By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 2 of 41

• CVE-2026-7566MEDIUM 6.6

  The LearnPress – Backup & Migration Tool WordPress plugin contains a PHP Object Injection flaw that allows authenticated administrators to inject malicious serialized objects into the application. By itself, this vulnerability is limited in impact because the plugin does not include a known Property-Oriented Programming (POP) chain. However, if your WordPress installation also runs other vulnerable plugins or themes that contain POP chains, an administrator could potentially weaponize this vulnerability to delete files, steal sensitive data, or execute arbitrary code on your server.

• CVE-2018-25393MEDIUM 6.5

  Navigate CMS version 2.8.5 contains a flaw that allows authenticated users to download files they shouldn't have access to by manipulating the download request. An attacker with valid login credentials can craft specially-formed requests to the navigate_download.php component using directory traversal patterns (such as ../../../) to sidestep folder boundaries and retrieve sensitive system files like configuration files outside the application's normal download directory.

• CVE-2018-25421MEDIUM 6.5

  Open STA Manager version 2.3 has a security flaw that allows authenticated users to download files they shouldn't have access to. An attacker with valid login credentials can manipulate web requests to trick the application into retrieving sensitive system files, such as configuration files or data stored outside the intended application directory. The vulnerability exists in the backup module and exploits how the application handles file path requests.

• CVE-2019-25716MEDIUM 6.5

  Dräger's Infinity Delta, Delta XL, and Kappa patient monitors are vulnerable to a denial-of-service attack triggered by malformed network packets. An attacker on the same network segment can send specially crafted packets that force the monitor to reboot repeatedly, disrupting patient monitoring and causing the device to lose network connectivity and revert to default settings. This is a network-adjacent threat that degrades clinical visibility rather than exposing patient data directly.

• CVE-2019-25720MEDIUM 6.5

  Dräger patient monitoring systems (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) are vulnerable to denial-of-service attacks from attackers on the same network segment. An unauthenticated attacker can send specially crafted network packets to force the monitor to reboot repeatedly, disrupting continuous patient monitoring. The device may then revert to default settings and lose network connectivity, compounding the disruption to clinical workflows.

• CVE-2019-25721MEDIUM 6.5

  Dräger Infinity M300 wearable patient monitors running software version VG2.3.1 or earlier are vulnerable to network-based denial-of-service attacks. An attacker positioned on the same network can send specially crafted requests that force the device to reboot repeatedly, effectively taking the monitor offline and disrupting patient monitoring. This is a network-adjacent threat that requires no authentication or user interaction to trigger.

• CVE-2019-25724MEDIUM 6.5

  Dräger Infinity M300 wearable patient monitors running software version VG2.x and earlier are vulnerable to a network-based denial-of-service attack that forces repeated device reboots. An attacker positioned on the hospital network or Infinity Network can trigger these reboots until the monitor enters a failed state, requiring manual intervention to restore function. During this attack window, wireless connectivity drops, patient monitoring capability is interrupted, and alarm functions become unavailable—creating a gap in real-time clinical visibility that could delay detection of patient deterioration.

• CVE-2019-25740MEDIUM 6.5

  A vulnerability in Joomla's com_jsjobs extension version 1.2.6 allows authenticated users to delete files from the web server. An attacker who has valid login credentials can craft a malicious request that exploits how the extension handles file path parameters, bypassing intended restrictions and removing files the web server can access. This is a path traversal flaw that turns file upload/management functionality into an unauthorized deletion mechanism.

• CVE-2020-37248MEDIUM 6.5

  OfflineIMAP before version 8.0.3 contains a man-in-the-middle vulnerability in its STARTTLS implementation. The application accepts the server's claim that TLS encryption is available without verifying it before sending login credentials, allowing an attacker on the network to intercept and read account usernames and passwords in cleartext. This is a classic STRIPTLS attack where the attacker downgrades the connection from encrypted to unencrypted.

• CVE-2024-35690MEDIUM 6.5

  CVE-2024-35690 is a data exposure vulnerability in MarketingFire's Widget Options plugin. The flaw allows authenticated users to retrieve sensitive information that should not be transmitted over the network. An attacker with valid login credentials can extract embedded sensitive data by exploiting how the plugin handles and sends data. This is not a remote unauthenticated attack, but the exposure of sensitive information through a trusted plugin represents a meaningful risk to organizations relying on MarketingFire.

• CVE-2024-37210MEDIUM 6.5

  CVE-2024-37210 is a missing authorization flaw in ali2woo AliNext that allows authenticated users to access resources or perform actions they shouldn't be permitted to reach due to improperly configured access controls. An attacker with valid login credentials can exploit weak authorization checks to view sensitive information, though they cannot modify data or disrupt service availability. All versions through 3.3.5 are affected.

• CVE-2024-47477MEDIUM 6.5

  Dell PowerFlex Manager versions before 4.5.1.1 have a flaw in how they validate SSL/TLS certificates from servers they connect to. An attacker on the network path between a user and PowerFlex Manager could intercept and impersonate the legitimate server, potentially gaining access to sensitive data or modifying communications. The vulnerability requires the attacker to also poison DNS records to redirect traffic, but both techniques are well-established attack vectors that don't require authentication or user interaction.

