By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

1972 published vulnerabilities · page 20 of 20

• CVE-2026-8422MEDIUM 4.3

  The Remove meta boxes per user role WordPress plugin contains a security flaw that allows attackers to change how meta boxes (content panels) are hidden or shown for different user roles on a WordPress site. An attacker can't do this directly, but by tricking a site administrator into clicking a malicious link, the attacker can force the admin's browser to make unauthorized changes to these visibility settings. The vulnerability affects all versions up to and including 1.01.

• CVE-2026-8611MEDIUM 4.3

  A WordPress plugin called Klamra Paycal for Aspaclaria contains a flaw that allows authenticated users with subscriber-level permissions to access and download invoices belonging to other customers. The vulnerability stems from insufficient access controls on invoice retrieval—an attacker can simply modify an invoice identifier in a request to view sensitive billing data from any customer, including names, email addresses, phone numbers, order amounts, and internal notes. No special privileges or user interaction are required beyond basic authenticated access.

• CVE-2026-8682MEDIUM 4.3

  The 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On WordPress plugin contains a flaw that allows users with basic subscriber access to change critical plugin settings they should not be able to modify. An authenticated attacker can bypass authorization checks to write arbitrary data directly to the plugin's configuration stored in the database, potentially affecting how the 3D viewer and virtual try-on features function across the site.

• CVE-2026-8689MEDIUM 4.3

  The Visualizer: Tables and Charts Manager WordPress plugin contains an authorization bypass flaw that allows logged-in users with minimal privileges (Subscriber level and above) to create chart posts without proper permission checks and to view or modify charts belonging to other users, including site administrators. The vulnerability affects all versions through 3.11.14 and stems from missing capability validation in two critical AJAX functions. While the flaw requires an authenticated account, the low barrier to entry and potential for unauthorized data access make it a meaningful risk for multi-user WordPress installations.

• CVE-2026-8902MEDIUM 4.3

  The AJAX Report Comments plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 2.0.4. An attacker can trick a WordPress site administrator into unknowingly changing critical plugin settings—such as notification email addresses, comment thresholds, success messages, and cookie durations—by crafting a malicious link or webpage. The attack requires social engineering to get an admin to click a link, but once successful, the attacker can alter how the plugin behaves without any authentication.

• CVE-2026-8904MEDIUM 4.3

  The FastPicker plugin for WordPress, which integrates order picking and management capabilities with WooCommerce, contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 1.0.2. An attacker cannot exploit this vulnerability directly; instead, they must trick a WordPress site administrator into clicking a malicious link while logged in. If successful, the attacker can alter critical plugin settings—including webhook toggles and API endpoint URLs for FastPicker and KDZ services—without the administrator's knowledge or consent. This is a configuration-tampering risk rather than a direct data breach vector.

• CVE-2026-8909MEDIUM 4.3

  The WpMobi WordPress plugin contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick administrators into modifying plugin settings and injecting malicious scripts. An unauthenticated attacker can craft a malicious link or webpage that, when clicked by a site admin, silently changes the plugin's General Settings without the admin's knowledge or consent. The vulnerability is particularly concerning because the injected script executes in the admin's browser even when the malicious input fails validation, meaning the attack works regardless of server-side data checks.

• CVE-2026-8940MEDIUM 4.3

  The WP Meta Sort Posts WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to 0.9. An attacker can craft a malicious link or webpage that, when clicked by an administrator, silently changes plugin settings without their knowledge or consent. Specifically, the vulnerability allows modification of the msp_loop_file and msp_nav_location settings. This is possible because the plugin fails to properly validate security tokens (nonces) on the options page. The attack requires social engineering to trick an admin into clicking a link, but once successful, can alter how the plugin sorts and displays posts on the website.

• CVE-2026-8976MEDIUM 4.3

  The RSS Aggregator by Feedzy plugin for WordPress fails to properly verify user permissions, allowing contributors and higher-level users to perform administrative actions they shouldn't be able to access. An authenticated attacker with basic contributor rights can create RSS import jobs, delete all posts from any import, clear error logs, and view sensitive taxonomy and post metadata information. The vulnerability is particularly dangerous because the security token needed to perform these actions is automatically exposed to anyone who can edit posts through the block editor interface—no additional hacking or theft is required.

