By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 27 of 41

• CVE-2020-25900MEDIUM 5.3

  HelloTalk, a language exchange and social networking application, contains a privacy flaw in versions through 3.4.1 where the app stores precise GPS coordinates even when users intend to share only their country or city location. These full-precision coordinates are inadvertently saved to a local database accessible by other users' clients. While the client-side database was encrypted in a 2019 update, the vulnerability persists in how location data is initially processed and stored, creating an unintended disclosure of user whereabouts to a level of granularity the user did not authorize.

• CVE-2023-33854MEDIUM 5.3

  IBM's Db2 database platform, when deployed on Cloud Pak for Data, contains a weakness that allows authenticated users to bypass client-side security checks and alter input data through man-in-the-middle (MITM) attacks. The vulnerability affects Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data across versions 4.8 through 5.3. While this requires an attacker to already have valid credentials and network positioning, successful exploitation could lead to unauthorized data modification without detection by client-side safeguards.

• CVE-2023-40200MEDIUM 5.3

  A WordPress plugin called WP Logo Showcase Responsive Slider and Carousel contains a flaw that allows attackers to bypass access controls by manipulating user-controlled parameters. An attacker can exploit this to perform unauthorized actions—specifically modifying content—without needing to authenticate or interact with a legitimate user. The vulnerability affects all versions through 3.6.

• CVE-2024-21944MEDIUM 5.3

  CVE-2024-21944 is a medium-severity memory integrity flaw tied to how systems validate Serial Presence Detect (SPD) metadata on memory modules. An attacker with privileged access (ring0 code execution), physical access to hardware, or control over firmware update mechanisms could bypass input validation and corrupt guest virtual machine memory. The impact is data integrity loss for virtual machines—a guest's memory contents could be overwritten without authorization. This is not an easy exploit to execute in typical environments, requiring either high system privileges, hands-on access to the machine, or compromise of the firmware update chain.

• CVE-2024-27891MEDIUM 5.3

  Arista EOS devices that simultaneously use MACsec (a security protocol encrypting layer 2 traffic) and egress Access Control Lists (ACLs) on the same network interfaces may fail to enforce the intended ACL policies on outgoing traffic. This means packets that should be blocked by policy could be allowed to leave the device, or conversely, traffic that should be permitted might be incorrectly denied—effectively breaking the network's egress filtering controls.

• CVE-2024-33909MEDIUM 5.3

  Avirtum iPages Flipbook versions up to and including 1.5.1 contain a missing authorization flaw that allows unauthenticated attackers to read sensitive information by bypassing access control security levels. An attacker can access data they should not have permission to view without needing to authenticate or interact with a user. This is a straightforward but serious vulnerability that requires immediate attention if you deploy this software.

• CVE-2025-10268MEDIUM 5.3

  The Printcart Web to Print Product Designer plugin for WooCommerce, a WordPress extension used for customizable product design workflows, contains a path traversal vulnerability affecting versions through 2.4.8. An attacker can exploit this flaw to browse and retrieve directory listings from arbitrary locations on the affected web server without authentication. While the vulnerability does not allow file modification or system disruption, it exposes the directory structure and potentially sensitive file names that could inform further reconnaissance or attacks.

• CVE-2025-12714MEDIUM 5.3

  A widely used WordPress SEO plugin has a security hole that allows anyone on the internet—even without a WordPress account—to change critical SEO settings and site metadata. An attacker could modify your site's homepage title, meta descriptions, breadcrumb labels, and social media preview information without permission. This creates two problems: it can tank your search engine rankings, and it opens the door to injecting malicious content that visitors see across your site.

• CVE-2025-15657MEDIUM 5.3

  CVE-2025-15657 is a security flaw in School Management software (versions 93.1.0 and earlier) that allows unauthenticated attackers to view data they shouldn't have access to. The vulnerability stems from improper access controls on specific resources—an attacker can directly request or manipulate object identifiers in URLs or API calls to retrieve sensitive information without logging in. While the flaw enables unauthorized information disclosure, it does not permit modification of data or system unavailability.

• CVE-2025-15666MEDIUM 5.3

  Open Asset Import Library (Assimp) versions up to 5.4.3 contain a heap buffer overflow vulnerability in the model file handler's scene combining function. An attacker with local system access can manipulate image dimension parameters (width/height) to trigger memory corruption. The vulnerability requires local access and user-level privileges to exploit, making it primarily a concern in environments where untrusted users can execute code or submit malicious 3D model files to applications using Assimp.

• CVE-2025-46308MEDIUM 5.3

  Apple has addressed an authorization flaw affecting iOS, iPadOS, and macOS that could allow installed apps to access sensitive user information without proper permission checks. The vulnerability stems from inadequate state management in the platform's authorization framework. While the issue requires a malicious or compromised app to be present on a device, the potential for information disclosure makes this a meaningful security concern for users managing sensitive data. This is not currently known to be exploited in the wild, but the low barrier to exploitation (no user interaction required, network accessible) warrants timely patching.

• CVE-2025-53302MEDIUM 5.3

  CVE-2025-53302 is a missing authorization vulnerability in Anton Shevchuk's Constructor framework that allows unauthenticated attackers to access functionality that should be restricted by access control rules. An attacker can reach protected features without proper credentials or permissions, potentially exposing sensitive operations or data. The vulnerability affects Constructor versions up to and including 1.6.5.

