By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

2331 published vulnerabilities · page 24 of 24

• CVE-2026-52846MEDIUM 4.2

  Caddy's stripHTML template function, designed to remove HTML tags from user input, has a flaw that allows certain malformed HTML patterns to bypass its filtering logic. Specifically, malformed tags like <<>img src=x onerror=alert()> can slip through, potentially leaving executable scripts in the output if that output is later rendered as HTML in a browser. This creates a client-side XSS vulnerability when applications use stripHTML to sanitize untrusted content but then display the result unsafely. The flaw affects Caddy versions prior to 2.11.4.

• CVE-2026-53860MEDIUM 4.2

  OpenClaw versions before 2026.5.7 contain a flaw in the BlueBubbles feature that allows authenticated users to bypass sender identity verification. Instead of confirming the actual sender, the system can be tricked into matching allowlist rules based on conversation metadata—data that attackers can influence. This means an attacker with legitimate access could manipulate conversation identifiers to receive responses that should only go to authorized senders, effectively circumventing access controls meant to restrict agent functionality.

• CVE-2026-53862MEDIUM 4.2

  OpenClaw versions before 2026.5.12 allow attackers to replay bootstrap tokens used during device pairing setup. An attacker who intercepts or obtains a pending bootstrap token can reuse it to request broader permissions than the token's original scope allowed, effectively escalating their access during the pairing process. This vulnerability requires the attacker to have network access and for a user to interact with the malicious request, but it can lead to unauthorized authority being granted to a paired device.

• CVE-2026-54298MEDIUM 4.2

  Astro, a popular web framework, contains a vulnerability in how it processes HTML attributes during server-side rendering. When developers use the spread syntax to pass object properties as HTML attributes—a common pattern for dynamic content—Astro fails to escape keys coming from untrusted sources like APIs or user input. An attacker can craft malicious property names that become unescaped HTML attributes, allowing them to inject event handlers (onclick, onmousemove) or break out of the attribute context entirely to inject new HTML elements. This affects Astro versions before 6.4.6.

• CVE-2026-54319MEDIUM 4.2

  Daytona, a runtime platform for executing AI-generated code and agent workflows, contains a path-traversal vulnerability in versions prior to 0.186. When users specify a volume identifier to mount storage, the system failed to properly validate the path, potentially allowing an authenticated user to reference storage locations outside the intended directories. An attacker with valid credentials could craft a specially formatted volume reference to access or modify files beyond the sandbox's intended scope.

• CVE-2026-57306MEDIUM 4.2

  A CSRF vulnerability in the Jenkins Zowe zDevOps Plugin allows an attacker with login access to Jenkins to trick an authenticated user into performing actions that connect to attacker-controlled systems. By exploiting this flaw, an attacker can force Jenkins to use stored credentials to establish connections to malicious endpoints, potentially exposing those credentials to capture. The vulnerability requires an attacker to already know or obtain valid credential IDs from Jenkins, limiting the immediate exposure scope but creating a clear escalation path for authenticated threats.

• CVE-2026-57307MEDIUM 4.2

  Jenkins Zowe zDevOps Plugin versions 1.1.3.50.ve350c9b_450b_1 and earlier contain a permission check vulnerability that allows users with basic read access to Jenkins to exploit credential handling flaws. An attacker with Overall/Read permission can leverage known credential IDs to connect to arbitrary URLs using those stored credentials, potentially exposing sensitive authentication material. This is a moderate-severity issue that requires authenticated access but poses a real insider threat risk in shared Jenkins environments.

• CVE-2026-9986MEDIUM 4.2

  CVE-2026-9986 is a UI spoofing vulnerability in Google Chrome's OptimizationGuide component that could let an attacker deceive users about what they're seeing on a webpage. The vulnerability requires the attacker to have already compromised Chrome's rendering process—the engine that draws web content. While this limits the immediate attack scope, it represents a meaningful escalation risk for adversaries who have achieved code execution in that sandboxed component. The flaw stems from inadequate validation of user-supplied input before it's used to generate on-screen elements.

• CVE-2024-45636MEDIUM 4.1

  IBM Security QRadar EDR versions 3.12 through 3.12.24 contain a credential storage flaw where user passwords and authentication tokens are stored in plain text on disk. A local attacker with elevated system privileges can read these credentials directly, potentially gaining unauthorized access to QRadar EDR or downstream systems that those credentials protect. This is a local-only attack requiring existing high-level access to the affected system.

• CVE-2024-47263MEDIUM 4.1

  A path traversal flaw in Synology Hyper Backup's web API allows administrators who already have legitimate access to write files outside their intended directory. The vulnerability is constrained to non-sensitive file types, limiting immediate damage, but represents a control-boundary weakness that could enable privilege misuse or lateral movement in environments where admin accounts are compromised or where insider threat is a concern.