• CVE-2026-8995MEDIUM 4.3

  The Poll Maker – Versus Polls plugin for WordPress has a flaw that lets logged-in users see sensitive account information they shouldn't access, including password hashes. The vulnerability stems from an AJAX endpoint that returns the entire WordPress user object without proper security checks. Any subscriber or higher can call this endpoint and retrieve not just their own data, but potentially others' account details including email addresses, registration dates, roles, and capabilities. While the exposure doesn't immediately compromise an account, the password hash data could be targeted by offline cracking attempts.

• CVE-2026-9008MEDIUM 4.3

  The Page-list plugin for WordPress contains an authorization flaw in its shortcode feature that allows authenticated users with contributor-level or higher permissions to view sensitive content they shouldn't be able to access. By inserting a specially crafted shortcode into a draft post and previewing it, attackers can extract titles, body text, and metadata from private or draft pages across the entire site. The vulnerability exists because the plugin doesn't verify whether the current user is permitted to view the pages being queried.

• CVE-2026-9015MEDIUM 4.3

  The Equalize Digital Accessibility Checker plugin for WordPress contains a flaw that allows users with basic subscriber access to modify accessibility audit findings they shouldn't be able to touch. An authenticated attacker can change whether issues are marked as ignored, alter the reason for ignoring them, and add comments to any accessibility finding on the site. In some cases, they can perform bulk modifications across multiple related findings at once. This means someone with minimal privileges could systematically hide or dismiss accessibility compliance problems, undermining the integrity of WCAG and ADA audit records without proper authorization.

• CVE-2026-9048MEDIUM 4.3

  Slider Revolution, a popular WordPress plugin, contains a vulnerability that allows authenticated users with basic contributor privileges to view sensitive social media API credentials through a specific AJAX action. An attacker with contributor-level access or higher can call the 'slider.get.full' AJAX action to retrieve raw API tokens and keys—including Instagram OAuth tokens, Flickr API keys, YouTube Data API credentials, and Facebook App IDs—that have been configured within slider settings. This exposure affects plugin versions 7.0.0 through 7.0.14.

• CVE-2026-9050MEDIUM 4.3

  Slider Revolution, a popular WordPress plugin, contains a flaw that allows contributors and higher-privileged users to disable any plugin on a WordPress site without proper authorization checks. An attacker with basic contributor access—a common account level in multi-author sites—can leverage this to shut down security plugins, backup solutions, or other critical extensions. The vulnerability affects versions 6.0.0 through 6.7.55 and 7.0.0 through 7.0.14.

• CVE-2026-9228MEDIUM 4.3

  A WordPress plugin called Timetable and Event Schedule by MotoPress has a flaw that allows users with contributor-level access or higher to see confidential information they shouldn't have access to. Specifically, they can view drafts, pending reviews, and private event posts created by other users, including the content, excerpts, and author information. The vulnerability stems from the plugin failing to properly validate user input when retrieving event data, making it possible to directly access posts by guessing or enumerating their IDs.

• CVE-2026-9234MEDIUM 4.3

  The JTL-Connector for WooCommerce plugin contains authorization flaws that allow low-privileged WordPress users (Subscriber level and above) to perform administrative actions without proper permission checks. Specifically, attackers can change plugin configuration, download sensitive log files containing developer information, and delete those logs. This bypasses WordPress's built-in permission model and could lead to configuration tampering or information disclosure.

• CVE-2026-9241MEDIUM 4.3

  The FOX – Currency Switcher Professional for WooCommerce plugin contains a flaw that lets authenticated users trick the system into thinking they have higher privileges than they actually do. By manipulating a request parameter, a subscriber-level user can impersonate a wholesale customer or administrator to access pricing they shouldn't be able to see. This only matters if your store uses the fixed user-role pricing feature and has set special prices for privileged customer types.

• CVE-2026-9599MEDIUM 4.3

  The Tectite Forms plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 1.3. An attacker can trick a site administrator into clicking a malicious link, which then allows the attacker to change the plugin's settings without the administrator's knowledge. This could include modifying the tectite_forms_button option or other plugin configurations. The vulnerability requires social engineering but poses a real risk to WordPress sites using this plugin.

