By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 18 of 41

• CVE-2026-57943MEDIUM 5.9

  LibrePhotos versions before 1.0.0 contain an authorization flaw that lets authenticated users view other people's private photos. The vulnerability exists in the SetPhotosShared endpoint, where the application fails to properly verify that only a photo's owner can change who it's shared with. An attacker with a valid LibrePhotos account can manipulate the sharing settings to grant themselves access to private photos belonging to any other user on the system, effectively reading arbitrary private image collections without permission.

• CVE-2026-57959MEDIUM 5.9

  Hi.Events versions through 1.9.0 contain a flaw in how promo codes are validated during ticket reservations. When a customer applies a limited-use promo code at checkout, the system checks how many times it's been used—but this check happens before a background job updates the usage counter. An attacker can exploit this timing gap by sequentially reserving multiple orders with the same restricted code. Each reservation sees the counter at zero and passes validation, even though previous reservations should have incremented it. By completing these reservations one after another (not simultaneously), attackers can redeem a single-use or limited-use promo code many times, obtaining tickets at a discount that should only apply once.

• CVE-2026-58015MEDIUM 5.9

  A security flaw in GLib's D-Bus SASL authentication allows a malicious D-Bus server to trick a client into reading arbitrary files from the system. During the DBUS_COOKIE_SHA1 authentication handshake, the server sends a cookie context parameter that the client does not properly validate. An attacker can embed path traversal sequences in this parameter to force the client to read sensitive files and leak their contents by comparing file data against cryptographic hashes. The attack requires network access and some guessing, but succeeds without user interaction.

• CVE-2026-58471MEDIUM 5.9

  GNU Wget, a widely-used command-line download utility, contains a heap buffer overflow vulnerability in how it processes filenames from remote servers when character set conversion is needed. An attacker controlling a web or FTP server could craft a malicious filename that causes Wget to write beyond allocated memory boundaries, potentially crashing the application or corrupting memory. The vulnerability requires specific conditions: the filename must need character conversion, and user interaction is typically involved (such as accepting a download prompt). The issue was introduced in the filename conversion logic and has been patched in the project's main development branch.

• CVE-2026-58472MEDIUM 5.9

  GNU Wget versions through 1.25.0 contain a critical memory safety flaw in how they process HTML attributes from remote servers. When Wget downloads a webpage containing specially crafted HTML attributes with many characters that need encoding, an internal counter can overflow. This causes the program to allocate less memory than needed, and subsequently writes data beyond the allocated buffer. An attacker can exploit this by hosting malicious HTML that triggers the overflow when Wget parses it, potentially causing the application to crash or allowing code execution in limited scenarios.

• CVE-2026-58501MEDIUM 5.9

  Zeep, a popular Python library for consuming SOAP web services, has a configuration bypass vulnerability affecting versions 4.0.0 through 4.3.2. The library includes a security setting called forbid_external designed to prevent risky automatic fetching of external resources during WSDL and XSD parsing, but this setting is not actually enforced. An attacker can bypass this protection by crafting malicious SOAP schema documents that include references to external XML resources. When a vulnerable application parses these documents, Zeep will automatically fetch attacker-controlled URLs over HTTP or HTTPS without respecting the forbid_external setting, potentially exposing sensitive information or enabling further attacks. The issue is resolved in version 4.3.3.

• CVE-2026-58580MEDIUM 5.9

  LobeChat server deployments up to version 2.2.9 contain an authorization flaw that allows authenticated users to tamper with other users' message metadata. If an attacker learns another user's message ID, they can modify that user's plugin tool settings, error states, text-to-speech configurations, and translation records. The victim would then receive corrupted or attacker-controlled content when accessing their own messages. This is a localized instance attack—it affects users sharing the same LobeChat deployment.

• CVE-2026-59924MEDIUM 5.9

  Mistune, a popular Python Markdown parser, contains a path traversal vulnerability in its Include.parse() function. When processing markdown files that reference external files via include statements, the parser fails to properly validate that included file paths remain within the intended markdown directory. An attacker can craft specially designed include paths to escape the intended directory and read arbitrary files from the system. The vulnerability affects Mistune versions prior to 3.3.0 and is resolved in version 3.3.0 and later.

• CVE-2026-59999MEDIUM 5.9

  OpenSSH versions before 10.4 contain a logic error where the DisableForwarding security setting fails to properly override the PermitTunnel setting. Administrators who configured DisableForwarding=yes expecting to block all forwarding features would find that tunnel functionality remains active if PermitTunnel was also enabled, potentially exposing the system to unauthorized network tunneling.

• CVE-2026-7850MEDIUM 5.9

  The WP Magnific Popup WordPress plugin up through version 1.0 contains a stored cross-site scripting (XSS) vulnerability in its image error handling. An authenticated user with Author-level permissions or higher can inject malicious JavaScript into image load error messages. Because the plugin fails to properly escape URLs before displaying them in the page, the injected code executes in the browsers of any site visitor, including administrators. This is a persistence risk: the malicious payload stays in the database and re-executes every time the affected page loads.

• CVE-2026-9320MEDIUM 5.9

  IBM WebSphere Application Server versions 9.0 and 8.5, along with WebSphere Liberty versions 17.0.0.3 through 26.0.0.6, contain a denial-of-service vulnerability triggered by specially-crafted network requests. An attacker can exploit this remotely without authentication to exhaust server memory, causing service degradation or outages. The vulnerability does not compromise confidentiality or integrity—its impact is purely on availability.

• CVE-2026-9678MEDIUM 5.9

  Undici, a popular Node.js HTTP client library, has a flaw in its caching mechanism that can cause it to incorrectly store and serve cached responses containing sensitive user data. The vulnerability exists when the cache interceptor is enabled in shared-cache mode and an upstream server uses improperly formatted Cache-Control directives—specifically, field names with surrounding whitespace like ` private="authorization"` instead of the standard `private="authorization"`. Because the parser preserves that whitespace, the library fails to recognize that the response should not be cached, and may serve cached authentication data to subsequent requests, potentially exposing one user's credentials or session information to another user or an unauthenticated caller. This only affects applications that have explicitly enabled shared caching, forward Authorization headers, and receive such malformed directives from upstream servers.