• CVE-2026-10029MEDIUM 5.3

  The Event Koi Lite plugin for WordPress has a flaw that allows anyone on the internet to view sensitive details about events that are supposed to be hidden. Specifically, attackers can retrieve meeting links, venue addresses, coordinates, and RSVP settings for draft, pending, and private events through a function called get_events. No login is required. This affects all versions up to 1.3.13.1.

• CVE-2026-10034MEDIUM 5.3

  The WP DSGVO Tools (GDPR) plugin for WordPress contains a flaw that allows attackers to bypass authentication safeguards and obtain sensitive personal data of any WordPress user without permission. By manipulating request parameters, an unauthenticated attacker can trigger the plugin's Subject Access Request (SAR) processing feature for an arbitrary victim email address, receive direct download links to archives containing that person's data, and then access it without proving they own the account. The vulnerability exists because the plugin's CSRF token—which should act as a security gate—is publicly visible in the SAR form and reused across all visitors, rendering it ineffective.

• CVE-2026-10075MEDIUM 5.3

  DreamMaker, a product from Interinfo, contains a path traversal flaw that lets unauthenticated attackers list or read filenames from any directory on the affected system without requiring authentication or user interaction. An attacker can craft requests using absolute path manipulation to traverse the filesystem and discover file structures that should remain hidden. While this does not allow direct file content theft or system modification, it exposes the directory layout and naming conventions, which can aid reconnaissance in a broader attack chain.

• CVE-2026-10098MEDIUM 5.3

  A flaw in wolfSSL's OCSP (Online Certificate Status Protocol) certificate revocation checking allows an attacker to cause the library to report incorrect revocation status for a certificate. Specifically, if an OCSP response contains status information for a certificate whose serial number is shorter and matches the beginning of another certificate's serial number (both issued by the same CA), wolfSSL could incorrectly report the wrong certificate's revocation status. This happens because the code compared serial numbers byte-by-byte without first checking that they were the same length. An attacker controlling an OCSP responder or intercepting OCSP traffic could exploit this to make a revoked certificate appear valid or vice versa.

• CVE-2026-10200MEDIUM 5.3

  Assimp, a popular open-source 3D model import library, contains a heap-based buffer overflow vulnerability in its glTF file format parser. An attacker with local access to a system can craft a malicious glTF file with a specially crafted 4x4 matrix to overflow memory and trigger a crash, information disclosure, or potential code execution. The vulnerability affects Assimp versions up to 6.0.4 and has been publicly disclosed.

• CVE-2026-10224MEDIUM 5.3

  A vulnerability in NousResearch's hermes-agent allows an attacker to consume resources on a server by sending specially crafted requests to a webhook endpoint. The vulnerability affects versions up to 2026.4.30 and can be triggered remotely without authentication. While the technical complexity is low, the impact is limited to availability rather than data breach or system compromise. Public exploit information exists, though NousResearch has not responded to early vendor disclosure attempts.

• CVE-2026-10229MEDIUM 5.3

  Assimp, a widely-used 3D model import library, contains a heap-based buffer overflow in its Half-Life 1 MDL file loader. An attacker with local system access can craft a malicious .MDL file that, when processed by an application using vulnerable Assimp versions up to 6.0.4, triggers memory corruption. This could lead to information disclosure, data corruption, or process crash. The vulnerability requires local execution and has been publicly disclosed.

• CVE-2026-10230MEDIUM 5.3

  Assimp, a popular open-source 3D model import library, contains a heap buffer overflow vulnerability in its Half-Life 1 MDL file loader. The vulnerability exists in the animation-reading function and can be triggered by a malicious or crafted MDL file. An attacker with local access can exploit this to read sensitive memory, modify data, or crash the application. The vulnerability affects Assimp versions up to 6.0.4.

• CVE-2026-10231MEDIUM 5.3

  Assimp, a popular open-source 3D model importing library, contains a heap buffer overflow vulnerability in its Half-Life 1 MDL file loader. By crafting a malicious MDL file that manipulates the animation value counter, an attacker with local system access can trigger memory corruption. This flaw requires the attacker to be already present on the system and execute code that processes a specially crafted model file, making it a local-origin threat rather than a remote network attack.

• CVE-2026-10232MEDIUM 5.3

  CVE-2026-10232 is a use-after-free vulnerability in Assimp, an open-source 3D model import library, affecting versions up to 6.0.4. The flaw exists in the ASE file parser component and can be triggered by a local attacker with user-level privileges when processing specially crafted ASE (ASCII Scene Export) files. Exploitation could allow an attacker to read sensitive data, modify application state, or crash the process. Because exploitation requires local access and user permissions, the risk is primarily relevant in multi-user systems or scenarios where untrusted ASE files are processed by privileged applications.

• CVE-2026-10254MEDIUM 5.3

  SourceCodester Pet Grooming Management Software version 1.0 contains a vulnerability that exposes file and directory information to unauthenticated remote attackers. An unknown function in the /admin/ path fails to properly restrict access to sensitive filesystem metadata, allowing adversaries to enumerate files and directories without authentication. While this does not permit direct modification or service disruption, the information disclosure can serve as reconnaissance for subsequent targeted attacks. Public exploit code is available.