• CVE-2026-9618MEDIUM 4.3

  The PeachPay plugin for WordPress, which integrates payment processing for Stripe, PayPal, Square, and other providers, contains a cross-site request forgery (CSRF) vulnerability in all versions up to 1.120.46. An attacker can craft a malicious link or webpage that, when clicked by a site administrator, silently deletes all stored Stripe credentials from the site's database without the administrator's knowledge or consent. This disables Stripe payments immediately and requires the administrator to reconfigure the integration. The attack requires social engineering to trick an admin into clicking the link, but requires no special authentication or technical sophistication once the admin takes the bait.

• CVE-2026-9719MEDIUM 4.3

  The LatePoint WordPress plugin, which handles calendar booking and appointment scheduling, contains a security flaw that allows attackers to manipulate invoice statuses without proper authorization. An attacker can craft a malicious link or webpage and, if they trick a WordPress administrator into clicking it, change the status of any invoice—including fraudulently marking unpaid invoices as paid. This works because the plugin fails to properly validate requests before processing status changes.

• CVE-2026-9722MEDIUM 4.3

  The Laiser Tag plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting all versions through 1.2.5. An attacker can craft a malicious link or webpage that, when clicked by a site administrator, silently modifies critical plugin settings without the administrator's knowledge or consent. This includes changes to API keys, tag filtering rules, and tagging behavior—settings that directly control how the plugin functions across the site.

• CVE-2026-9723MEDIUM 4.3

  The Google Plus One Bottom plugin for WordPress contains a cross-site request forgery (CSRF) flaw that allows attackers to manipulate plugin settings without proper authorization. An attacker can craft a malicious link or web page that, when clicked by a site administrator, will change critical plugin configuration options—such as language preferences, callback functions, and URLs—without the administrator's knowledge or consent. This attack requires social engineering to trick an admin into clicking the malicious link, but requires no authentication or technical exploit code to execute.

• CVE-2026-9730MEDIUM 4.3

  The Remove NoFollow Commenter URL plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows unauthenticated attackers to change how the plugin displays comments. An attacker can craft a malicious link or webpage that, when clicked by a WordPress site administrator, silently modifies the plugin's comment settings without the administrator's knowledge or consent. This requires social engineering to trick an admin into visiting the attacker's content, but requires no special technical skills to exploit once that condition is met.

• CVE-2026-9732MEDIUM 4.3

  The EmergencyWP plugin for WordPress has a security flaw that allows attackers to change important plugin settings without authorization. An attacker would need to trick a WordPress site administrator into clicking a malicious link, but if successful, they could alter access controls, email addresses, and other critical configurations. This is a cross-site request forgery (CSRF) vulnerability caused by the plugin failing to properly validate requests before processing them.

• CVE-2026-9791MEDIUM 4.3

  An authenticated user who belongs to a Keycloak organization can request tokens or access APIs in ways that expose organization metadata, even after an administrator has turned off the Organizations feature. This metadata leakage could cause downstream applications (resource servers) to make incorrect access control decisions based on stale or unintended organization information.

• CVE-2026-9798MEDIUM 4.3

  Keycloak's account lockout feature, which temporarily disables accounts after repeated failed login attempts, can be bypassed when an attacker possesses valid client credentials. By using the Client-Initiated Backchannel Authentication (CIBA) flow—a legitimate OAuth 2.0 feature—attackers can circumvent the lockout and continue attempting to authenticate or obtain tokens. This undermines brute-force protection and creates a secondary path for unauthorized access once the attacker has obtained initial client credentials.

• CVE-2026-9807MEDIUM 4.3

  GitLab has patched a flaw in its Community and Enterprise editions where a Project Access Token that was supposed to be blocked could still access private project resources. This happened because the authorization checks weren't applied correctly when a token was revoked or blocked. An authenticated user with permissions to create or manage tokens could potentially exploit this before the fix was released, though the vulnerability requires prior login access and the attacker would need knowledge of or ability to create a blocked token.