• CVE-2026-9679MEDIUM 5.9

  Undici, a popular Node.js HTTP client library, contains a cookie parsing flaw that incorrectly decodes percent-encoded characters in Set-Cookie headers. When applications use undici's cookie parsing functions and then forward the parsed values into HTTP response headers—a common pattern in proxies, middleware, and server-side rendering frameworks—attackers can inject malicious headers into downstream responses. This enables session hijacking, open redirects, or cache poisoning attacks. The vulnerability affects undici versions 7.0.0 through 7.27.x and 8.0.0 through 8.4.x.

• CVE-2026-9793MEDIUM 5.9

  Keycloak has a vulnerability in how it handles encrypted OpenID Connect requests. When a JWE-encrypted request object arrives, Keycloak may skip signature verification on the decrypted JSON claims, allowing an attacker to inject unauthorized claims into the OIDC authorization flow. This bypasses a key security control designed to ensure claims haven't been tampered with. The vulnerability is classified as medium severity because while it compromises data integrity, exploitation requires specific conditions and the redirect URI allowlist provides some defense-in-depth protection.

• CVE-2026-10517MEDIUM 5.8

  Clair, a container image scanning tool, has a server-side request forgery (SSRF) vulnerability in its fetcher component. When processing container manifests, Clair can be tricked into making HTTP requests to attacker-controlled URLs without proper validation. An attacker who is unauthenticated can submit a malicious manifest pointing to internal services or cloud metadata endpoints, causing Clair to reach out to those targets. When the request fails, error messages leak up to 256 bytes of the response, potentially exposing sensitive information like API credentials or internal configuration. Red Hat Quay deployments that are operator-managed are automatically protected because they enable pre-shared key (PSK) authentication by default; self-managed Clair installations without PSK are at risk.

• CVE-2026-13976MEDIUM 5.8

  A flaw in how Google Chrome handles data validation within its storage system creates a pathway for attackers who have already compromised the browser's renderer process to potentially break out of Chrome's security sandbox. The vulnerability requires an attacker to serve a specially crafted HTML page and relies on user interaction, making it a multi-step attack rather than something triggering automatically. Chrome versions before 150.0.7871.47 are vulnerable.

• CVE-2026-44046MEDIUM 5.8

  Apache APISIX contains a vulnerability in its wolf-rbac plugin that allows an attacker to inject false identity information into logs and bypass IP-based access controls. The plugin uses insufficiently trusted data sources to make security decisions, enabling an attacker to spoof their identity and potentially circumvent network-level access restrictions. This affects versions 1.2.0 through 3.16.0 and is resolved in version 3.17.0.

• CVE-2026-46447MEDIUM 5.8

  OpenStack Ironic versions before 35.0.2 contain a vulnerability that allows an attacker with elevated privileges to inject malicious iPXE boot scripts by modifying node configuration data. An attacker who can alter the driver_info or instance_info fields of a node can supply a specially crafted iPXE script that will execute during the boot process, potentially compromising the integrity of deployed systems. This attack requires authenticated access with administrative or operator-level permissions, but once achieved, can affect multiple systems across a cloud environment.

• CVE-2026-46467MEDIUM 5.8

  Dell PowerProtect Data Domain contains a flaw that causes sensitive information to be written to log files where it should not be. An attacker with local system access and limited privileges could read these logs to obtain confidential data. This is a local-access vulnerability—the attacker must already have a foothold on the affected system.

• CVE-2026-46552MEDIUM 5.8

  NocoDB, a database-as-spreadsheet application, contains a flaw in how it enforces access control for shared bases. An attacker who obtains a shared-base link identifier (xc-shared-base-id) can impersonate a legitimate viewer, enumerate the members of that database, and send invitations to arbitrary email addresses. Those invitations, when accepted, grant persistent authenticated access to the database—access that persists even if the original shared link is revoked. The vulnerability stems from the application failing to distinguish between genuine authenticated users and those accessing via a shared session, allowing the latter to perform actions restricted to real members.

• CVE-2026-46690MEDIUM 5.8

  A memory safety vulnerability exists in unbounded_spsc versions 0.2.0 and earlier, a Rust library for lock-free message passing. The flaw occurs when the sender transmutes a pointer as a value and then sends it, which can cause the receiver to read memory outside the intended bounds or incorrectly drop a reference-counted object if the sender and receiver operate concurrently. This could lead to information disclosure or denial of service. No public patches are currently available.

• CVE-2026-48821MEDIUM 5.8

  Shaarli, a self-hosted bookmarking application, has a cross-site scripting (XSS) vulnerability in its thumbnail synchronization feature affecting versions 0.16.1 and earlier. When administrators use the thumbnail update tool, the system retrieves bookmark data from the server and displays it on the page without properly cleaning the content first. An attacker who controls bookmark titles can inject malicious scripts that execute when an administrator runs the thumbnail sync. The scripts run with the administrator's permissions, potentially allowing unauthorized access to accounts, elevation of privileges, or installation of persistent backdoors. The vulnerability has been patched in version 0.16.2.

• CVE-2026-48822MEDIUM 5.8

  Shaarli, a personal bookmarking service, contains a stored cross-site scripting (XSS) vulnerability in how it processes bookmark descriptions. An authenticated attacker can craft a specially-formatted bookmark that executes malicious JavaScript in the browsers of other users who view that bookmark. The vulnerability exists because the application's sanitization logic overlooks a specific Markdown syntax variant—reference-style links—allowing dangerous protocols like javascript: to slip through unfiltered. This affects versions 0.16.1 and earlier.