• CVE-2026-10052MEDIUM 4.1

  Quay's configuration tool contains a weakness in how it validates LDAP and SMTP settings. When a configuration editor supplies endpoints for these services, the tool connects to them without restricting which IP addresses or hostnames are allowed. An attacker with config editor privileges can abuse this to make the Quay container reach internal network resources, allowing them to map and discover the organization's internal infrastructure from inside the cluster's network position.

• CVE-2026-37700MEDIUM 4.1

  MaxSite CMS version 109.2 contains a cross-site scripting (XSS) vulnerability in its backend file upload feature that allows authenticated attackers to inject malicious scripts. When an administrator performs a file upload through the admin page endpoint, an attacker with login credentials could craft a request that executes JavaScript in the victim's browser, potentially exposing sensitive information displayed during the upload process.

• CVE-2026-42401MEDIUM 4.1

  CVE-2026-42401 is a stored HTML injection vulnerability in Kibana that allows an attacker with write access to an Elasticsearch index to inject malicious markup. When other users view the affected Kibana dashboard or visualization, the injected code is not properly sanitized before rendering in their browser. This can enable unauthorized UI changes and cause the victim's browser to make unintended outbound network requests on their behalf.

• CVE-2026-46692MEDIUM 4.1

  ImageMagick, a widely-used image manipulation tool, contains a heap buffer overwrite vulnerability in its distributed cache service. An attacker with local access to the cache service can trigger the flaw to crash the service, causing a denial of service. The vulnerability affects ImageMagick versions before 6.9.13-48 (legacy branch) and 7.1.2-23 (current branch). While the attack requires local connectivity to the cache daemon and elevated privileges, the impact is confined to availability—not confidentiality or integrity.

• CVE-2026-46693MEDIUM 4.1

  ImageMagick, a widely-used open-source image manipulation suite, contains a race condition vulnerability in its distributed cache service. An attacker with local access to a system running the magick -distribute-cache service can exploit a timing window to hijack a file descriptor belonging to the server process, potentially gaining unauthorized read access to sensitive data the server is handling. This is a local privilege escalation scenario requiring both network access to the cache service and precise timing to trigger.

• CVE-2026-46771MEDIUM 4.1

  CVE-2026-46771 is a localized privilege-escalation vulnerability in Oracle Application Development Framework (ADF) that allows a highly privileged attacker already logged into the infrastructure to access sensitive application data. The attacker must be an administrative user on the machine running ADF, and even then exploiting it requires specific conditions to be met. The primary risk is unauthorized disclosure of data within ADF systems—the vulnerability does not enable attackers to modify or delete data, nor does it allow takeover of the ADF service itself.

• CVE-2026-47165MEDIUM 4.1

  ImageMagick, a widely-used open-source image manipulation tool, contained a flaw in how its distributed pixel cache system authenticated connections. The distributed pixel cache feature, which allows ImageMagick instances to share pixel data across systems, did not require proper authentication before versions 6.9.13-48 and 7.1.2-23. An attacker with high privileges on the same system could potentially read sensitive pixel data—such as confidential images being processed—without authorization. This is a local-only issue affecting system administrators and environments where multiple users or services share the same ImageMagick installation.

• CVE-2026-4983MEDIUM 4.1

  Open VSX Registry, an extension marketplace used by developers, has a vulnerability where it fails to properly secure SVG image files that extensions upload as icons. When someone views the icon directly, malicious code embedded in the SVG can execute in their browser. The impact depends on how the registry is hosted: if it uses its own servers, an attacker can steal session tokens and impersonate users; if it relies on external cloud storage like Amazon S3, the risk is lower but attackers can still create convincing fake login pages to harvest credentials.

• CVE-2026-56272MEDIUM 4.1

  Flowise versions before 3.0.13 use weak password hashing configuration that makes user account credentials significantly easier to crack if a database is compromised. The application relies on bcrypt with only 5 salt rounds (32 iterations), whereas security best practices call for at least 10 rounds. This 30x speed advantage in cracking attempts means attackers with GPU hardware can recover plaintext passwords from stolen hashes much faster than intended.

• CVE-2019-25723MEDIUM 4.0

  Dräger Perseus A500 ventilators running software versions 2.00 through 2.02 are vulnerable to a denial-of-service attack. An attacker on the network can send malformed data through the Medibus medical interface to crash the device's processor, forcing a warm restart. During this restart—which lasts several seconds—ventilation pressure drops to ambient level, temporarily interrupting therapy delivery before the device recovers. This is a network-accessible vulnerability with no authentication required, making it a genuine concern for clinical environments.

• CVE-2019-25734MEDIUM 4.0

  Contact Form by WD version 1.13.1 has a security flaw that combines two weaknesses: a cross-site request forgery (CSRF) vulnerability and local file inclusion (LFI). An unauthenticated attacker can craft a malicious web form that, when visited by an admin, tricks the admin's browser into loading arbitrary files from the server using directory traversal sequences. This bypasses the normal authentication checks on certain WordPress AJAX actions, potentially exposing sensitive files.