• CVE-2026-9907MEDIUM 4.3

  A memory read vulnerability in Google Chrome's Dawn graphics component allows attackers to access sensitive data from different website origins. An attacker can craft a malicious web page that, when visited by a user, tricks Chrome into reading memory beyond intended boundaries and leaking information from other websites the user may have open. This affects Windows systems running Chrome versions prior to 148.0.7778.216.

• CVE-2026-9911MEDIUM 4.3

  CVE-2026-9911 is a memory safety issue in the ANGLE graphics library used by Google Chrome. When a user visits a specially crafted webpage, an attacker can read small amounts of sensitive data from the browser's memory. The vulnerability requires user interaction—visiting the malicious page—but needs no special permissions or browser configuration to exploit. While the data exposure is limited in scope, it could leak sensitive information like passwords, tokens, or cached credentials stored in memory.

• CVE-2026-9913MEDIUM 4.3

  A flaw in the ANGLE graphics library component of Google Chrome prior to version 148.0.7778.216 could allow an attacker to access memory outside intended bounds when a user visits a malicious website. The vulnerability requires user interaction (visiting a crafted page) but does not require special privileges. Potential impacts include disclosure of sensitive information, though the attacker cannot modify data or crash the browser directly through this flaw.

• CVE-2026-9919MEDIUM 4.3

  A WebGL processing flaw in Google Chrome for Android allows attackers to read data they shouldn't have access to by tricking users into visiting a malicious webpage. The vulnerability exists in how Chrome handles certain graphics operations and can leak information across website boundaries, but only affects the Android version of Chrome and requires user interaction to exploit.

• CVE-2026-9921MEDIUM 4.3

  Google Chrome on Android contains a flaw in its WebGL graphics processing where memory buffers may not be properly initialized before use. An attacker can exploit this by crafting a malicious HTML page that, when visited, allows them to read sensitive information from other websites—a cross-origin data leak. The vulnerability requires user interaction (clicking a link or viewing a page) but does not require special privileges or complex attack setup.

• CVE-2026-9929MEDIUM 4.3

  A flaw in how Google Chrome on Android handles WebGL—a technology that enables 3D graphics in web browsers—could allow an attacker to trick a user into visiting a malicious webpage and expose data from other websites the user has open. The attacker cannot force this to happen; the user must interact with the page, such as by clicking or scrolling. This is a cross-origin data leak, meaning sensitive information from one domain could become visible to JavaScript code running on an attacker's domain.

• CVE-2026-9930MEDIUM 4.3

  An out-of-bounds write vulnerability exists in the Dawn graphics component of Google Chrome on macOS. An attacker can craft a malicious HTML page that, when viewed by a user, writes data to memory locations outside the intended bounds of a buffer. This memory corruption could allow an attacker to modify sensitive data or potentially achieve code execution, though the CVSS assessment indicates the integrity impact is limited. The vulnerability requires user interaction—the victim must visit or be directed to the malicious page—and affects Chrome versions prior to 148.0.7778.216 on macOS.

• CVE-2026-9935MEDIUM 4.3

  CVE-2026-9935 is a memory safety issue in Google Chrome's ANGLE graphics library that allows attackers to steal sensitive data from other websites. When you visit a malicious webpage, an attacker can craft it to leak information that should be isolated to other sites you have open. The vulnerability requires user interaction—you must visit the attack page—but the bar for exploitation is otherwise low. Google has classified this as High severity internally, though the CVSS score reflects a more limited scope.

• CVE-2026-9943MEDIUM 4.3

  A memory access flaw in Google Chrome's WebGL implementation on Android allows attackers to read data from other websites through a specially crafted web page. When a user visits the malicious page, the attacker can extract information (such as authentication tokens, session cookies, or sensitive content) from sites the user is logged into. This is a cross-origin data leak—meaning the attacker can access information meant to be isolated to other domains.

• CVE-2026-9955MEDIUM 4.3

  A vulnerability in Google Chrome on iOS versions before 148.0.7778.216 allows attackers to extract sensitive information from websites the user visits. An attacker would craft a malicious webpage and trick a user into visiting it; the page can then read data intended to be private to other websites. This is a cross-origin data leak—a violation of the browser's same-origin policy that normally prevents websites from accessing each other's information.