• CVE-2026-48982MEDIUM 5.8

  pam_usb is a Linux authentication system that uses removable media (like USB devices) as a hardware security token. The vulnerability exists in how pam_usb creates temporary files when updating its one-time pad—a counter that prevents the same authentication credential from being reused. The flaw: the temporary file is created without atomic guarantees, meaning two processes updating the pad simultaneously could both write to the file, with the second write erasing the first. This race condition could cause authentication failures or, in a worst-case scenario, create a window where an attacker could replay a previously-used credential. The issue is resolved in version 0.9.2.

• CVE-2026-48983MEDIUM 5.8

  pam_usb is a Linux authentication tool that uses USB devices or removable media as a hardware security key. A timing vulnerability allows a local attacker with basic user privileges to manipulate how the system creates directories that store authentication data. By exploiting a narrow window between the system checking if a directory exists and actually creating it, an attacker can trick pam_usb into writing sensitive authentication tokens to a location under their control. This could expose future authentication codes or prevent legitimate users from logging in. The vulnerability was fixed in version 0.9.2.

• CVE-2026-49129MEDIUM 5.8

  Music Player Daemon (MPD) versions before 0.24.11 contain a server-side request forgery (SSRF) vulnerability in its URL-fetching code. An attacker can craft a malicious HTTP server that redirects MPD to access protocols like FTP, LDAP, or others that the application should not reach. By triggering MPD commands that fetch remote content—such as adding tracks, reading metadata, or loading playlists—an attacker can probe or interact with internal network services on vulnerable systems, potentially exposing sensitive information or enabling further attacks. No authentication is required, and the attack works over the network.

• CVE-2026-50134MEDIUM 5.8

  Hugo, a popular static site generator, contains a vulnerability in its remote resource fetching mechanism that allows attackers to bypass URL access control policies through HTTP redirects. When a Hugo site is configured to restrict which servers it can fetch content from, an attacker who controls an allowed server (or compromises its DNS) can redirect Hugo to fetch from a forbidden server instead. Hugo will follow these redirects without re-checking them against the security policy, enabling data exfiltration or content injection from otherwise blocked hosts. This affects versions 0.91.0 through 0.161.x and is resolved in 0.162.0.

• CVE-2026-53723MEDIUM 5.8

  Guzzle Services, a popular PHP library for building API clients, has a flaw in how it writes untrusted data into XML requests. When an application serializes user-supplied input as XML element text (not attributes), an attacker can inject the string `]]>` to break out of the CDATA section and insert malicious XML elements. This only affects *outgoing* requests your application sends—not responses it receives. The attacker can manipulate what the downstream service sees, potentially bypassing security boundaries, injecting privileged fields, or creating duplicate elements. The fix is available in version 1.5.3 and later.

• CVE-2026-53944MEDIUM 5.8

  Ghost, a popular Node.js-based content management system, contains a vulnerability in versions 6.0.9 through 6.21.0 that allows attackers to bypass security filters intended to prevent requests to internal services. The flaw exploits IPv6 address formats that resolve to private IPv4 addresses, enabling an attacker to potentially access or interact with backend services that should be protected from external requests. This is a network-accessible vulnerability requiring no authentication, though the direct impact is limited to integrity violations rather than data exposure or service disruption.

• CVE-2026-54250MEDIUM 5.8

  K3s, a lightweight Kubernetes distribution, contains a path traversal vulnerability in how it handles compressed etcd snapshots. When an administrator restores a backup, a maliciously crafted zip file can write files to unintended locations on the filesystem. An attacker would need to supply a malicious snapshot file and have an administrator decompress it, but the impact could include overwriting system files or creating files in sensitive directories. This has been patched in versions 1.35.3+k3s1, 1.34.6+k3s1, and v1.33.10+k3s1.

• CVE-2026-54764MEDIUM 5.8

  Traefik's ForwardAuth middleware has a header validation flaw that allows attackers to spoof authorization checks. When an attacker sends a specially crafted HTTP request with a fake HTTPS header, Traefik incorrectly forwards a port number (443) to the authentication service—even when the actual connection is plain HTTP. This mismatch can trick the auth service into granting access to users who should be blocked based on port-level restrictions. The vulnerability exists because Traefik uses the attacker-controlled header instead of the actual connection details, bypassing the trustForwardHeader safety setting that administrators may have configured.

• CVE-2026-55430MEDIUM 5.8

  Coder, a platform for provisioning remote development environments, contains a host-header validation weakness in its workspace app proxy that allows an authenticated user to redirect traffic intended for one application to a different application within the same Coder deployment. An attacker can exploit this by crafting a malicious link to a shared app and manipulating the `X-Forwarded-Host` HTTP header—something JavaScript running in a browser can do natively. The vulnerability requires specific configuration (subdomain-based app routing) and depends on the upstream infrastructure not filtering this header. Versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 fix the issue by validating the header only from trusted proxies.

• CVE-2026-55438MEDIUM 5.8

  Coder, a platform for provisioning remote development environments, contains a CORS (Cross-Origin Resource Sharing) bypass vulnerability in its workspace app proxy. The flaw allows an attacker to craft a malicious URL that tricks the CORS validation logic into approving cross-origin requests it should reject. This only works when the workspace identifier in the subdomain can be parsed as a UUID and the attacker can convince an authenticated user to visit their crafted link. The vulnerability requires subdomain-based app routing to be enabled and direct user interaction—it does not represent a silent or automatic compromise. Coder has patched this in recent maintenance releases across all supported version branches.

• CVE-2026-55599MEDIUM 5.8

  phpseclib, a widely-used PHP library for cryptographic operations and secure communications, contains a server-side request forgery (SSRF) vulnerability in how it validates X.509 certificates. When an application uses phpseclib to validate a certificate, the library automatically fetches and connects to a URL embedded in the certificate's Authority Information Access extension—without any restrictions on where that URL points. An attacker who controls a malicious certificate can force a validating server to make connections to internal resources it should never reach, such as localhost services, cloud metadata endpoints, or internal-only infrastructure. This happens by default with no configuration required, making it a dangerous insecure default.