• CVE-2021-4479MEDIUM 4.0

  Dräger Atlan A350 patient monitoring devices running firmware versions 1.00 through 1.01 are vulnerable to a denial-of-service attack delivered through the Medibus network interface. An attacker can send malformed data packets that the device fails to validate properly, causing the internal processor to become overloaded. Over several hours, this degradation manifests as loss of data transmission capability, delays in displaying vital sign curves, and discrepancies between measured airway pressure and displayed values—conditions that could compromise clinical decision-making in critical care settings.

• CVE-2026-10099MEDIUM 4.0

  XX-Net V5.16.6 has a flaw in how it processes WebSocket communications that causes data corruption. When a client sends WebSocket frames without proper masking, the server incorrectly interprets the first 4 bytes of the message as a mask key (even when masking wasn't used), then mangles the rest of the data by applying the wrong decryption. This results in corrupted data being processed by the application. The vulnerability affects local attack scenarios and has medium severity.

• CVE-2026-10998MEDIUM 4.0

  CVE-2026-10998 is a memory safety issue in Google Chrome's media handling code that allows an attacker positioned on the same local network to read data from memory locations they shouldn't have access to. The vulnerability exists in Chrome versions before 149.0.7827.53. An attacker would need to send specially crafted network traffic to trigger an out-of-bounds read, which could potentially expose sensitive information resident in the browser's memory. This is a local-network-only threat, meaning the attacker must be on your network segment to exploit it.

• CVE-2026-28581MEDIUM 4.0

  A logic error in Android's call processing code allows an application to initiate emergency calls without proper authorization checks. The vulnerability stems from inadequate validation in the CallIntentProcessor when determining the initiating user, potentially enabling an app to trigger emergency dialing functionality that should be restricted. No user interaction is required for exploitation, and the issue affects multiple Android versions.

• CVE-2026-41714MEDIUM 4.0

  Spring AMQP applications that connect to RabbitMQ brokers using AMQPS URIs without explicitly enabling SSL validation are vulnerable to man-in-the-middle attacks. While the connection appears encrypted, the application skips critical TLS certificate and hostname verification steps, allowing an attacker to intercept credentials and sensitive message data. This occurs when developers configure RabbitConnectionFactoryBean with an amqps:// URI but omit the setUseSSL(true) call, creating a false sense of security.

• CVE-2026-45536MEDIUM 4.0

  Netty, a widely-used Java network framework, has a file descriptor leak in its Unix domain socket implementation when handling multi-fd messages. When a peer sends a crafted control message carrying multiple file descriptors via SCM_RIGHTS, Netty's receiver allocates a fixed buffer that happens to fit the kernel's response exactly. The code then performs a validation check that fails due to the unexpected message format, causing the installed file descriptors to never be closed. Applications using DomainSocketChannel with FILE_DESCRIPTORS read mode—a non-default opt-in feature—can leak two file descriptors per malicious message received from a peer on the same host. This degrades availability by exhausting the process's file descriptor limit.

• CVE-2026-46559MEDIUM 4.0

  ImageMagick, a widely used open-source image editing tool, contains a flaw in how it validates JP2 (JPEG 2000) image files. When processing certain malformed JP2 files, the software writes a single byte of data beyond the boundaries of an allocated memory region. While limited to overwriting one byte, this heap buffer overflow could cause the application to crash or, in specific configurations, enable an attacker to influence program behavior. The issue affects ImageMagick versions before 6.9.13-48 and 7.1.2-23.

• CVE-2026-53464MEDIUM 4.0

  ImageMagick versions before 7.1.2-25 leak a small amount of memory when the wand option parser receives invalid input. An attacker with local access could trigger this repeatedly to consume system memory and degrade performance or cause denial of service. The issue is low-impact but present in all affected versions.

• CVE-2026-56357MEDIUM 4.0

  n8n's GitHub Webhook Trigger node accepts webhook requests without verifying their authenticity, allowing attackers to forge webhook events if they know the webhook URL. An attacker could send spoofed GitHub webhook payloads directly to a workflow, potentially triggering unintended automation actions. This is a signature verification bypass rather than a complete authentication failure, meaning the vulnerability requires knowledge of the specific webhook URL but does not require credentials or sophisticated network access.

• CVE-2026-57053MEDIUM 4.0

  GNU libidn, a widely-used library for handling internationalized domain names, contains a flaw in its ToUnicode conversion APIs that can read uninitialized memory from your system. This occurs when the library processes certain domain name conversions, potentially exposing sensitive data that happened to be in memory. The vulnerability affects libidn versions before 1.44; the newer libidn2 implementation does not have this issue. While the attack requires local access and specific conditions to trigger, the combination of memory disclosure and potential data corruption makes it a meaningful security concern for systems that process untrusted international domain names.