• CVE-2026-10640MEDIUM 4.2

  Zephyr RTOS contains a use-after-free vulnerability in its IPv6 Neighbor Discovery implementation. When a Zephyr device sends IPv6 neighbor advertisement or solicitation messages, the code attempts to update traffic statistics after the network packet has already been freed by the underlying driver. An attacker on the same network segment can trigger this flaw by sending crafted ICMPv6 packets, potentially causing the device to crash or corrupt memory. The vulnerability affects Zephyr versions 3.3.0 through 4.4.0 and requires no authentication—any adjacent device can trigger it.

• CVE-2026-11479MEDIUM 4.2

  A weakness in the grepai hash implementation allows authenticated users to manipulate how files are indexed and chunked in the Qdrant backend, potentially corrupting data integrity or availability. The vulnerability requires login credentials and involves complex exploitation techniques, making opportunistic attacks unlikely. A fix has been proposed but not yet merged into the main codebase.

• CVE-2026-12453MEDIUM 4.2

  Google Chrome versions before 149.0.7827.155 contain a flaw where insufficient input validation allows an attacker who has already compromised the browser's renderer process to circumvent the same-origin policy through a specially crafted webpage. This means a sandboxed renderer could potentially access or modify data from websites it should not be able to reach, though the attacker must first gain control of the renderer itself—a significant prerequisite.

• CVE-2026-12456MEDIUM 4.2

  A vulnerability in how Google Chrome handles extensions before version 149.0.7827.155 allows a malicious extension to bypass the same-origin policy, which normally prevents web pages from accessing data belonging to other websites. An attacker would need to trick a user into installing a specially crafted malicious extension. If successful, the extension could read or modify sensitive information from other websites the user visits. This is a user-consent attack—the user must be socially engineered into installing the extension first.

• CVE-2026-12457MEDIUM 4.2

  Google Chrome versions prior to 149.0.7827.155 contain a flaw in how extensions are implemented that allows an attacker who has already compromised Chrome's renderer process to escape the site isolation sandbox and access content from different websites. Site isolation is Chrome's core defense that prevents malicious code running on one site from stealing data from another. This vulnerability requires the attacker to have already gained code execution in the renderer—a significant prerequisite—but if achieved, it undermines that critical isolation boundary.

• CVE-2026-12460MEDIUM 4.2

  Google Chrome versions prior to 149.0.7827.155 contain a weakness in how the browser enforces file system access policies. An attacker who has already compromised Chrome's renderer process (the part that executes web content) can exploit this flaw by serving a specially crafted PDF file to bypass Site Isolation—Chrome's security feature that isolates web content from different sites. The vulnerability requires both an existing renderer compromise and user interaction, limiting its standalone exploitability but reflecting a real protection gap once a renderer is already under attacker control.

• CVE-2026-24315MEDIUM 4.2

  SAP Fiori Launchpad contains a URL-crafting vulnerability that allows attackers to trigger unauthorized service calls within the Fiori application domain. When a user clicks a malicious link, the attacker can potentially steal credentials or compromise the user's account. The attack requires the attacker to have detailed knowledge of the system and depends on user interaction—the vulnerability cannot be exploited remotely without a victim opening the malicious URL.

• CVE-2026-41839MEDIUM 4.2

  Spring Framework versions 5.3, 6.1, 6.2, and 7.0 contain a session management flaw in WebFlux applications. If an attacker first compromises a subdomain (through XSS or similar attack), they can trade a known session ID for one belonging to an authenticated user, potentially gaining unauthorized access to that user's account or data. The flaw requires two conditions: initial subdomain compromise and user interaction, which limits its immediate exploitability but remains a meaningful risk in multi-tenant or loosely-segmented environments.

• CVE-2026-41844MEDIUM 4.2

  CVE-2026-41844 is a redirect vulnerability in Spring Framework that allows attackers to craft malicious links causing users' browsers to redirect to arbitrary external websites. The flaw exists in Spring MVC and Spring WebFlux applications configured with a catch-all URL mapping ("/**") where the view name is not explicitly set. An attacker can exploit the 'redirect:' prefix to bypass intended routing controls and send users to phishing sites or other malicious hosts. This requires user interaction—the victim must click a crafted link—and impacts four widely-used versions of Spring Framework spanning multiple release series.