• CVE-2026-55706MEDIUM 5.8

  A flaw in OpenBSD's serialized-line-protocol (SPPP) implementation allows attackers on an adjacent network to bypass authentication by supplying specially crafted zero-length values during the PAP (Password Authentication Protocol) exchange. The vulnerability resides in the input validation logic of the sppp_pap_input function and requires local network access but no user interaction to exploit. Successful exploitation leads to unauthorized access to authenticated services, potentially compromising confidentiality, integrity, and availability.

• CVE-2026-55767MEDIUM 5.8

  Guzzle, a popular PHP HTTP client library, has a flaw in how it validates cookie attributes. The library incorrectly permits cookies with a domain attribute that is either completely empty or contains only whitespace, after normalization. When an attacker-controlled web server sets such a malformed cookie, Guzzle stores it and then sends it to any downstream host that the application requests using the same cookie jar—regardless of domain matching rules. This cookie injection could be leveraged for session fixation or other cookie-based attacks against services downstream from the vulnerable application.

• CVE-2026-57054MEDIUM 5.8

  Juniper Networks MX Series routers running Junos OS contain a flaw in their web filtering plugin that allows attackers to bypass security controls and reach restricted web resources. The vulnerability stems from improper name or URL resolution logic—specifically, if configured to block certain destinations, a specially crafted URL request can slip past the filter and reach downstream systems that should be inaccessible. An attacker on the network does not need authentication to exploit this, making it a straightforward attack vector for network-based threats.

• CVE-2026-57323MEDIUM 5.8

  A vulnerability in Flash & HTML5 Video versions 2.11.0 and earlier allows unauthenticated attackers to access restricted resources without proper permission checks. The flaw stems from broken access control logic that fails to enforce authentication requirements, potentially exposing sensitive video content or configuration data to unauthorized parties over a network. Exploitation does not require user interaction or special privileges.

• CVE-2026-59101MEDIUM 5.8

  AutoBangumi versions before 3.2.8 contain a server-side request forgery (SSRF) vulnerability in an unprotected setup endpoint. An unauthenticated attacker can probe internal network services and systems by sending specially crafted requests to the test-downloader endpoint during the initial setup phase. The vulnerability leaks information about internal systems through error messages, allowing reconnaissance of services that should not be accessible from the internet.

• CVE-2025-36321MEDIUM 5.7

  IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 contain an HTML injection vulnerability that allows authenticated users to inject malicious HTML code into the application. When other users view the affected pages, the injected HTML executes in their browsers within the security context of the hosting site, potentially enabling credential theft, session hijacking, or malware distribution. The vulnerability requires an authenticated attacker and user interaction (viewing the injected content), but poses a meaningful risk in shared or collaborative environments.

• CVE-2026-0165MEDIUM 5.7

  CVE-2026-0165 is a medium-severity vulnerability in Android's RTCP (Real-Time Control Protocol) packet decoder that allows an attacker to read sensitive information from device memory without needing special permissions. The flaw stems from missing boundary checks that permit out-of-bounds memory access. Exploitation requires user interaction—such as accepting a call or media stream—but once triggered, the vulnerability can leak confidential data like encryption keys, authentication tokens, or other sensitive information stored in adjacent memory regions.

• CVE-2026-0269MEDIUM 5.7

  An authenticated attacker can cause a Palo Alto Networks PAN-OS firewall to reboot by sending specially crafted packets that exploit a memory corruption flaw in tunnel traffic processing. Sending multiple malicious packets repeatedly forces the firewall into maintenance mode, rendering it unavailable until manual intervention occurs. This is not a remote unauthenticated attack—the attacker must already have network access and valid credentials.

• CVE-2026-14063MEDIUM 5.7

  CVE-2026-14063 is a memory disclosure vulnerability in Google Chrome's Chromecast component that allows a local attacker to read sensitive data from the browser process. The flaw requires the attacker to be on the same network and the user to interact with malicious network traffic, but does not require elevated privileges. While individual impact is modest, this type of information leak can enable reconnaissance for more sophisticated attacks. Google rated the underlying issue as low severity, but the combination of local network access, user interaction requirement, and memory disclosure capability warrants MEDIUM priority in most enterprise environments.

• CVE-2026-20254MEDIUM 5.7

  A vulnerability in Splunk Enterprise and Splunk Cloud Platform allows low-privileged users to create malicious dashboards that steal sensitive data when viewed by administrators or power users. The attack works by injecting CSS code into dashboard styling that bypasses Splunk's security controls designed to prevent outbound connections to untrusted servers. An attacker without admin privileges can craft a specially designed 'classic' dashboard that, when opened by someone with higher permissions, silently sends sensitive information—including credentials—to a server they control.

• CVE-2026-20255MEDIUM 5.7

  Splunk Enterprise and Splunk Cloud Platform contain a vulnerability that allows low-privileged users to create malicious dashboards capable of stealing sensitive data. An attacker without admin or power user roles can craft a dashboard that bypasses URL validation protections, tricking users into sending data to external servers they control. The flaw stems from incomplete validation of URLs in the external content dialog, meaning attackers can direct requests to untrusted domains when legitimate users view the compromised dashboard.

• CVE-2026-20256MEDIUM 5.7

  A vulnerability in Splunk Enterprise and Splunk Cloud Platform allows a low-privileged user without admin or power roles to trick other users into visiting attacker-controlled websites through specially crafted dashboard links. The flaw exploits a gap in URL validation: Splunk's security check only blocks URLs starting with 'http://' or 'https://', but misses protocol-relative URLs like '//attacker.com'. When a victim clicks a malicious drill-down link in a classic dashboard, they are silently redirected without the warning dialog that normally appears for external navigation. This can lead to credential theft, malware infection, or data exfiltration if the attacker's site mimics a trusted service.

