Keystone checks the victim's stored admin role assignment in the database rather than validating against the actual permissions on the requesting token. This allows the attacker to create a trust that delegates the victim's admin privileges to themselves. The resulting admin access persists independently and can be maintained through additional credential chains, while all actions appear in audit logs under the victim's identity.

• CVE-2026-44273MEDIUM 6.0

  Dell Wyse Management Suite before version 2605 contains a default credentials vulnerability that allows a high-privileged local user to access sensitive information. An attacker already holding elevated administrative privileges on the system could use hardcoded or default credentials to bypass authentication controls and obtain confidential data stored within the management suite. This is not a network-accessible vulnerability and requires both local system access and high-level privileges to exploit.

• CVE-2026-44394MEDIUM 6.0

  OpenStack Keystone, the identity service underlying many cloud deployments, has a flaw in how it handles federated user logins through SAML2 or OpenID Connect. When a user rescopes a token (essentially asking for a new token with different permissions or projects), the system doesn't carry forward the original token's expiration time. Instead, it issues a fresh token with a standard lifetime. An attacker with valid federated credentials can exploit this by repeatedly rescoping their token just before it expires, effectively creating a token that never truly expires. This bypasses the organization's configured token lifetime policies, allowing indefinite access once initial compromise occurs.

• CVE-2026-46768MEDIUM 6.0

  A denial-of-service vulnerability exists in Oracle VM VirtualBox 7.2.8 that allows a high-privileged user with local access to crash or hang the hypervisor. The issue resides in the VMSVGA device component and requires administrator-level credentials to trigger, but when exploited, can render the virtualization platform unavailable and potentially affect guest virtual machines. The vulnerability does not compromise data confidentiality or integrity—it is purely an availability threat.

• CVE-2026-46825MEDIUM 6.0

  CVE-2026-46825 is a medium-severity vulnerability in Oracle VM VirtualBox 7.2.8 affecting the VMSVGA device driver. A user with high system privileges can modify or delete critical data within VirtualBox or data accessible through it. The vulnerability requires local access and elevated privileges to exploit, but can impact not only VirtualBox itself but also systems and data it manages. Oracle has classified this as a scope-change issue, meaning an attacker could potentially affect resources beyond VirtualBox's immediate boundary.

• CVE-2026-46877MEDIUM 6.0

  A vulnerability in Oracle VM VirtualBox version 7.2.8 allows an administrator or highly privileged user on the host system to read sensitive data from the virtual machine. The flaw is in the VMSVGA graphics device component. An attacker would need administrative-level access to the infrastructure running VirtualBox, but from that position can extract confidential information that VirtualBox can access. The vulnerability does not enable attackers to modify or delete data, nor does it crash the system.

• CVE-2026-47375MEDIUM 6.0

  NocoDB, a spreadsheet-like database-building platform, contains a SQL injection vulnerability that allows authenticated users to run arbitrary database commands. An attacker with permission to add columns can exploit the ARRAYSORT function's direction parameter to inject malicious SQL code. Once injected, the code executes both when the column is created and every time records are read from that column. This only affects Postgres databases and has been patched in version 2026.04.1.

• CVE-2026-48529MEDIUM 6.0

  GitHub MCP Server versions 0.22.0 through 1.1.1 contain a critical session isolation flaw when running in HTTP mode with lockdown mode enabled. The server caches GraphQL credentials from the first authenticated user and reuses those credentials for all subsequent users, meaning later users' lockdown-related queries execute under the initial user's permissions rather than their own. This breaks the intended access control boundary and allows users to inadvertently access resources they shouldn't see.

• CVE-2026-55748MEDIUM 6.0

  OpenStack Horizon, the web-based dashboard for OpenStack cloud infrastructure, contains a vulnerability in how it generates RC (resource credential) files for download. When an OpenStack project has a name containing shell metacharacters—such as backticks, dollar signs, or pipes—the generated script may inadvertently execute unintended commands when a user sources the RC file in their shell environment. This is a command injection risk that could be exploited if an attacker can influence or control a project name within an OpenStack deployment.

• CVE-2026-7253MEDIUM 6.0

  IBM Sterling B2B Integrator and IBM Sterling File Gateway contain a SQL injection vulnerability that requires an attacker to hold privileged user credentials. Once authenticated, a malicious insider or compromised privileged account can craft SQL statements to read, insert, modify, or delete data directly from the backend database. This is a classic database access control failure that elevates an authenticated user's power far beyond their intended scope.