• CVE-2026-41854MEDIUM 4.2

  CVE-2026-41854 is a server-side request forgery (SSRF) vulnerability in Spring Framework caused by incorrect parsing of host names in URLs. When an application uses Spring's UriComponentsBuilder to process a URL provided by an external user, an attacker could craft a malicious URL that causes the application to make unintended requests to internal systems or services. The vulnerability affects Spring Framework versions 7.0.0 through 7.0.7 and 6.2.0 through 6.2.18. Exploitation requires user interaction and presents moderate risk.

• CVE-2026-48104MEDIUM 4.2

  7-Zip versions 9.18 through 26.00 contain a memory safety bug in the SquashFS archive handler that can crash the application or leak heap information when processing a specially crafted archive file. The vulnerability stems from uninitialized memory left in an internal index structure; an attacker can craft a SquashFS archive that causes the handler to read from these uninitialized slots and potentially dereference invalid pointers during directory parsing. The issue is triggered automatically when you open the malicious file—no user interaction beyond that is required. The impact is limited to denial of service and potential information disclosure; the attacker cannot modify files or escalate privileges.

• CVE-2026-48522MEDIUM 4.2

  PyJWT, a widely-used Python library for JSON Web Token handling, has a vulnerability in versions before 2.13.0 where it blindly accepts any URL scheme when fetching public key sets (JWKS). An attacker who can influence the URL used to fetch these keys—through JWT headers, configuration, or OAuth parameters—can trick the application into reading local files, attempting unusual protocol connections (FTP, data URIs), or in certain chained scenarios, forging valid tokens. The vulnerability requires specific conditions: the attacker must control the URL source, and token forgery scenarios require additional application-layer flaws like writable filesystem access.

• CVE-2026-48776MEDIUM 4.2

  A path traversal vulnerability in LangGraph Python SDK versions 0.3.14 and earlier allows authenticated users to manipulate resource identifiers in HTTP requests, potentially accessing or modifying resources they shouldn't have permission to reach. The vulnerability stems from unsafe construction of URL paths using caller-supplied identifiers without proper sanitization. An attacker with valid credentials could craft specially formatted identifier values containing URL path characters to bypass authorization checks, particularly in deployments where access control relies on URL-prefix validation rather than application-level authorization.

• CVE-2026-53860MEDIUM 4.2

  OpenClaw versions before 2026.5.7 contain a flaw in the BlueBubbles feature that allows authenticated users to bypass sender identity verification. Instead of confirming the actual sender, the system can be tricked into matching allowlist rules based on conversation metadata—data that attackers can influence. This means an attacker with legitimate access could manipulate conversation identifiers to receive responses that should only go to authorized senders, effectively circumventing access controls meant to restrict agent functionality.

• CVE-2026-53862MEDIUM 4.2

  OpenClaw versions before 2026.5.12 allow attackers to replay bootstrap tokens used during device pairing setup. An attacker who intercepts or obtains a pending bootstrap token can reuse it to request broader permissions than the token's original scope allowed, effectively escalating their access during the pairing process. This vulnerability requires the attacker to have network access and for a user to interact with the malicious request, but it can lead to unauthorized authority being granted to a paired device.

• CVE-2026-9986MEDIUM 4.2

  CVE-2026-9986 is a UI spoofing vulnerability in Google Chrome's OptimizationGuide component that could let an attacker deceive users about what they're seeing on a webpage. The vulnerability requires the attacker to have already compromised Chrome's rendering process—the engine that draws web content. While this limits the immediate attack scope, it represents a meaningful escalation risk for adversaries who have achieved code execution in that sandboxed component. The flaw stems from inadequate validation of user-supplied input before it's used to generate on-screen elements.

• CVE-2024-45636MEDIUM 4.1

  IBM Security QRadar EDR versions 3.12 through 3.12.24 contain a credential storage flaw where user passwords and authentication tokens are stored in plain text on disk. A local attacker with elevated system privileges can read these credentials directly, potentially gaining unauthorized access to QRadar EDR or downstream systems that those credentials protect. This is a local-only attack requiring existing high-level access to the affected system.