• CVE-2026-10255MEDIUM 5.3

  A remote access control weakness exists in SourceCodester Pharmacy Sales and Inventory System version 1.0. An unauthenticated attacker can exploit the sell_statement function in the application's form controller to bypass authorization checks and gain unauthorized read access to sensitive pharmacy data. The vulnerability requires no special interaction from users and can be triggered over the network. Because exploit code has already been publicly disclosed, active exploitation risk is elevated.

• CVE-2026-10530MEDIUM 5.3

  The Pie Register WordPress plugin generates account verification tokens using insufficiently random values, meaning attackers can predict valid tokens without knowing a user's email password. This allows an attacker to activate any account by guessing the token, potentially taking over user accounts before the legitimate owner receives their verification email.

• CVE-2026-10548MEDIUM 5.3

  NousResearch's hermes-agent contains a flaw in how it synchronizes Anthropic API credentials from local credential files. An attacker with local access can exploit this to bypass authentication controls, potentially gaining unauthorized access to Anthropic services or resources protected by those credentials. The vulnerability affects versions up to 2026.4.23, and exploit code has already been made public, increasing the practical risk.

• CVE-2026-10566MEDIUM 5.3

  A vulnerability exists in FoundationAgents MetaGPT versions up to 0.8.2 that allows local attackers with user-level privileges to trigger unsafe deserialization through manipulation of function arguments in the Message.check_instruct_content handler. An attacker with local access and basic user permissions can exploit this to potentially read, modify, or disrupt system operations. Public exploit code is available, increasing near-term risk for organizations running affected versions.

• CVE-2026-10592MEDIUM 5.3

  A certificate validation flaw in wolfSSL allowed digital certificates with wildcard DNS names (like *.example.com) to bypass security constraints that should have rejected them. Certificate authorities use name constraints to limit which domains a certificate can be used for—this vulnerability meant those restrictions could be circumvented by using a wildcard entry, potentially allowing an attacker to use a certificate in ways the CA never intended to permit.

• CVE-2026-10597MEDIUM 5.3

  OMICARD EDM, a product developed by ITPison, contains a vulnerability that allows attackers without credentials to access user email addresses by manipulating a specific parameter in a web request. No authentication is required, making this a direct and accessible attack surface. While the vulnerability does not allow attackers to modify data or disrupt service, the unauthorized disclosure of email addresses poses a clear privacy and information-gathering risk.

• CVE-2026-10647MEDIUM 5.3

  A bug in the Zephyr RTOS USB network driver causes the device to freeze and lose network connectivity when the USB host suspends the bus while the Zephyr device is trying to send data. The driver fails silently when the USB hardware rejects a transmission request, then waits forever for a completion signal that never arrives, effectively deadlocking the network stack. Recovery requires a reboot. This is a denial-of-service issue affecting any Zephyr device using USB-based networking that connects to a typical host that implements USB suspend (such as a PC entering sleep mode).

• CVE-2026-10650MEDIUM 5.3

  A flaw in libwebsockets (a widely-used WebSocket and networking library) allows attackers to exhaust server resources by manipulating a specific message length parameter in the SSH protocol handler. The vulnerability requires network access but no authentication, and an exploit has already been published. This is a denial-of-service issue that can make affected systems unresponsive without compromising data confidentiality or integrity.

• CVE-2026-10740MEDIUM 5.3

  AWS's s2n-quic library contains a memory management flaw in its QUIC protocol handler that can be triggered by specially crafted network packets. An unauthenticated attacker can exploit this remotely to degrade service availability by exhausting server memory, without needing credentials or user interaction. The vulnerability affects versions before 1.8.2.

• CVE-2026-11004MEDIUM 5.3

  CVE-2026-11004 is a memory disclosure vulnerability in Google Chrome's ANGLE graphics library. An attacker who has already compromised Chrome's renderer process can craft a malicious HTML page to read sensitive data from the browser's memory. While this requires prior compromise of the renderer, the ability to extract potentially sensitive information makes it a meaningful security concern for organizations running Chrome.

• CVE-2026-11005MEDIUM 5.3

  A flaw in ANGLE, the graphics abstraction layer used by Google Chrome on Windows, allows a remote attacker to read sensitive data from Chrome's renderer process memory. The attacker must first compromise the renderer process and trick a user into visiting a malicious webpage. Once those conditions are met, the attacker can extract potentially sensitive information from memory that they shouldn't have access to. This is an out-of-bounds read vulnerability—the code accesses memory locations it wasn't intended to reach.

• CVE-2026-11098MEDIUM 5.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in GPU handling that allows an attacker with control of the renderer process to extract sensitive data from other websites. The vulnerability requires user interaction and a compromised renderer, making it a targeted risk rather than a mass-exploitation vector. The issue stems from insufficient validation when processing untrusted input, permitting cross-origin information disclosure.

• CVE-2026-11145MEDIUM 5.3

  A race condition in Google Chrome's geolocation feature on Android devices allows attackers to steal sensitive information across website boundaries. By crafting a malicious webpage, an attacker can exploit a timing vulnerability to extract data from other origins—websites or apps—that the user has visited or is logged into. The vulnerability requires user interaction (visiting the malicious page) and specific technical conditions to trigger, but successful exploitation could expose authentication tokens, personal information, or other confidential data from legitimate services.