• CVE-2024-51454MEDIUM 6.5

  IBM Engineering Workflow Management versions 7.0.2, 7.0.3, and 7.1 (up to specific interim fixes) contain a flaw in how they validate HTTP HOST headers. An attacker can inject malicious content into these headers to manipulate how the application processes requests. This could enable attackers to steal session credentials, poison cached content, or execute JavaScript in users' browsers. The vulnerability requires no authentication and can be triggered remotely over the network.

• CVE-2024-54178MEDIUM 6.5

  IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data contain a resource allocation flaw that allows authenticated users to trigger a denial of service condition when creating new databases. An attacker with valid credentials can exhaust system resources during database creation, making the service unavailable to legitimate users. This is not a remote unauthenticated attack—the threat actor must first obtain valid authentication credentials.

• CVE-2024-6858MEDIUM 6.5

  Arista EOS switches running in 802.1X authentication mode contain a logic flaw that can allow unauthorized devices to bypass port access controls. If an unauthenticated device is present on a port configured for multi-auth, and there is an EAPOL-capable (Extensible Authentication Protocol over LAN) device in the fallback VLAN, the unauthenticated device may be granted network access when it should remain blocked. This creates an authentication bypass condition specific to the multi-auth scenario and fallback VLAN configuration.

• CVE-2025-12799MEDIUM 6.5

  Jastow contains a cross-site scripting (XSS) vulnerability that arises when specific configuration combinations are used with the embedded Undertow server. The flaw allows unescaped characters in URLs to pass through to the application without proper sanitization. An attacker can craft a malicious URL containing JavaScript code that, when a user visits the link, executes in their browser within the context of the vulnerable application. This can lead to session hijacking, credential theft, or malware distribution. The vulnerability requires specific configuration settings to be present, which limits its exposure but does not eliminate the risk for affected deployments.

• CVE-2025-15661MEDIUM 6.5

  libssh2 versions up to 1.11.1 contain a flaw in how they handle responses from SSH servers during SFTP file operations. A malicious or compromised SSH server can craft a specially-malformed response that causes the client library to read beyond the boundaries of its own memory buffer. This can leak sensitive data from the application's memory or cause the client to crash. The vulnerability exists in the symlink-related operations (READLINK and REALPATH) and requires network access to an SSH server, but does not require user interaction or special privileges.

• CVE-2025-24816MEDIUM 6.5

  Nokia MantaRay contains a flaw in its API authorization logic that allows an authenticated user to access information they should not be able to see. An attacker with valid credentials could exploit insufficient permission checks to retrieve confidential data beyond their intended access scope. This is a moderate-severity issue requiring attention but does not enable data modification or system disruption.

• CVE-2025-36327MEDIUM 6.5

  IBM watsonx.data intelligence contains a client-side security enforcement flaw that allows authenticated users to circumvent server-side protections. An attacker who has legitimate access to the system can manipulate client-side controls to perform actions they should not be authorized to perform, potentially modifying data or accessing functionality restricted by policy. This is a privilege escalation vulnerability requiring existing user credentials.

• CVE-2025-48977MEDIUM 6.5

  Apache Ignite REST API contains a path traversal vulnerability that allows authenticated users to read arbitrary files from the server by manipulating the log path parameter in API commands. An attacker with valid REST API credentials can escape the intended log directory and access sensitive files anywhere on the system. This affects Ignite versions 2.0.0 through 2.17.0, and the vendor has released version 2.18.0 to address it.

• CVE-2025-5089MEDIUM 6.5

  CVE-2025-5089 is a denial-of-service vulnerability affecting Arista EOS switches and CloudVision eXchange (CVX) servers when they communicate with each other. When either device receives specially crafted messages over their management connection, it can crash internal system processes, causing the EOS switch to reset or the CVX cluster to become unstable. An attacker would need legitimate administrative access to one of these connected devices to exploit this vulnerability—it cannot be triggered remotely by an unauthenticated outsider.

• CVE-2025-5090MEDIUM 6.5

  CVX, a network control platform, crashes when it receives malformed or unexpected messages from a connected network switch. An attacker with administrative access to that switch could exploit this instability to repeatedly trigger crashes, disrupting the CVX cluster's availability. This is a denial-of-service vulnerability that requires high privilege on the switch infrastructure to execute.

• CVE-2025-52766MEDIUM 6.5

  CVE-2025-52766 is a missing authorization flaw in Printeers Print & Ship that allows authenticated users to perform actions they shouldn't have permission to do. An attacker with valid login credentials can exploit improperly configured access controls to modify data or settings—for instance, altering print job configurations, shipping labels, or account information belonging to other users or tenants. The vulnerability requires an authenticated user; it cannot be exploited by unauthenticated attackers. The impact is elevation of privilege within the application, not confidentiality compromise or service disruption.

• CVE-2025-55639MEDIUM 6.5

  GPAC's MP4Box version 2.4 contains a flaw that can crash the application when processing a specially crafted MP4 file. An attacker can exploit this by distributing a malicious MP4 that triggers a crash in any system using MP4Box to process or validate video files, disrupting availability without requiring special privileges or authentication.