• CVE-2026-20257MEDIUM 5.7

  A vulnerability in Splunk Enterprise and Splunk Cloud Platform allows a low-privileged user to create a malicious dashboard that can steal sensitive data from higher-privileged users who view it. The attack works by bypassing security controls on dashboard styling, enabling the dashboard to send data to external websites. However, the attacker cannot trigger the theft automatically—they must trick a target into visiting the dashboard, typically through phishing. Once the target views it, their browser could leak information to attacker-controlled servers.

• CVE-2026-25624MEDIUM 5.7

  A cross-site scripting (XSS) vulnerability exists in Arista Next Generation Firewall's administrative dashboard. An attacker with administrative credentials can inject malicious code into web form fields that are then reflected back to other administrators viewing the dashboard, potentially allowing them to steal session tokens, modify firewall rules, or perform other administrative actions on behalf of legitimate users. This is a stored or reflected XSS issue that requires an attacker to have already compromised an admin account or trick an admin into clicking a malicious link.

• CVE-2026-31267MEDIUM 5.7

  Mercusys MW302R routers running firmware version 1.4.10 (build 231023) contain a buffer overflow flaw in the administrative web interface that allows authenticated administrators to crash the device. An attacker with admin credentials can send a specially crafted request that overwrites memory on the stack, causing the router to stop functioning. This is a denial-of-service issue—the attacker cannot steal data or gain higher privileges, but they can disrupt network operations by making the router unavailable.

• CVE-2026-35067MEDIUM 5.7

  Dell PowerFlex Manager versions before 5.1.0.1 contain a flaw in how access is controlled that could allow someone already on your network with limited user privileges to gain higher-level administrative access or view sensitive data they shouldn't see. An attacker would need to be on the same network segment as the system and have at least basic user credentials to attempt this attack.

• CVE-2026-35069MEDIUM 5.7

  Dell PowerFlex Manager versions before 5.1.0.1 contain a SQL injection flaw that allows a low-privileged attacker on the same network to inject malicious SQL commands. This could enable script injection attacks, potentially compromising data confidentiality or system integrity depending on the attacker's follow-up actions. The vulnerability requires adjacent network access and valid credentials to exploit, which limits its immediate exposure but remains a real risk in internal environments.

• CVE-2026-40425MEDIUM 5.7

  A vulnerability in the Danelec MacGregor Voyage Data Recorder web interface allows an authenticated administrator to directly modify sensitive authentication-related files on the system. This could enable an attacker with admin credentials to alter the root password and gain elevated system control. While exploitation requires existing administrative access, the ability to change root credentials represents a critical privilege escalation path that should be addressed promptly.

• CVE-2026-40639MEDIUM 5.7

  Dell Client Platform BIOS contains a weakness in how it encodes passwords, allowing an attacker with physical access to a machine to bypass authentication controls and gain elevated privileges. This is not a remote vulnerability—an attacker must have hands-on access to the device. The risk is real but requires a meaningful obstacle (physical presence) that limits the pool of potential attackers in most enterprise environments.

• CVE-2026-40989MEDIUM 5.7

  Spring Cloud Function versions across multiple release lines contain a flaw in the routing layer that can trigger infinite recursion during request handling. This recursion exhausts available memory, causing an out-of-memory (OOM) error that crashes the application. The vulnerability requires either physical access to the system or authenticated local access to exploit, which limits its immediate risk in cloud-native deployments but remains a concern for containerized environments or systems with weak internal network segmentation.

• CVE-2026-40990MEDIUM 5.7

  A resource exhaustion flaw exists in Spring Cloud Function that allows an attacker to trigger out-of-memory (OOM) errors by registering an excessive number of functions in the Function Registry. The vulnerability requires local or adjacent network access and user interaction, making it a medium-severity concern primarily affecting development and hybrid deployment environments. Multiple versions across Spring Cloud Function 3.2 through 5.0 are vulnerable.

• CVE-2026-41918MEDIUM 5.7

  RUGGEDCOM RST2428P industrial switches store sensitive configuration data in the web browser's cache when authenticated users make changes. An attacker with valid credentials and access to the same system could potentially retrieve this cached data, exposing sensitive operational information. The vulnerability affects all versions prior to V4.0.

• CVE-2026-44696MEDIUM 5.7

  OpenProject, a widely-used open-source project management platform, contains a vulnerability in how it sanitizes user-supplied CSS in formatted text fields. Versions prior to 17.4.0 fail to properly restrict CSS properties when users add styling to work package descriptions, comments, project descriptions, and news items. Any authenticated user with write permissions can inject arbitrary CSS, potentially enabling visual deception attacks, credential harvesting through fake login forms overlaid on legitimate content, or other client-side manipulation. The vulnerability requires an attacker to have valid account access and user interaction (clicking or viewing the malicious content), which limits its immediate threat scope but makes it a meaningful risk for organizations where internal users may be adversarial or where guest/contractor accounts have write access.

• CVE-2026-45359MEDIUM 5.7

  ImageMagick, a widely-used image editing library, contains a memory safety flaw in its connected components operation. When the connected-components:keep-top parameter receives an invalid value, the software can read beyond allocated memory boundaries. While the vulnerability requires specific input conditions and local system access, it may allow an attacker to extract sensitive data or crash the application. Versions 6.9.13-48 and 7.1.2-22 patch this issue.

• CVE-2026-45610MEDIUM 5.7

  WWBN AVideo, an open-source video hosting platform, contains a cross-site request forgery (CSRF) flaw that allows an attacker to disable two-factor authentication (2FA) on a victim's account without their knowledge. If a logged-in AVideo user visits a malicious website controlled by an attacker, that site can silently turn off the victim's 2FA protection in a single HTTP request. This happens because the vulnerable endpoint doesn't validate the origin of the request or require re-authentication. Once 2FA is disabled, the account becomes significantly easier to compromise if credentials are later leaked or guessed.