• CVE-2024-47263MEDIUM 4.1

  A path traversal flaw in Synology Hyper Backup's web API allows administrators who already have legitimate access to write files outside their intended directory. The vulnerability is constrained to non-sensitive file types, limiting immediate damage, but represents a control-boundary weakness that could enable privilege misuse or lateral movement in environments where admin accounts are compromised or where insider threat is a concern.

• CVE-2026-10052MEDIUM 4.1

  Quay's configuration tool contains a weakness in how it validates LDAP and SMTP settings. When a configuration editor supplies endpoints for these services, the tool connects to them without restricting which IP addresses or hostnames are allowed. An attacker with config editor privileges can abuse this to make the Quay container reach internal network resources, allowing them to map and discover the organization's internal infrastructure from inside the cluster's network position.

• CVE-2026-37700MEDIUM 4.1

  MaxSite CMS version 109.2 contains a cross-site scripting (XSS) vulnerability in its backend file upload feature that allows authenticated attackers to inject malicious scripts. When an administrator performs a file upload through the admin page endpoint, an attacker with login credentials could craft a request that executes JavaScript in the victim's browser, potentially exposing sensitive information displayed during the upload process.

• CVE-2026-42401MEDIUM 4.1

  CVE-2026-42401 is a stored HTML injection vulnerability in Kibana that allows an attacker with write access to an Elasticsearch index to inject malicious markup. When other users view the affected Kibana dashboard or visualization, the injected code is not properly sanitized before rendering in their browser. This can enable unauthorized UI changes and cause the victim's browser to make unintended outbound network requests on their behalf.

• CVE-2026-46692MEDIUM 4.1

  ImageMagick, a widely-used image manipulation tool, contains a heap buffer overwrite vulnerability in its distributed cache service. An attacker with local access to the cache service can trigger the flaw to crash the service, causing a denial of service. The vulnerability affects ImageMagick versions before 6.9.13-48 (legacy branch) and 7.1.2-23 (current branch). While the attack requires local connectivity to the cache daemon and elevated privileges, the impact is confined to availability—not confidentiality or integrity.

• CVE-2026-46693MEDIUM 4.1

  ImageMagick, a widely-used open-source image manipulation suite, contains a race condition vulnerability in its distributed cache service. An attacker with local access to a system running the magick -distribute-cache service can exploit a timing window to hijack a file descriptor belonging to the server process, potentially gaining unauthorized read access to sensitive data the server is handling. This is a local privilege escalation scenario requiring both network access to the cache service and precise timing to trigger.

• CVE-2026-46771MEDIUM 4.1

  CVE-2026-46771 is a localized privilege-escalation vulnerability in Oracle Application Development Framework (ADF) that allows a highly privileged attacker already logged into the infrastructure to access sensitive application data. The attacker must be an administrative user on the machine running ADF, and even then exploiting it requires specific conditions to be met. The primary risk is unauthorized disclosure of data within ADF systems—the vulnerability does not enable attackers to modify or delete data, nor does it allow takeover of the ADF service itself.

• CVE-2026-47165MEDIUM 4.1

  ImageMagick, a widely-used open-source image manipulation tool, contained a flaw in how its distributed pixel cache system authenticated connections. The distributed pixel cache feature, which allows ImageMagick instances to share pixel data across systems, did not require proper authentication before versions 6.9.13-48 and 7.1.2-23. An attacker with high privileges on the same system could potentially read sensitive pixel data—such as confidential images being processed—without authorization. This is a local-only issue affecting system administrators and environments where multiple users or services share the same ImageMagick installation.

• CVE-2019-25723MEDIUM 4.0

  Dräger Perseus A500 ventilators running software versions 2.00 through 2.02 are vulnerable to a denial-of-service attack. An attacker on the network can send malformed data through the Medibus medical interface to crash the device's processor, forcing a warm restart. During this restart—which lasts several seconds—ventilation pressure drops to ambient level, temporarily interrupting therapy delivery before the device recovers. This is a network-accessible vulnerability with no authentication required, making it a genuine concern for clinical environments.