• CVE-2026-11174MEDIUM 5.3

  CVE-2026-11174 is a Site Isolation bypass vulnerability in Google Chrome that allows an attacker who has already compromised a browser's renderer process to read sensitive data from other websites. The flaw stems from improper implementation of Chrome's Site Isolation feature, a critical security boundary that normally prevents one website from accessing another's data. An attacker would need to first gain control of the renderer process—typically through a separate vulnerability—and then use a specially crafted HTML page to circumvent this protection. While the attack requires a prior compromise, the consequence of success is confidentiality loss across site boundaries.

• CVE-2026-11246MEDIUM 5.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in IndexedDB—a browser feature for storing data locally—that fails to properly validate user input. If an attacker compromises the renderer process (the part of Chrome that displays web pages), they can craft a malicious HTML page to bypass the same-origin policy, a critical security boundary that normally prevents one website from accessing another's data. This requires the attacker to already control the renderer process, which limits the immediate threat but remains a meaningful integrity risk.

• CVE-2026-11379MEDIUM 5.3

  GitLab Enterprise Edition contains an authorization flaw in its DAST (Dynamic Application Security Testing) site profile feature that allows developers to access secrets they shouldn't be able to reach. Under specific circumstances, a user with a Developer role can retrieve sensitive credentials stored in DAST site profiles—such as authentication tokens or API keys—that are meant to be restricted to higher-privilege users. This affects multiple recent versions of GitLab EE and requires patching to resolve.

• CVE-2026-11398MEDIUM 5.3

  The LatePoint calendar booking plugin for WordPress contains a flaw that allows unauthenticated visitors to change customer account information—including names, phone numbers, and notes—without any authorization checks. An attacker can target any existing customer record by submitting a booking form with a known email address. The vulnerability only affects sites where guest bookings are enabled (a common configuration for public-facing appointment systems). This is a medium-severity issue that requires active user interaction on the attacker's part but poses a direct risk to customer data integrity.

• CVE-2026-11458MEDIUM 5.3

  A flaw in erzhongxmu JeeWMS allows unauthenticated attackers to access sensitive information through an exposed Boot Actuator Endpoint at /base-boot/actuator. The vulnerability requires no special conditions to exploit and can be triggered over the network. While the issue is rated MEDIUM severity and does not allow data modification or system disruption, the information disclosure risk warrants prompt remediation. Public exploit code is available, increasing the likelihood of opportunistic attacks.

• CVE-2026-11487MEDIUM 5.3

  Neovim versions up to 0.12.2 contain a command injection vulnerability in the secure.lua module's path-handling function. An authenticated local attacker can manipulate the path argument to execute arbitrary commands with the privileges of the Neovim process. The vulnerability requires local access and user-level privileges, making it a risk primarily in multi-user systems or environments where untrusted users have shell access to machines running Neovim.

• CVE-2026-11497MEDIUM 5.3

  A vulnerability exists in D-Link DCS-5615 network camera firmware version 1.01.00 affecting the Boa web server configuration. An unauthenticated remote attacker can manipulate the web server settings to escalate privileges or modify system functionality without proper authorization. The vulnerability requires no special interaction from the user and can be exploited over the network. While the technical impact is bounded to integrity violations, the ability to alter web server configuration on a networked device introduces operational risk, particularly in environments where the camera serves as a network endpoint with security implications.

• CVE-2026-11515MEDIUM 5.3

  A hard-coded password vulnerability has been discovered in SourceCodester Barangay Resident Profiling and Information Management System version 1.0. The flaw exists in the password reset handler, allowing an attacker to reset user passwords to a predictable hard-coded value rather than the intended new password. This can be exploited remotely without authentication, potentially leading to unauthorized account takeover. The vulnerability has been publicly disclosed and is actively exploitable.

• CVE-2026-11552MEDIUM 5.3

  A remote authentication bypass vulnerability exists in SourceCodester's Online Examination & Learning Management System (also marketed under an alternate name, Syllabus-aligned Learning Management and Examination System) version 1.0. An unauthenticated attacker can manipulate a password parameter in the user import function to trigger use of a hard-coded credential, gaining unauthorized access without valid authentication. The vulnerability requires no user interaction and can be exploited from the network. Public exploit details are available.

• CVE-2026-11620MEDIUM 5.3

  TOTOLINK has released a vulnerability in the EX200 router (version 4.0.3c.7646) that allows an attacker to manipulate vsftpd configuration files remotely without authentication, potentially bypassing security restrictions. The flaw resides in how the device handles file permissions or access controls for the FTP service configuration, enabling an unauthenticated attacker over the network to make unauthorized changes that could weaken the router's security posture.

• CVE-2026-11669MEDIUM 5.3

  A flaw in Google Chrome's media handling on ChromeOS allows an attacker who has already compromised the browser's renderer process to read sensitive information from memory using a specially crafted webpage. The attacker gains access to data that should not be accessible—such as passwords, cryptographic keys, or other process memory contents—without being able to modify or crash the system. This is a memory disclosure vulnerability that requires the renderer process to be already compromised, making it part of a multi-stage attack chain.

• CVE-2026-11678MEDIUM 5.3

  An integer overflow vulnerability exists in libyuv, an image processing library bundled with Google Chrome. The flaw allows an attacker who has already compromised Chrome's renderer process to read sensitive information from memory by serving a specially crafted HTML page. Because the attack requires prior renderer compromise, real-world exploitation involves a multi-stage attack chain rather than direct network exploitation.