• CVE-2026-47166MEDIUM 5.7

  ImageMagick, a widely-used image editing tool, contains a memory safety flaw in its distributed caching service. An attacker with local access who can connect to the magick -distribute-cache service can trigger the server to read beyond allocated heap memory, potentially exposing sensitive data or causing a denial of service. The vulnerability affects versions before 6.9.13-48 (legacy branch) and 7.1.2-23 (current branch).

• CVE-2026-47734MEDIUM 5.7

  Dulwich is a Python library used by Git servers to handle code push operations. A vulnerability in versions before 1.2.5 allows an attacker with push access to craft a specially designed small Git package that tricks the server into allocating hundreds of megabytes of memory based on false size declarations in the package header. This memory exhaustion attack can degrade or crash the server, denying legitimate developers access to the repository.

• CVE-2026-48187MEDIUM 5.7

  OTRS has a vulnerability in its email handling system that allows authenticated users to trigger excessive resource allocation on the web server, potentially causing it to crash or become unresponsive. An attacker with valid login credentials can exploit this through user interaction to exhaust server resources, resulting in denial of service. This is not a critical vulnerability but poses a meaningful availability risk to organizations relying on OTRS for ticketing operations.

• CVE-2026-48189MEDIUM 5.7

  OTRS has released a security update addressing an input validation flaw in its Customer Backend module that allows authenticated users to bypass group-based access controls and view customer information they shouldn't have access to. The vulnerability requires that the CustomerGroupSupport feature is both enabled and actively used within the deployment. While the flaw is rated medium severity, it poses a direct confidentiality risk for organizations managing sensitive customer data through OTRS ticketing systems.

• CVE-2026-48210MEDIUM 5.7

  OTRS 2026.3.1 has a configuration issue where ticket forwarding automatically marks internal information as visible to customers, and administrators cannot turn this off through the user interface. This means sensitive ticket details that should remain internal can unintentionally become visible to external customers, creating a data leakage risk.

• CVE-2026-49220MEDIUM 5.7

  Jellyfin, a self-hosted open-source media server, contains a cross-site scripting (XSS) vulnerability that allows unprivileged users to inject malicious JavaScript into an administrative account. An attacker can craft a special Client header value during the authentication process that, when viewed by an admin in the dashboard, executes arbitrary code in that admin's browser session. This could grant the attacker the ability to perform administrative actions, modify system settings, or access sensitive information without explicit authorization. The vulnerability affects Jellyfin versions prior to 10.11.9.

• CVE-2026-49993MEDIUM 5.7

  Nuxt's build tools (rspack-builder and webpack-builder) contain a flaw that allows attackers to steal source code during local development. If a developer runs the Nuxt dev server on a network-accessible address and then visits a malicious website, that site can intercept and exfiltrate the developer's source code. This is a regression—an incomplete patch for an earlier vulnerability—affecting versions 3.15.4 through 3.21.6 and 4.0.0 through 4.4.6. The risk is primarily to development environments, not production systems.

• CVE-2026-58024MEDIUM 5.7

  A MediaWiki vulnerability allows authenticated users to access sensitive information they shouldn't be able to see. The flaw is in the user rights API component and requires an attacker to be logged in and interact with a user interface element. While the exposure is limited to confidential data (no data modification or system disruption), it represents a meaningful privacy and compliance risk because sensitive administrative or user information could be leaked to unauthorized individuals.

• CVE-2026-58026MEDIUM 5.7

  A vulnerability in MediaWiki allows authenticated users to view sensitive information they shouldn't have access to through a flaw in the parser component. An attacker needs a valid login and user interaction to exploit this, limiting the attack surface but still representing a meaningful information disclosure risk in environments where many users have accounts.

• CVE-2026-61432MEDIUM 5.7

  PraisonAI versions before 1.6.78 contain a path traversal weakness in their FastContext feature. When the system executes file-related tools like file reading or directory listing, it does not properly validate absolute file paths or path sequences that use '../' to step backward through directories. This means an attacker with access to the application could craft requests or manipulate the AI model to read files outside the intended workspace directory, potentially exposing sensitive data stored on the server.

• CVE-2026-10222MEDIUM 5.6

  A vulnerability exists in NousResearch's hermes-agent software that allows attackers to inject malicious code through improper sanitization of environment variables. The flaw resides in the configuration parsing logic and can be exploited remotely, though successful exploitation requires substantial technical knowledge and effort. While a public exploit exists, the attack surface is limited by high complexity requirements. This is a medium-severity issue affecting versions up to 2026.4.30.

• CVE-2026-10540MEDIUM 5.6

  Control-M/Enterprise Manager versions 9.0.20.x and earlier use cryptographic hashing methods that do not meet modern security standards for protecting stored user passwords. If an attacker gains access to the credential database—through a breach, misconfiguration, or physical access—they could potentially recover plaintext passwords offline using computational attacks. This is a local-origin threat that requires the attacker to already have obtained the password hash file, but once in hand, the weak protection mechanism makes password recovery feasible without further network access to the system.

• CVE-2026-11941MEDIUM 5.6

  Cloudflare's Quiche QUIC library contains two use-after-free vulnerabilities in its C FFI (Foreign Function Interface) layer. When applications call the quiche_connection_id_iter_next or quiche_conn_retired_scid_next functions, these functions return a pointer to connection ID data that has already been freed from memory. This is a memory safety issue that primarily affects custom applications that directly use Quiche's C bindings—a relatively small subset compared to Rust consumers. The good news is the FFI layer is disabled by default and requires explicit build-time opt-in.