• CVE-2025-55642MEDIUM 6.5

  GPAC MP4Box version 2.4 contains a flaw that can cause the application to crash when processing certain MP4 files. The vulnerability exists in code responsible for handling audio and video data during file writing operations. An attacker could craft a malicious MP4 file that, when opened in MP4Box, triggers a mathematical error leading to a denial of service. No data theft or file corruption occurs, but the crash prevents legitimate work with video files.

• CVE-2025-55658MEDIUM 6.5

  GPAC MP4Box version 2.4 contains a bug in how it processes Opus audio codec headers within MP4 files. When processing a specially crafted MP4 file, the application crashes due to a floating point exception—essentially a mathematical error in code that causes the program to terminate. An attacker can exploit this by distributing a malicious MP4 file, causing MP4Box to crash whenever a user or automated system tries to process it. This is a denial-of-service vulnerability that affects availability but does not compromise data confidentiality or integrity.

• CVE-2025-55659MEDIUM 6.5

  GPAC MP4Box version 2.4 contains a flaw that causes the application to crash when processing a specially crafted MP4 media file. An attacker can exploit this by distributing a malicious MP4 file that, when opened by a user, triggers a denial of service condition. The vulnerability does not compromise data confidentiality or integrity—it simply stops the application from functioning until it is restarted.

• CVE-2025-58175MEDIUM 6.5

  GeoServer, an open-source geospatial data sharing platform, contains a Server-Side Request Forgery (SSRF) vulnerability in versions before 2.26.4 and 2.27.3. An attacker without authentication can exploit this flaw to make the server perform unauthorized network requests on their behalf, potentially accessing internal resources or sensitive data. The vulnerability is only active when GeoServer is configured with a proxy base URL lacking a path component or trailing slash, and when entity resolution allowlist is enabled (the default since version 2.25.0).

• CVE-2025-59174MEDIUM 6.5

  Ericsson's Packet Core Controller (PCC) software versions before 1.39 can be knocked offline or severely degraded when an attacker on the same network segment sends large numbers of specially crafted messages. An attacker doesn't need credentials or user interaction to trigger the problem, but they do need network access to the affected system. This is a denial-of-service vulnerability that could disrupt telecom packet routing and control functions.

• CVE-2025-59601MEDIUM 6.5

  CVE-2025-59601 describes an information disclosure vulnerability in multiple Qualcomm wireless and audio components. When a device is factory reset through its powerline interface, sensitive configuration data may be exposed to an attacker with adjacent network access. This allows unauthorized parties to read device settings that should have been wiped during the reset process. The vulnerability does not allow modification of settings or denial of service, but the exposure of configuration details could enable further attacks or reveal sensitive operational parameters.

• CVE-2025-62858MEDIUM 6.5

  A buffer overflow flaw exists in QNAP's QTS and QuTS hero operating systems that allows a high-privileged attacker to corrupt memory or crash running processes. Because the vulnerability requires prior administrative access, the risk is contained to scenarios where an admin account has been compromised or a trusted insider acts maliciously. QNAP has released patched versions across all affected product lines.

• CVE-2025-64215MEDIUM 6.5

  StylemixThemes MasterStudy LMS Pro contains a missing authorization vulnerability that allows unauthenticated attackers to access functionality that should be restricted by access control lists (ACLs). An attacker can exploit this flaw to perform unauthorized actions affecting the integrity and availability of the learning management system without requiring authentication or user interaction.

• CVE-2025-70101MEDIUM 6.5

  CVE-2025-70101 is a memory safety flaw in the lwext4 library, a lightweight ext4 filesystem implementation. When processing a specially crafted ext4 disk image, the library can read past the end of allocated memory due to missing validation checks. An attacker who tricks a user into opening a malicious filesystem image can trigger this out-of-bounds read, causing the application to crash. This is primarily a denial-of-service risk rather than a gateway to data theft or system compromise.

• CVE-2025-71332MEDIUM 6.5

  Flowise, a popular workflow automation platform, contains a SQL injection vulnerability in its chatflow import feature. An authenticated attacker can upload a specially crafted JSON file that executes arbitrary SQL commands on the backend database. The vulnerability stems from a failure to properly sanitize the chatflow ID before inserting it into a SQL query. While authentication is required to exploit this issue, the impact is significant: attackers can extract sensitive data from the credential table, potentially compromising stored API keys, passwords, and other authentication tokens used by the platform.

• CVE-2025-71381MEDIUM 6.5

  Hono is a lightweight web framework used by developers to build fast APIs and web applications. A flaw in its CORS (Cross-Origin Resource Sharing) middleware allows attackers to inject arbitrary cache-control directives by manipulating the Vary header in requests. When a server reflects this attacker-supplied Vary value back in the response, it can poison how shared caches and proxies store and retrieve content, leading to inconsistent security policies and potential information leakage. The issue affects versions before 4.10.3.