• CVE-2026-11696MEDIUM 5.3

  Google Chrome on Windows contains a memory safety bug where uninitialized video-handling code can leak sensitive data from the browser's renderer process. An attacker who has already compromised Chrome's renderer (the process that executes web page code) can craft a malicious HTML page to read uninitialized memory, potentially exposing passwords, session tokens, or other data. The flaw requires the renderer to be under attacker control and user interaction to trigger, making it a secondary attack component rather than a direct entry point. Chrome versions prior to 149.0.7827.103 are vulnerable.

• CVE-2026-11848MEDIUM 5.3

  CVE-2026-11848 is a missing authentication vulnerability in IEI Integration Corp's iRM-IEI Remote Management platform. An attacker on the network can access certain system configuration information without needing valid credentials. While the exposed data is limited to partial configuration details rather than sensitive secrets, the ability to query system state without authentication creates an information disclosure pathway that could support reconnaissance for further attacks.

• CVE-2026-11869MEDIUM 5.3

  The WP DSGVO Tools plugin, used by WordPress sites to manage GDPR data subject access requests, has a flaw that lets anyone request and download a user's personal data without logging in. An attacker only needs to know someone's email address to retrieve their name, address, phone number, email, and website comments. This affects all versions before 3.1.40.

• CVE-2026-11875MEDIUM 5.3

  A widely-used WordPress support ticket plugin fails to properly secure session cookies used by guest users. This means an attacker can forge a guest session to impersonate someone else, gaining access to that person's support tickets without needing credentials. The attacker can read ticket contents, reply on behalf of the ticket owner, and close tickets—but cannot modify the underlying plugin or escalate to administrator access.

• CVE-2026-11896MEDIUM 5.3

  The My Calendar plugin for WordPress has a flaw that allows anyone on the internet to secretly peek at calendar events they shouldn't be able to see. By manipulating a web request parameter, an attacker can view the full details of non-public, draft, trashed, and personal calendar events—including titles, descriptions, dates, locations, and organizer information—without needing to log in or have permission. The vulnerability affects all versions up to 3.7.14 and stems from the plugin failing to properly validate user input before retrieving calendar data.

• CVE-2026-11990MEDIUM 5.3

  KiviCare, a WordPress plugin for managing medical clinics and patient records, contains a flaw that allows attackers to bypass security checks. An attacker can mark pending appointments as confirmed and create fake payment records without actually paying, essentially allowing them to schedule appointments and forge evidence of payment. This works on standard installations because the plugin shows all payment methods even those disabled by administrators, making it easy to exploit.

• CVE-2026-12015MEDIUM 5.3

  A use-after-free vulnerability in Google Chrome's autofill feature allows attackers who have already compromised the browser's renderer process to leak sensitive information from memory. An attacker would need to trick a user into visiting a specially crafted webpage while the renderer is in a vulnerable state. This is not a remote code execution risk on its own, but represents a significant information disclosure threat once an attacker has a foothold in the rendering engine.

• CVE-2026-12025MEDIUM 5.3

  Google Chrome versions before 149.0.7827.115 contain a flaw in how the browser validates input within its Network component. An attacker who has already compromised Chrome's renderer process—the sandboxed environment that executes web content—can craft a malicious HTML page to leak sensitive data across security boundaries that normally prevent one website from accessing another's information. This is a privilege-escalation scenario: it requires the renderer to already be compromised, but then allows the attacker to exfiltrate data that should be protected by the browser's same-origin policy.

• CVE-2026-12033MEDIUM 5.3

  Google Chrome versions prior to 149.0.7827.115 contain an out-of-bounds memory read vulnerability in the VideoCapture component. An attacker who has already compromised Chrome's GPU process can exploit this flaw by serving a specially crafted webpage, allowing them to read sensitive data from the process's memory. This is a post-compromise attack requiring prior GPU process compromise and user interaction.

• CVE-2026-12093MEDIUM 5.3

  The Simple Membership WordPress plugin contains a flaw that allows attackers to forcibly deactivate user accounts without authentication. An attacker can forge a fake payment refund notification that the plugin trusts, causing it to disable a victim's membership account. This only affects websites running version 4.7.5 or earlier that haven't manually configured Stripe webhook security—which is the default setup most sites use out of the box.

• CVE-2026-12094MEDIUM 5.3

  The Advanced Contact Form 7 - Compact DB WordPress plugin up to version 1.0.0 allows unauthenticated attackers to delete contact form submissions. The plugin's deletion function lacks security checks—no authentication requirement, no permission verification, and no ownership validation. An attacker can exploit this by sending requests with sequential form submission IDs to systematically erase user-submitted data without any authorization.

• CVE-2026-12097MEDIUM 5.3

  A WordPress plugin called User Management contains a flaw that allows anyone on the internet—even visitors who are not logged in—to change how the plugin exports user data. Specifically, unauthenticated attackers can manipulate which user fields (including password hashes) get included in CSV exports and how data is mapped during imports. The plugin fails to verify that the person making these configuration changes actually has permission to do so.