• CVE-2026-13524MEDIUM 5.6

  CherryHQ's cherry-studio application contains an authorization flaw in its MCP OAuth callback mechanism that could allow remote attackers to bypass access controls. The vulnerability exists in the OAuth callback handler where improper validation of the 'code' parameter fails to enforce proper authorization checks. An attacker would need to craft a malicious request, but exploitation requires high technical complexity and specific conditions. Versions up to 1.9.6 are affected.

• CVE-2026-13529MEDIUM 5.6

  YzmCMS versions up to 7.5 contain a SQL injection vulnerability in the installation script that can be triggered by manipulating the siteurl parameter. While the flaw allows an attacker to read, modify, or delete database contents, exploiting it requires navigating non-trivial technical barriers and is not straightforward to execute. The vendor has not responded to early disclosure attempts, leaving users without an official patch timeline.

• CVE-2026-13543MEDIUM 5.6

  Documenso versions up to 2.11.0 contain an authentication flaw in their Google OAuth login implementation that could allow an attacker to bypass or manipulate the authentication process. The vulnerability exists in the OAuth callback URL handling logic and requires specific technical conditions to exploit, making it moderately difficult to execute. While a public exploit exists, successful attacks would still demand significant effort and precision from an attacker.

• CVE-2026-13588MEDIUM 5.6

  PcapPlusPlus, a packet processing library version 25.05, contains a vulnerability in its TLS handshake processing that allows an attacker to cause a heap-based buffer overflow by manipulating the handshake version parameter. While the vulnerability is accessible over the network, exploiting it requires significant technical effort and specific conditions. The flaw could potentially allow an attacker to read sensitive memory, modify data, or disrupt application availability, though practical exploitation remains constrained by the high complexity barrier.

• CVE-2026-13589MEDIUM 5.6

  PcapPlusPlus version 25.05 contains a heap buffer overflow vulnerability in its Telnet packet parsing logic. When processing specially crafted Telnet subnegotiation commands, the vulnerable code can write beyond allocated memory boundaries. While remote exploitation is possible without authentication, the attack requires careful crafting and succeeds only under specific conditions, making opportunistic attacks less likely. A public exploit exists, increasing practical risk.

• CVE-2026-13590MEDIUM 5.6

  A heap-based buffer overflow vulnerability has been identified in seladb PcapPlusPlus version 25.05, specifically within the Modbus Protocol Handler component. When a specially crafted packet with a manipulated length argument is processed by the pcpp::ModbusLayer::getLength function, it can cause a buffer overflow in heap memory. An unauthenticated attacker on the network can trigger this condition, though significant technical knowledge and specific packet construction are required to exploit it successfully. The vulnerability enables attackers to leak sensitive memory contents, corrupt data, or potentially crash the application.

• CVE-2026-14355MEDIUM 5.6

  PHP versions before specific patch levels contain a flaw in how they allocate memory for AES key-wrap-with-padding operations within the OpenSSL extension. When processing encrypted keys, the application reserves too little memory for the output, allowing OpenSSL to write beyond these bounds. This corrupts internal heap structures and causes the application to crash. The vulnerability requires specific conditions to trigger—it is not a remote code execution—but does enable a network attacker to cause denial of service on affected systems.

• CVE-2026-14609MEDIUM 5.6

  CVE-2026-14609 is a session fixation vulnerability in SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0. An attacker can remotely manipulate an unknown processing component to hijack or lock a user's session, gaining unauthorized access to the account without needing to know the victim's password. The attack is complex to execute, requiring significant technical skill, but public exploit code now exists, raising the practical risk despite the moderate CVSS rating.

• CVE-2026-14627MEDIUM 5.6

  NousResearch's hermes-agent, a tool used for building agent applications, contains an authentication bypass vulnerability in its Discord platform integration. The flaw exists in code responsible for verifying whether a Discord user is allowed to interact with the agent. An attacker can exploit this remotely by manipulating the authentication check, gaining unauthorized access to agent functionality. While the technical difficulty is high and exploitation requires specific knowledge, the vendor has not provided patches or meaningful engagement on the issue since disclosure.

• CVE-2026-1764MEDIUM 5.6

  GNOME localsearch, a desktop search indexing tool, contains a memory safety flaw in its MP3 metadata parser. When a specially crafted MP3 file with ID3v2.4 tags is processed, the software fails to properly validate tag boundaries before reading heap memory. This can crash the indexing process or leak sensitive data from the application's memory space. The vulnerability requires local access and user interaction—a user must open or index a malicious MP3 file—but the consequences can include service disruption and unintended data exposure.

• CVE-2026-1765MEDIUM 5.6

  GNOME localsearch contains a heap buffer overflow vulnerability in its MP3 file processing component. When a user opens a specially crafted MP3 file, the application can crash unexpectedly. There is also a potential risk that sensitive data from system memory could be exposed during the crash. This is a locally-triggered vulnerability—an attacker must first convince a user to open a malicious file rather than launching an attack remotely over the network.

• CVE-2026-1766MEDIUM 5.6

  A heap buffer overflow vulnerability exists in GNOME localsearch's MP3 file parser. When processing maliciously crafted MP3 files with corrupted ID3v2.3 comment tags, the tracker-extract-mp3 component can crash or leak sensitive data from system memory. An attacker needs local access and user interaction (opening or processing the file) to trigger the flaw. This is a moderate-risk issue affecting Linux systems running affected GNOME versions.

• CVE-2026-1767MEDIUM 5.6

  GNOME's localsearch application contains a heap buffer overflow flaw in its MP3 file processor that can be triggered when a specially crafted MP3 file with malformed ID3 tags is scanned or indexed. An attacker who can place a malicious MP3 on a system would cause the application to crash (denial of service) or potentially leak sensitive information from memory. This is not a remote code execution vulnerability and requires local access and user interaction to exploit.