• CVE-2025-71382MEDIUM 6.5

  MuPDF, a popular open-source PDF and EPUB rendering library, contains a denial-of-service vulnerability in its EPUB CSS processing engine. An attacker can craft a malicious EPUB file with deeply nested HTML elements and CSS styles that causes the application to recursively process CSS property inheritance without stopping, ultimately crashing any application using MuPDF to read EPUB files. The vulnerability requires user interaction (opening the file) but affects any software embedding MuPDF for document viewing.

• CVE-2026-0039MEDIUM 6.5

  CVE-2026-0039 is an integer overflow vulnerability in Android's ubsan_throwing_runtime.cpp that allows an authenticated attacker to remotely crash or disable affected devices. The flaw resides in multiple functions and can be exploited without user interaction, making it a straightforward denial-of-service vector for anyone with network access to a vulnerable Android system.

• CVE-2026-0040MEDIUM 6.5

  CVE-2026-0040 is an integer overflow vulnerability in Google Android's ubsan_throwing_runtime.cpp file that allows an authenticated attacker to remotely crash the system. No special privileges or user interaction are required for exploitation, making this a straightforward denial-of-service attack vector. The flaw resides in multiple functions within a core runtime component, meaning the exposure is likely widespread across affected Android versions.

• CVE-2026-0041MEDIUM 6.5

  An integer overflow vulnerability exists in Google Android's UBSan (Undefined Behavior Sanitizer) runtime code. When triggered, the overflow causes the sanitizer itself to fail rather than safely handling undefined behavior, resulting in application crashes or service disruption. An authenticated attacker can remotely exploit this without user interaction, making it a network-reachable denial-of-service vector.

• CVE-2026-0044MEDIUM 6.5

  CVE-2026-0044 is an integer overflow vulnerability in Android's ubsan_throwing_runtime.cpp that allows an authenticated attacker to crash the system remotely. The flaw requires valid credentials to exploit but no user interaction, making it a straightforward denial-of-service vector that can disrupt device availability without requiring the attacker to execute code or escalate privileges.

• CVE-2026-0051MEDIUM 6.5

  A vulnerability in Google Android's UBSan (Undefined Behavior Sanitizer) runtime component allows an authenticated attacker to crash the system by sending malformed input to multiple functions in ubsan_throwing_runtime.cpp. The vulnerability requires valid credentials to exploit but no special privileges, and the attacker doesn't need to interact with the device user. The impact is denial of service—the system becomes unavailable—but data confidentiality and integrity are not compromised.

• CVE-2026-0052MEDIUM 6.5

  CVE-2026-0052 is an integer overflow vulnerability in Android's UBSan runtime that can be triggered remotely by an authenticated attacker to crash the affected system. The flaw exists in multiple functions within ubsan_throwing_runtime.cpp and requires only network access and valid credentials—no special privileges or user interaction needed. Successful exploitation results in denial of service, making the device temporarily unavailable.

• CVE-2026-0080MEDIUM 6.5

  CVE-2026-0080 is an integer overflow vulnerability in Google Android's ubsan_throwing_runtime.cpp that allows authenticated attackers to crash affected devices remotely. The flaw requires a valid login but no special permissions, and can be triggered without user interaction—making it a practical denial-of-service vector for an attacker with baseline Android system access.

• CVE-2026-0127MEDIUM 6.5

  A flaw in how Android processes certain network messaging has been discovered that allows an attacker with basic network access to crash the device's communication processor. The vulnerability stems from improper bounds checking when reading data from network messages, potentially causing the system to read memory beyond intended limits. An attacker can trigger this remotely without needing special privileges or user interaction, though they do require an authenticated network connection to the affected system.

• CVE-2026-0128MEDIUM 6.5

  A vulnerability in how Android processes RTCP feedback packets can allow an attacker to read sensitive memory from a device. An integer overflow in the packet decoding function causes the system to read beyond intended buffer boundaries. An attacker would need to trick a user into interacting with a malicious packet (for example, through a compromised media stream or application), but no special permissions are required for the attack itself. The vulnerability exposes information only—it cannot be used to modify data or crash the system.

• CVE-2026-0136MEDIUM 6.5

  A memory safety flaw in Android's modem component allows an attacker with valid login credentials to remotely crash a device by triggering an out-of-bounds read. The vulnerability requires network access and authentication but no additional privileges or user interaction, making it a straightforward denial of service vector for authenticated attackers.

• CVE-2026-0144MEDIUM 6.5

  A memory safety vulnerability exists in Google Android's audio codec implementation that allows an authenticated attacker to crash the audio service remotely. The flaw stems from insufficient validation when processing audio commands, enabling a denial-of-service condition without requiring user interaction or special system privileges. An attacker with network access and basic authentication credentials could trigger this issue to disrupt audio functionality.

• CVE-2026-0282MEDIUM 6.5

  Palo Alto Networks PAN-OS contains a vulnerability that allows an attacker on the network to delete files from a temporary directory on the management interface without authentication. The actual risk depends heavily on your deployment posture—Palo Alto emphasizes that restricting management access to trusted internal networks significantly reduces exposure. Cloud NGFW and Prisma Access deployments are unaffected.