• CVE-2026-12120MEDIUM 5.3

  The FireBox Popups plugin for WordPress contains a security flaw that allows anyone on the internet to download complete lists of form submissions, including sensitive personal information like email addresses and names, without needing to log in. An attacker simply needs to guess or identify a form ID number to retrieve all submitted data in CSV format. This affects all versions up to and including 3.1.7.

• CVE-2026-12122MEDIUM 5.3

  The Kirki page builder plugin for WordPress has a flaw that allows anyone on the internet to view sensitive builder metadata and HTML code from unpublished draft pages. An attacker can retrieve this information by guessing sequential post IDs, exposing content that website owners intended to keep private—including incomplete pages, design configurations, and internal HTML structures.

• CVE-2026-12127MEDIUM 5.3

  WPForms, a popular WordPress form-building plugin, contains a flaw that allows unauthenticated attackers to secretly redirect copies of form notification emails to attacker-controlled addresses. The vulnerability stems from improper handling of carriage-return and line-feed characters in form field data when constructing email headers. An attacker can craft a form submission using a textarea field configured as the Reply-To display name to inject additional email headers like Bcc:, causing the site to silently blind-copy all notification emails sent by the form to a third party. This data exfiltration occurs without the site owner's knowledge or consent.

• CVE-2026-12189MEDIUM 5.3

  Moovit Bus & Public Transit App version 1.18 on Android contains a flaw in its custom URL scheme handler that allows a local attacker with user-level privileges to bypass authorization controls. An attacker with access to the device could potentially read, modify, or disrupt app functionality by manipulating how the app processes custom URLs. The vulnerability requires local access and user interaction is not needed once access is gained. Public exploit code exists for this issue.

• CVE-2026-12190MEDIUM 5.3

  A vulnerability in Genspark AI Workspace App version 2.8.4 on Android allows a local attacker with user-level access to bypass authorization checks for custom URL scheme handlers. This means an attacker already on the device could potentially redirect the app to perform actions it shouldn't allow, such as accessing sensitive data or triggering unintended operations. The attack requires local access and does not appear in active exploitation records.

• CVE-2026-12201MEDIUM 5.3

  IObit Malware Fighter versions up to 13.2.0 contain a flaw in its DLL Handler component that allows a local attacker with standard user privileges to gain elevated permissions or access sensitive system information. The vulnerability requires an attacker to be already logged into the system; it cannot be exploited remotely. An exploit has been publicly disclosed, increasing the risk of opportunistic attacks in environments where this software is deployed.

• CVE-2026-12203MEDIUM 5.3

  HKUDS AI-Trader contains a flaw in its research export functionality that allows unauthenticated attackers to access sensitive information through the /api/research/agents.csv endpoint. An attacker can remotely exploit this vulnerability without user interaction to retrieve confidential data. The issue stems from insufficient access controls on the export feature. Public exploit code exists for this vulnerability. The vendor has addressed this by enforcing authentication and capability-based authorization on research export endpoints.

• CVE-2026-12208MEDIUM 5.3

  A prototype pollution vulnerability exists in jsonata-js (jsonata library) versions up to 2.2.0. The vulnerability is in the createFrame function within the Function Binding Frame System, allowing attackers to remotely modify object prototype attributes. An exploit has been publicly disclosed, increasing the risk of widespread exploitation. The vendor has not responded to early disclosure attempts.

• CVE-2026-12209MEDIUM 5.3

  RubyLouvre avalon, a popular Ruby templating library, contains a vulnerability in its filter handling mechanism that allows attackers to manipulate JavaScript object prototypes remotely. An attacker can inject malicious code through the template filter system to alter core object properties, potentially affecting application behavior across an entire system. The vulnerability requires no special privileges or user interaction to exploit, making it straightforward to weaponize. Public exploit code is already available, and the vendor has not responded to early disclosure attempts.

• CVE-2026-12216MEDIUM 5.3

  CVE-2026-12216 is a memory corruption flaw in Duktape, a lightweight JavaScript engine, affecting versions up to 2.99.99. An attacker with local access can manipulate function arguments in the bytecode processing component to corrupt memory, potentially leading to crashes or code execution. The vulnerability has been publicly disclosed with proof-of-concept code available, though the vendor has not acknowledged or released a patch.

• CVE-2026-12238MEDIUM 5.3

  WP Go Maps, a popular WordPress mapping plugin, contains a flaw that allows anyone on the internet to add fake map data—including markers, circles, and polygons—to a website's database without logging in. The vulnerability exists because the plugin fails to verify that requests to create these objects come from authorized users. An attacker exploits this by crafting a malicious request that bypasses the plugin's namespace check, resulting in unauthorized database modifications. While the plugin attempts to block suspicious requests by requiring class names to start with 'WPGMZA', attackers can still use legitimate class names like WPGMZA\Map to slip past this check before the actual authorization logic runs.

• CVE-2026-12276MEDIUM 5.3

  The LA-Studio Element Kit for Elementor WordPress plugin contains a flaw that bypasses account registration controls. Even when a WordPress site administrator has disabled user registration site-wide, attackers can create new accounts by exploiting unauthenticated AJAX endpoints in the plugin. This occurs because the plugin fails to verify whether registration is actually enabled before processing account creation requests.

• CVE-2026-12300MEDIUM 5.3

  Mozilla has patched a memory safety vulnerability affecting Firefox and Thunderbird that could allow an attacker to read sensitive data from affected systems. The flaw exists in how these applications handle memory, and while exploitation requires network access, it does not need user interaction or elevated privileges. The vulnerability is classified as Medium severity and has been resolved in Firefox 152 and Thunderbird 152.