• CVE-2019-25734MEDIUM 4.0

  Contact Form by WD version 1.13.1 has a security flaw that combines two weaknesses: a cross-site request forgery (CSRF) vulnerability and local file inclusion (LFI). An unauthenticated attacker can craft a malicious web form that, when visited by an admin, tricks the admin's browser into loading arbitrary files from the server using directory traversal sequences. This bypasses the normal authentication checks on certain WordPress AJAX actions, potentially exposing sensitive files.

• CVE-2021-4479MEDIUM 4.0

  Dräger Atlan A350 patient monitoring devices running firmware versions 1.00 through 1.01 are vulnerable to a denial-of-service attack delivered through the Medibus network interface. An attacker can send malformed data packets that the device fails to validate properly, causing the internal processor to become overloaded. Over several hours, this degradation manifests as loss of data transmission capability, delays in displaying vital sign curves, and discrepancies between measured airway pressure and displayed values—conditions that could compromise clinical decision-making in critical care settings.

• CVE-2026-10099MEDIUM 4.0

  XX-Net V5.16.6 has a flaw in how it processes WebSocket communications that causes data corruption. When a client sends WebSocket frames without proper masking, the server incorrectly interprets the first 4 bytes of the message as a mask key (even when masking wasn't used), then mangles the rest of the data by applying the wrong decryption. This results in corrupted data being processed by the application. The vulnerability affects local attack scenarios and has medium severity.

• CVE-2026-10998MEDIUM 4.0

  CVE-2026-10998 is a memory safety issue in Google Chrome's media handling code that allows an attacker positioned on the same local network to read data from memory locations they shouldn't have access to. The vulnerability exists in Chrome versions before 149.0.7827.53. An attacker would need to send specially crafted network traffic to trigger an out-of-bounds read, which could potentially expose sensitive information resident in the browser's memory. This is a local-network-only threat, meaning the attacker must be on your network segment to exploit it.

• CVE-2026-28581MEDIUM 4.0

  A logic error in Android's call processing code allows an application to initiate emergency calls without proper authorization checks. The vulnerability stems from inadequate validation in the CallIntentProcessor when determining the initiating user, potentially enabling an app to trigger emergency dialing functionality that should be restricted. No user interaction is required for exploitation, and the issue affects multiple Android versions.

• CVE-2026-41714MEDIUM 4.0

  Spring AMQP applications that connect to RabbitMQ brokers using AMQPS URIs without explicitly enabling SSL validation are vulnerable to man-in-the-middle attacks. While the connection appears encrypted, the application skips critical TLS certificate and hostname verification steps, allowing an attacker to intercept credentials and sensitive message data. This occurs when developers configure RabbitConnectionFactoryBean with an amqps:// URI but omit the setUseSSL(true) call, creating a false sense of security.

• CVE-2026-45536MEDIUM 4.0

  Netty, a widely-used Java network framework, has a file descriptor leak in its Unix domain socket implementation when handling multi-fd messages. When a peer sends a crafted control message carrying multiple file descriptors via SCM_RIGHTS, Netty's receiver allocates a fixed buffer that happens to fit the kernel's response exactly. The code then performs a validation check that fails due to the unexpected message format, causing the installed file descriptors to never be closed. Applications using DomainSocketChannel with FILE_DESCRIPTORS read mode—a non-default opt-in feature—can leak two file descriptors per malicious message received from a peer on the same host. This degrades availability by exhausting the process's file descriptor limit.

• CVE-2026-46559MEDIUM 4.0

  ImageMagick, a widely used open-source image editing tool, contains a flaw in how it validates JP2 (JPEG 2000) image files. When processing certain malformed JP2 files, the software writes a single byte of data beyond the boundaries of an allocated memory region. While limited to overwriting one byte, this heap buffer overflow could cause the application to crash or, in specific configurations, enable an attacker to influence program behavior. The issue affects ImageMagick versions before 6.9.13-48 and 7.1.2-23.

• CVE-2026-53464MEDIUM 4.0

  ImageMagick versions before 7.1.2-25 leak a small amount of memory when the wand option parser receives invalid input. An attacker with local access could trigger this repeatedly to consume system memory and degrade performance or cause denial of service. The issue is low-impact but present in all affected versions.