• CVE-2026-10004MEDIUM 6.5

  Google Chrome versions before 148.0.7778.216 contain a flaw in how they validate user input within the password-handling component. An attacker can craft a malicious HTML page that, when visited by a user, tricks the browser into displaying fake password prompts or other UI elements that appear legitimate. This is a spoofing attack—the attacker doesn't steal data directly, but deceives users into believing they're interacting with genuine Chrome interface elements, potentially leading them to enter credentials or take other unintended actions.

• CVE-2026-10008MEDIUM 6.5

  Google Chrome on Android contains an uninitialized memory flaw in the GPU rendering pipeline that could allow an attacker to extract sensitive data from the browser process. An attacker would craft a malicious HTML page that, when loaded by a user, exploits how the GPU handles uninitialized memory regions—leaking fragments of previously-used data that may contain sensitive information. This is a memory disclosure vulnerability, not a code execution flaw, but information leaks can enable follow-on attacks or expose credentials, tokens, and personal data.

• CVE-2026-10018MEDIUM 6.5

  CVE-2026-10018 is a medium-severity integer overflow vulnerability in ANGLE (Almost Native Graphics Layer Engine), Google's graphics abstraction layer used in Chrome. An attacker can craft a malicious webpage that, when visited, causes Chrome to mishandle memory calculations in its graphics pipeline. This flaw allows the attacker to read sensitive data from the browser's process memory—potentially including cached credentials, session tokens, or other confidential information—without modifying or crashing the system. The vulnerability requires user interaction (visiting the malicious page) but does not require special privileges to exploit.

• CVE-2026-10190MEDIUM 6.5

  A remotely exploitable vulnerability exists in Tenda W12 version 3.0.0.7(4763) that allows authenticated users to crash the device's web management interface. By sending a specially crafted request to the web timeout configuration function, an attacker with valid credentials can trigger a denial-of-service condition, rendering the device's management portal unavailable until it is restarted. Public exploit code is available, increasing the practical risk.

• CVE-2026-10272MEDIUM 6.5

  A4M4's Student-Management-System contains an authorization flaw in its admin panel that allows unauthenticated attackers to manipulate a parameter called 'sid' in the deleteform.php file, potentially leading to unauthorized data modification or deletion. The vulnerability is network-accessible and does not require user interaction or special privileges to exploit. While the issue has been publicly disclosed and exploit code is available, the development team has not yet issued a patch or formal response.

• CVE-2026-10544MEDIUM 6.5

  Devolutions Server contains a vulnerability in its built-in PAM (Privileged Access Management) provider that allows authenticated users with vault write access to inject commands into password rotation templates. When those templates execute, the injected commands run on systems managed by the PAM provider, potentially granting attackers control over critical infrastructure. The issue stems from insufficient sanitization of special characters and command syntax in template processing.

• CVE-2026-10593MEDIUM 6.5

  A flaw in the Zephyr RTOS Bluetooth LE Audio implementation allows a malicious or misconfigured remote Bluetooth server to crash devices using the BAP (Basic Audio Profile) unicast client. The vulnerability occurs when the remote server sends a state notification at a specific moment in the connection handshake—before the local device has fully set up its audio configuration. At that precise window, the code tries to write data to a memory location that hasn't been initialized, causing the device to crash. The attacker doesn't need any special permissions or interaction from the user; they only need to be connected via Bluetooth.

• CVE-2026-10655MEDIUM 6.5

  A race condition in Zephyr's SNTP (Simple Network Time Protocol) client can cause a networking thread crash when the asynchronous socket close operation runs on a different thread than the socket service's polling thread. An attacker on the network or positioned to intercept traffic can trigger this condition repeatedly by dropping or delaying SNTP responses, causing the system to repeatedly attempt reconnection and hitting the race window. While memory corruption is theoretically possible, denial of service via crash is the primary risk.

• CVE-2026-10786MEDIUM 6.5

  A flaw in Devolutions Server's ticketing integration settings allows authenticated users with low-level permissions to retrieve cleartext credentials for third-party ticketing systems through a specially crafted API request. An attacker with basic user access could exploit this to obtain sensitive integration credentials without proper authorization checks, potentially enabling lateral movement or unauthorized access to connected ticketing platforms.

• CVE-2026-10824MEDIUM 6.5

  Masteriyo LMS, a WordPress plugin for managing online courses, contains a flaw where certain API endpoints fail to verify that the person making a request is actually authorized to access or modify course progress data. This means someone without a valid account—or even someone not logged in—can view and delete course completion records belonging to any student. The vulnerability affects versions prior to 2.2.1.

• CVE-2026-10860MEDIUM 6.5

  CVE-2026-10860 is a logic error in MISP's delete handler that allows authenticated users to bypass validation checks and delete records they shouldn't be able to. The flaw stems from a missing parenthesis in the conditional logic that evaluates HTTP DELETE requests, causing the validator to be skipped when a DELETE method is used. While an attacker must already be authenticated, they can exploit this to circumvent application-level protections and remove protected data.