• CVE-2026-12301MEDIUM 5.3

  A memory safety vulnerability has been identified in Firefox and Thunderbird that could allow an attacker to read sensitive information from a user's system. The flaw stems from improper memory handling and has been resolved in Firefox 152 and Thunderbird 152. While the vulnerability requires a network connection to exploit and does not enable code execution or system crashes, it does pose a confidentiality risk. Mozilla has addressed this issue and users should update to the patched versions.

• CVE-2026-12306MEDIUM 5.3

  A memory safety vulnerability was discovered in Firefox and Thunderbird that could allow attackers to read sensitive information from affected systems. The flaw affects the way these applications handle memory, creating a situation where an attacker could potentially access data they shouldn't be able to reach. Mozilla has addressed this issue in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

• CVE-2026-12307MEDIUM 5.3

  A memory safety vulnerability was discovered in Mozilla Firefox and Thunderbird that could allow an attacker to read limited sensitive data from affected systems. The flaw does not enable code execution or system disruption, but it does create a confidentiality risk. Mozilla has addressed this issue in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

• CVE-2026-12308MEDIUM 5.3

  CVE-2026-12308 is a memory safety vulnerability discovered in Mozilla Firefox and Thunderbird. The flaw allows an attacker on the network to read sensitive information from affected systems without requiring user interaction or special privileges. Mozilla has released patched versions that eliminate the underlying memory handling defect. While the vulnerability does not enable unauthorized modifications or system unavailability, the confidentiality impact warrants timely remediation, particularly for users handling sensitive data.

• CVE-2026-12329MEDIUM 5.3

  A memory safety defect affecting Mozilla Firefox and Thunderbird could allow an unauthenticated attacker to cause the application to crash or become unavailable. The vulnerability requires no user interaction and can be triggered remotely over a network. It does not enable data theft or system compromise, but denial-of-service impact is possible.

• CVE-2026-12349MEDIUM 5.3

  The Premium Addons for KingComposer WordPress plugin allows any unauthenticated visitor to create, modify, or delete custom widget areas (sidebars) without logging in. By sending crafted requests to the plugin's AJAX endpoints, attackers can alter the configuration of where widgets appear on a site, causing existing widgets to disappear from pages. This happens because the plugin fails to verify that the person making the request has permission to make such changes.

• CVE-2026-12404MEDIUM 5.3

  NEX-Forms, a popular WordPress form-building plugin, contains a flaw that allows anyone on the internet—even without a login—to download sensitive form submission data that site administrators have saved as reports. An attacker can guess sequential report IDs and retrieve complete records containing names, emails, phone numbers, addresses, payment information, and file paths. This affects all versions up to 9.2.2. The vulnerability stems from missing authorization checks that should verify a user has permission before accessing stored reports.

• CVE-2026-12406MEDIUM 5.3

  A WordPress plugin called User Frontend (versions up to 4.3.7) allows unauthenticated attackers to delete media files that were uploaded by guests or through registration forms. The vulnerability exists because the plugin exposes a security token (nonce) in publicly visible JavaScript on pages where the plugin is active, and then fails to verify that the person requesting a file deletion actually has permission to do so. Any visitor to an affected site can exploit this without logging in.

• CVE-2026-12418MEDIUM 5.3

  A vulnerability in the User Frontend WordPress plugin (versions up to 4.3.7) allows unauthenticated attackers to modify post content on vulnerable sites. By accessing any WPUF post submission form—which doesn't require a WordPress user account—attackers can overwrite titles, body text, and excerpts of arbitrary posts, including those created by administrators. The attack exploits inadequate permission checks in the plugin's AJAX submission handler.

• CVE-2026-12432MEDIUM 5.3

  A flaw in the WP Full Stripe Free WordPress plugin (versions up to 8.4.3) allows unauthenticated attackers to manipulate payment records. The vulnerable AJAX action accepts requests from anyone, including non-logged-in users, and doesn't verify who is making the request or check if they should be allowed to do so. An attacker who knows a valid Stripe Payment Intent ID—information that is normally visible to customers during checkout—can use this flaw to mark successful payments as failed or alter the failure reason and message. This does not expose customer payment data or allow theft, but it does enable tampering with transaction history.

• CVE-2026-12472MEDIUM 5.3

  The Kirki page builder plugin for WordPress contains a flaw that allows anyone on the internet to send convincing phishing emails to your site's users without needing to log in first. These emails can appear to come from your own domain and can include legitimate-looking password reset links, making them effective social engineering weapons. The vulnerability exists in how the plugin handles email composition without proper access controls.

• CVE-2026-12516MEDIUM 5.3

  The Fediverse Embeds WordPress plugin contains a flaw in its media-proxying feature that fails to restrict which URLs the server can fetch. An attacker without any account or authentication can trick the website into making requests to internal networks or private systems, reading back the responses. This turns the vulnerable site into an open proxy—essentially a tool an attacker can point at targets to gather information or attack internal infrastructure.