• CVE-2026-2604MEDIUM 5.6

  A vulnerability in evolution-data-server allows a Flatpak application with D-Bus access to delete arbitrary files on the host system. The flaw stems from inconsistent validation logic: when contacts are created or modified, malicious URIs containing directory traversal sequences (like "../") are accepted without proper checks. When those contacts are later deleted, a less strict validation routine processes the URI and actually follows the traversal, deleting files the attacker specified. This could affect critical system files, including Flatpak override configurations that control sandboxing rules.

• CVE-2026-28322MEDIUM 5.6

  SolarWinds Database Performance Analyzer contains a stored cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application. When a user views a page containing the injected script, the malicious code executes in their browser with their privileges. This vulnerability requires an attacker to have authenticated access and user interaction to exploit, limiting but not eliminating the risk in environments where internal users have administrative permissions.

• CVE-2026-6899MEDIUM 5.6

  A flaw in S2OPC library's CycloneCrypto cryptographic wrapper causes the system to stop checking certificate revocation status after finding the first Certificate Revocation List (CRL) from a Certificate Authority. If additional CRLs exist for the same CA, they are ignored. This means a client or server using a revoked certificate could establish an OPC UA connection when it should be rejected, potentially allowing unauthorized communication with compromised credentials.

• CVE-2020-9711MEDIUM 5.5

  Adobe Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier contain a flaw that allows an attacker to read sensitive data from a computer's memory when a user opens a specially crafted PDF file. The vulnerability does not allow attackers to modify files or crash the application, but it does expose information that should remain private. An attacker would need to trick someone into opening a malicious PDF to exploit this issue.

• CVE-2020-9713MEDIUM 5.5

  CVE-2020-9713 is a memory disclosure vulnerability in Adobe Acrobat and Reader that allows an attacker to read sensitive data from a victim's computer. The flaw occurs when the application improperly accesses memory outside intended boundaries while processing a malicious PDF file. An attacker must trick a user into opening a crafted document to exploit it—there is no remote attack vector. While the vulnerability cannot directly crash the application or alter files, it can expose confidential information such as cached credentials, encryption keys, or other sensitive data resident in memory at the time of exploitation.

• CVE-2025-24165MEDIUM 5.5

  A permissions enforcement gap in macOS allows applications to trigger unexpected system shutdowns. The vulnerability stems from insufficient access controls that permit an app—without requiring special privileges or admin credentials—to initiate a termination condition. Apple addressed this by reinforcing permission checks across the affected operating system versions. The attack requires user interaction (such as running or interacting with a malicious app), but does not require the user to have special knowledge of the vulnerability.

• CVE-2025-24268MEDIUM 5.5

  CVE-2025-24268 is a medium-severity vulnerability in macOS that stems from inadequate validation of directory paths during parsing. An attacker with local access and user-level privileges could potentially exploit this weakness to read sensitive user data on an affected system. Apple has resolved this issue in macOS Sequoia 15.4 by implementing stricter path validation controls.

• CVE-2025-30431MEDIUM 5.5

  CVE-2025-30431 is a medium-severity vulnerability in Apple macOS that allows a malicious application already running on a user's computer to access private information. The flaw stems from inadequate validation checks in the operating system. Because an attacker must first get a malicious app onto the system and have it execute with user-level privileges, the real-world risk depends heavily on how the app gets installed—whether through social engineering, supply-chain compromise, or user mistake. Apple has patched this across three recent macOS versions.

• CVE-2025-30459MEDIUM 5.5

  CVE-2025-30459 is a privacy vulnerability affecting macOS that could allow an app to access sensitive user data without appropriate restrictions. Apple addressed this by removing the vulnerable code path in macOS Sequoia 15.4. The issue requires local access and an already-installed application to exploit, limiting its immediate risk to targeted or supply-chain scenarios.

• CVE-2025-36372MEDIUM 5.5

  IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 contain a flaw that allows authenticated database users to access sensitive information from internal monitoring and event tables they should not be able to view. An attacker with valid database credentials could exploit this to extract confidential data, though they cannot modify information or disrupt service. This affects Db2 installations on Linux, Unix, and Windows platforms, including Db2 Connect Server deployments.

• CVE-2025-43278MEDIUM 5.5

  CVE-2025-43278 is a local privilege escalation vulnerability in macOS Sequoia that allows an application to access protected user data through improper symlink handling. An attacker with local access and user interaction can exploit this to read sensitive files that should be restricted. The vulnerability requires the user to take an action (such as opening a file or interacting with an app), but does not require administrator privileges. Apple has addressed this in macOS Sequoia 15.4 with improved symlink validation logic.

• CVE-2025-43339MEDIUM 5.5

  A sandbox isolation weakness in macOS Tahoe allows a malicious app running with user privileges to read sensitive user data that should have been protected. The vulnerability does not allow the attacker to modify data or crash the system, only to view it. Apple has patched this in macOS Tahoe 26.1 by strengthening sandbox restrictions.

• CVE-2025-46293MEDIUM 5.5

  CVE-2025-46293 is a local privilege escalation vulnerability in macOS that allows installed applications to read protected user data through improper symlink handling. An attacker with local access and the ability to run an app on the target system could potentially bypass file access restrictions and view sensitive files. The vulnerability requires local presence and user-level privileges to exploit, making it a concern primarily for multi-user systems or scenarios where an attacker can install malicious software. Apple has resolved this with improved symlink validation in macOS Sequoia 15.4.

• CVE-2025-46313MEDIUM 5.5

  CVE-2025-46313 is a logging defect in macOS Tahoe that could allow a third-party application to access sensitive user information that should have been redacted from system logs. The vulnerability stems from incomplete data redaction in logging routines, enabling an app to read information it should not have access to. This is a local attack vector requiring user interaction, such as installing or running the vulnerable application.

• CVE-2025-48648MEDIUM 5.5

  CVE-2025-48648 is a denial-of-service vulnerability in Android's NotificationManagerService that allows a local attacker to exhaust system resources and crash the notification service. An attacker with basic user privileges can trigger this flaw without user interaction, causing persistent disruption to the device's notification functionality.