• CVE-2026-10912MEDIUM 6.5

  A flaw in Google Chrome's extension handling allows an attacker who has already compromised the renderer process to bypass the browser's same-origin policy—a core security boundary that prevents JavaScript from one website accessing data from another. An attacker would need to trick a user into visiting a specially crafted webpage to exploit this. The vulnerability affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-10937MEDIUM 6.5

  CVE-2026-10937 is a same-origin policy bypass vulnerability in Google Chrome's password handling logic. An attacker can craft a malicious HTML page that, when visited by a user, exploits an implementation flaw to circumvent Chrome's same-origin policy protections. This could allow unauthorized script execution or data access across domain boundaries, though the actual impact depends on how the flaw is chained with other browser capabilities. The vulnerability affects Chrome versions prior to 149.0.7827.53 and requires user interaction to trigger.

• CVE-2026-10938MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles certain HTML input that could allow an attacker to circumvent site isolation protections, but only if they have already compromised the renderer process. Site isolation is Chrome's core defense that prevents a compromised website from accessing data from other open websites. This vulnerability narrows that protection in specific scenarios.

• CVE-2026-10944MEDIUM 6.5

  A flaw in Google Chrome's autofill feature on iOS could allow an attacker to trick a user into visiting a malicious webpage that extracts sensitive information you've saved in your browser—such as payment details, addresses, or credentials—from other websites you use. The vulnerability requires user interaction (visiting the malicious page) but does not require special system permissions or unusual browser configurations to exploit.

• CVE-2026-10950MEDIUM 6.5

  Google Chrome on iOS has a flaw in how it enforces security policies for the autofill feature. An attacker can trick a user into visiting a specially crafted webpage that leaks sensitive data from other websites the user has visited or logged into. The vulnerability requires user interaction (clicking or visiting a malicious link) but doesn't require any special browser configuration or authentication bypass. It affects Chrome versions before 149.0.7827.53 on iOS devices.

• CVE-2026-10977MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in Skia (Chrome's graphics rendering engine) that could allow an attacker who has already compromised your browser's renderer process to steal data from websites you visit. The attacker would need to trick you into viewing a specially crafted webpage. This is a real but narrowly scoped risk—it requires the renderer to already be under attacker control, limiting the immediate threat from casual browsing.

• CVE-2026-10979MEDIUM 6.5

  A flaw in the ANGLE graphics library used by Google Chrome before version 149.0.7827.53 allows attackers to read memory outside intended bounds. An attacker can craft a malicious HTML page that, when visited by a user, extracts sensitive data from Chrome's process memory—such as authentication tokens, encryption keys, or other confidential information. Exploitation requires user interaction (clicking a link or visiting a site) but no special privileges.

• CVE-2026-10980MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in DevTools that allows an attacker who has already compromised the browser's rendering engine to bypass the same-origin policy—a core security boundary that prevents websites from accessing each other's data. An attacker could craft a malicious HTML page to exploit this, potentially gaining unauthorized access to sensitive information from other websites.

• CVE-2026-10981MEDIUM 6.5

  CVE-2026-10981 is a cross-origin data leak vulnerability in Google Chrome's video codec handling. An attacker who has already compromised Chrome's renderer process can craft a malicious video file to exfiltrate sensitive data from other websites the user is visiting. The vulnerability requires user interaction (opening or playing a video file) and relies on prior compromise of the rendering engine, limiting the attack surface but creating risk for users who already have malware or who visit compromised sites.

• CVE-2026-10985MEDIUM 6.5

  A flaw in Skia, the graphics rendering engine used by Google Chrome, allows attackers to read data they shouldn't have access to by crafting a malicious web page. When a user visits such a page, the browser's memory can leak information from other websites or origins, potentially exposing sensitive data. The attack requires user interaction—clicking a link or visiting a hostile site—but doesn't require any special browser permissions or configuration.

• CVE-2026-10992MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the Animation feature validates user-supplied data. An attacker can craft a malicious HTML page that, when opened in a vulnerable Chrome browser, leaks sensitive information stored in the browser's process memory. The attack requires user interaction (opening the page) but no authentication or special browser configuration.

• CVE-2026-10993MEDIUM 6.5

  A heap buffer overflow vulnerability exists in Skia, the graphics rendering engine used by Google Chrome. By visiting a specially crafted webpage, an attacker can read sensitive data from Chrome's memory without requiring any special user permissions beyond clicking the link. The vulnerability affects Chrome versions before 149.0.7827.53 and has a CVSS severity rating of Medium.

• CVE-2026-10994MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the ANGLE graphics library that can leak sensitive data from your browser's memory. An attacker can craft a malicious webpage that, when you visit it, reads uninitialized memory and potentially extracts information like passwords, tokens, or other private data. The vulnerability requires user interaction (clicking or viewing the page) but does not require special browser permissions.

• CVE-2026-10996MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how Web Workers are implemented that could allow an attacker to bypass the same-origin policy—a fundamental browser security boundary. An attacker could craft a malicious HTML page that, when visited by a user, potentially accesses or modifies content from other websites in the victim's browser session. This requires user interaction (visiting the crafted page) but does not require any special browser features to be enabled.

• CVE-2026-10997MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it enforces policies on extensions. An attacker could craft a malicious extension that, if installed by a user, would be able to bypass access controls that should normally restrict what the extension can do. This is a user-assisted attack—the victim must actively install the extension—but once installed, the extension gains unintended capabilities.

• CVE-2026-10999MEDIUM 6.5

  An integer overflow vulnerability exists in ANGLE (a graphics abstraction layer) within Google Chrome on Windows. Before version 149.0.7827.53, this flaw could allow an attacker who already controls the Chrome renderer process to read sensitive data from memory by tricking a user into viewing a specially crafted webpage. The vulnerability requires user interaction (clicking a link or visiting a malicious site) but does not allow the attacker to modify data or crash the browser.

• CVE-2026-11001MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the Payments feature that allows attackers to create a fake user interface through a specially crafted webpage. To exploit this, an attacker would need to trick a user into performing specific interactions—such as clicks or gestures—on the malicious page. The attack does not steal data or crash the browser, but instead deceives the user by making the browser display content that appears to come from a trusted source, when it actually originates from the attacker. This is a medium-severity issue that depends on user interaction to succeed.

• CVE-2026-11006MEDIUM 6.5

  A memory safety flaw in Google Chrome's Dawn graphics component (used for GPU rendering) allows attackers to read sensitive data from a user's memory by tricking them into visiting a specially crafted webpage. The vulnerability does not enable code execution or system crashes, but confidentiality is at risk. Chrome versions prior to 149.0.7827.53 are affected.

• CVE-2026-11007MEDIUM 6.5

  A flaw in Google Chrome's WebView on Android allows an attacker who has already compromised Chrome's renderer process to steal sensitive data from other websites. The vulnerability stems from inadequate validation of user-supplied input, making it possible for an attacker to craft a malicious webpage that leaks cross-origin information—data that should remain isolated between websites. While the attacker must first gain control of the renderer process, the subsequent data leakage requires only that a user visit a crafted page, making this a meaningful risk in multi-stage attack chains.

• CVE-2026-11008MEDIUM 6.5

  A flaw in Google Chrome's web app installation feature fails to properly validate user input, allowing an attacker who has already compromised Chrome's renderer process to extract sensitive data from other websites through a malicious webpage. The attacker would need to trick a user into visiting a crafted HTML page, but once the renderer is compromised, the vulnerability creates a pathway to leak cross-origin information that should remain isolated.

• CVE-2026-11013MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser validates user-supplied input within its networking code. An attacker who has already compromised Chrome's renderer process—the sandboxed component that executes web content—can craft a malicious HTML page to leak sensitive data from the renderer's memory. This is a post-compromise attack vector; the attacker must first gain code execution in the renderer sandbox, but once there, they can extract information that should remain private.

• CVE-2026-11014MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a vulnerability where insufficient policy enforcement in the extension system allows a malicious extension to circumvent Site Isolation—Chrome's security boundary that prevents one website from accessing another's data. An attacker must first convince a user to install the malicious extension, but once installed, the extension can read or modify data across websites that the user visits, potentially exposing sensitive information.

• CVE-2026-11016MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw where insufficient validation of network input allows a remote attacker who has already compromised the browser's renderer process to bypass the same-origin policy. An attacker could craft a malicious HTML page to force the compromised renderer to access resources or data from a different origin, violating the security boundary that normally prevents cross-origin access. This requires initial renderer process compromise—the attacker cannot trigger the vulnerability from an unauthenticated network position alone.

• CVE-2026-11017MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Link Preview feature handles navigation restrictions. If an attacker first compromises Chrome's renderer process—the component that displays web content—they can craft a malicious HTML page to bypass restrictions that normally prevent unauthorized navigation. The vulnerability requires prior renderer compromise, limiting its immediate attack surface, but it does allow an attacker with that foothold to navigate to restricted locations without proper authorization.

• CVE-2026-11018MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser enforces navigation policies. An attacker can craft a malicious HTML page that, when visited, tricks Chrome into allowing navigation to restricted destinations that should normally be blocked. The vulnerability requires user interaction—a person must visit the hostile page—but no special privileges are needed on the attacker's side. The core risk is integrity: an attacker can redirect you to unwanted sites, potentially enabling phishing, malware distribution, or social engineering attacks.

• CVE-2026-11019MEDIUM 6.5

  A vulnerability in Google Chrome's payments implementation on Android allows an attacker who has already compromised the browser's rendering engine to trick users into believing they are interacting with a legitimate website when they are actually on a fraudulent one. The attacker would craft a deceptive HTML page that spoofs the domain name displayed to the user, potentially leading to credential theft, payment fraud, or other social engineering attacks. This requires an initial compromise of the renderer process, which limits the immediate exposure but represents a serious escalation risk once that initial foothold is established.

• CVE-2026-11020MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the browser handles extensions that process XML files. An attacker can craft a malicious XML file that, when processed by a vulnerable extension, leaks sensitive data from other websites the user has visited. The vulnerability requires user interaction—specifically, the user must open or interact with the malicious file—but does not require the attacker to have special privileges or bypass additional security controls. This is a cross-origin data leak, meaning information intended to be isolated between websites can be extracted by an attacker.

• CVE-2026-11022MEDIUM 6.5

  CVE-2026-11022 is a same-origin policy bypass vulnerability in Google Chrome's DevTools that requires an attacker to have already compromised the renderer process. An attacker could then use a specially crafted HTML page to escape origin restrictions, potentially accessing or modifying data from other websites in the same browser session. This is not a remote code execution vector but rather a privilege escalation within an already-compromised rendering context.

• CVE-2026-11023MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the browser handles web app installation that allows an attacker who has already compromised the browser's renderer process to bypass the same-origin policy. This means a specially crafted web page could be used to access or modify content from other websites in ways the browser is supposed to prevent. The attacker needs prior renderer compromise, limiting the immediate threat to users, but the bypass itself is reliable once that initial foothold exists.

• CVE-2026-11025MEDIUM 6.5

  Google Chrome on Android contains a flaw in how it enforces content security policies (CSP) during navigation. An attacker can craft a malicious HTML page that, when visited by a user, bypasses the browser's CSP protections. This allows the attacker to inject or execute unintended content within a page that should be restricted. The vulnerability requires user interaction (visiting a malicious site) and affects Chrome versions before 149.0.7827.53 on Android devices.

• CVE-2026-11026MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how extensions are handled that allows an attacker to bypass built-in navigation restrictions. The vulnerability requires social engineering—an attacker must trick a user into installing a malicious Chrome extension. Once installed, the extension can circumvent the browser's navigation safeguards, potentially redirecting users to unintended destinations or enabling other attack chains. This is classified as a Medium severity issue by Chromium's security team.

• CVE-2026-11027MEDIUM 6.5

  A vulnerability in Google Chrome's Glic component fails to properly validate untrusted input, allowing an attacker who has already compromised Chrome's renderer process to extract sensitive data across website boundaries using a specially crafted webpage. The attacker needs initial renderer process compromise but then gains the ability to read data from sites the user visits, bypassing normal browser security boundaries.

• CVE-2026-11032MEDIUM 6.5

  Google Chrome's Password Manager contained a flaw that could allow an attacker to trick users into visiting a malicious webpage and leak sensitive data from other websites the user visits. The vulnerability requires user interaction—visiting a crafted HTML page—but once triggered, could expose cross-origin information that should remain isolated between websites. This affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-11033MEDIUM 6.5

  A memory initialization flaw in Chrome's WebML component on macOS allows attackers to steal sensitive data. When a user visits a malicious webpage, the browser may leak uninitialized memory contents—potentially exposing passwords, tokens, or other private information—without requiring any special user interaction beyond loading the page. The issue affects Chrome versions before 149.0.7827.53 on Apple's macOS.

• CVE-2026-11036MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a DOM implementation flaw that allows attackers to circumvent the same-origin policy—a fundamental browser security boundary. An attacker could craft a malicious HTML page that, when visited, tricks the browser into allowing cross-origin requests or data access that should normally be blocked. This requires user interaction (clicking a link, visiting a site) but does not require any special privileges. While the attack does not expose sensitive data directly, it enables unauthorized modification of web content or session state, potentially leading to account compromise or malware injection.

• CVE-2026-11038MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how Subresource Integrity (SRI) policies are enforced, allowing attackers to bypass Content Security Policy (CSP) protections through crafted network traffic. An attacker would need to trick a user into visiting a malicious webpage to exploit this vulnerability. The issue is classified as medium severity because it enables content injection attacks but does not directly compromise confidentiality or system availability.

• CVE-2026-11039MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in Skia (the graphics rendering engine) that could allow an attacker to trick users into visiting a malicious webpage and leak sensitive data from other websites the user has open. The vulnerability requires user interaction—clicking or visiting a link—but does not require any special system privileges. Once triggered, an attacker could read private information from cross-origin sources, such as data from other tabs or windows.

• CVE-2026-11044MEDIUM 6.5

  A memory access bug in Chrome's graphics engine (ANGLE) allows an attacker to steal sensitive data from your browser's memory. The attacker simply needs to trick you into visiting a malicious webpage—no special privileges or software manipulation required. This affects Mac users running Chrome versions before 149.0.7827.53. The vulnerability is classified as medium severity because while an attacker can read data from memory, they cannot crash your browser or modify files.

• CVE-2026-11045MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in GPU input validation that can leak sensitive data from memory. An attacker who has already compromised Chrome's renderer process can craft a malicious HTML page to read protected information. This is a stepping-stone attack—it requires prior renderer compromise but can extract valuable secrets afterward.

• CVE-2026-11048MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how extensions are handled that could allow a malicious extension to bypass the same-origin policy—a core browser security feature that prevents websites from accessing data across different origins. An attacker would need to trick a user into installing a malicious extension, but once installed, the extension could potentially access or modify content on websites that it shouldn't normally be able to reach. This is a medium-severity issue that affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11051MEDIUM 6.5

  A memory reading flaw exists in the ANGLE graphics component of Google Chrome on Linux systems prior to version 149.0.7827.53. An attacker can craft a malicious webpage that, when visited, reads data from Chrome's process memory—potentially exposing sensitive information like credentials, cryptographic keys, or other in-memory secrets. The vulnerability requires user interaction (clicking or viewing a link) but does not allow the attacker to modify data or crash the browser.