• CVE-2026-12517MEDIUM 5.3

  The Fediverse Embeds WordPress plugin contains a Server-Side Request Forgery (SSRF) vulnerability that allows unauthenticated attackers to manipulate the plugin's site-info endpoint into fetching internal or private network resources. Because the security nonce protecting this endpoint is exposed on public pages containing embeds, an attacker can craft requests to make the vulnerable site retrieve URLs it shouldn't access—such as internal APIs, cloud metadata endpoints, or private network services—and extract the parsed page metadata returned by those requests. This doesn't require authentication or user interaction.

• CVE-2026-12557MEDIUM 5.3

  The Ninja Forms - File Uploads plugin for WordPress contains an authorization flaw that allows anyone on the internet to read debug log entries or delete them entirely, without needing to log in or have any legitimate access. The vulnerability affects all versions up to and including 3.3.29. While an attacker cannot directly access user data through this flaw, the ability to view or destroy debug logs could expose sensitive application information or disrupt incident investigation efforts.

• CVE-2026-12565MEDIUM 5.3

  CVE-2026-12565 is a path traversal vulnerability in an unarchive module that fails to validate where extracted files are written. When processing malicious archive files on older systems running GNU tar (versions before 1.34, common in Ubuntu 20.04, Debian Buster, CentOS 7, and many Docker images), an attacker can craft an archive that extracts files outside the intended directory. This allows writing to arbitrary locations on the filesystem, potentially overwriting critical application or system files. Unlike the prior CVE-2025-10284 which addressed git-specific attack vectors, this vulnerability affects the core archive extraction logic and remains unfixed.

• CVE-2026-12644MEDIUM 5.3

  ts-deepmerge is a JavaScript utility library for merging nested objects. Versions before 8.0.0 have a critical flaw: when merging objects that contain properties named after built-in JavaScript methods like `toString` or `valueOf` with non-function values, the library corrupts the resulting object. Any attempt to use the merged object in a string context—such as logging, concatenation, or template operations—triggers a TypeError crash. This means an application using vulnerable versions of ts-deepmerge can be made to crash by an attacker providing specially crafted JSON or configuration objects for merging.

• CVE-2026-12657MEDIUM 5.3

  The LatePoint calendar and appointment booking plugin for WordPress contains a flaw that allows anyone on the internet—even without logging in—to bypass restrictions on certain services. Specifically, attackers can create bookings for services that should only be available to administrators and staff, potentially filling up reserved appointment slots and creating unauthorized bookings in the system. The vulnerability exists because the plugin fails to properly validate which services a user is allowed to book.

• CVE-2026-12822MEDIUM 5.3

  A code injection vulnerability exists in Langflow (an AI/LLM orchestration framework) up to version 1.9.3, affecting the Bundle URL Loader component. An authenticated local user can manipulate input to the loader to inject and execute arbitrary code on the affected system. The vulnerability requires local access and valid user credentials, limiting its reach to internal threats or compromised accounts. Langflow's maintainers were notified but did not provide a response or patch timeline.

• CVE-2026-12969MEDIUM 5.3

  dnsmasq, a widely-deployed DNS and DHCP server, contains an out-of-bounds read flaw in how it processes DNS response packets. When a remote attacker controls a DNS zone and sends a specially crafted NXDOMAIN response, the vulnerable code reads 10 bytes beyond the intended buffer boundary in heap memory. This can expose residual data from previous DNS transactions—potentially including DNS queries, cached responses, or other transient information—without crashing the service. The vulnerability requires network access and DNS zone control but does not demand user interaction.

• CVE-2026-13023MEDIUM 5.3

  CVE-2026-13023 is a memory disclosure vulnerability in Google Chrome's GPU handling code. If an attacker has already compromised Chrome's renderer process—the sandboxed component that executes web content—they can craft a malicious HTML page to read uninitialized GPU memory, potentially exposing sensitive data from the browser's process memory. This requires two conditions: prior renderer compromise and user interaction with the malicious page. The vulnerability affects Chrome versions before 149.0.7827.197.

• CVE-2026-13030MEDIUM 5.3

  Google Chrome for Android contains a memory initialization flaw in its GPU component that allows attackers to read sensitive information from the browser process. When a user visits a malicious webpage on an affected Android device, the GPU fails to properly initialize memory regions, potentially exposing data such as cached credentials, session tokens, or other process memory contents to the attacker. This is not a crash or denial-of-service issue—the vulnerability specifically enables information disclosure.

• CVE-2026-13122MEDIUM 5.3

  OpenVPN has a vulnerability in versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 that allows an authenticated attacker to crash the VPN server by sending a specially crafted authentication token when external authentication is enabled. The attack requires valid credentials and succeeds only under specific conditions, but once triggered, it causes a denial of service that disrupts all users relying on that OpenVPN instance.

• CVE-2026-13450MEDIUM 5.3

  The GamiPress gamification plugin for WordPress contains a flaw that lets anyone—without logging in—read private activity logs of any user on the site. These logs include badge earnings, point changes, and integration records from WooCommerce, LearnDash, and BuddyPress. The vulnerability exists because the plugin fails to validate who should access these records, and it broadcasts a security token to all website visitors, making the authentication nearly meaningless.

• CVE-2026-13459MEDIUM 5.3

  JetFormBuilder, a popular WordPress form-building plugin, contains a flaw that allows unauthenticated visitors to extract sensitive data from your website's database. Specifically, attackers can retrieve any customer information, payment details, or confidential data stored in WordPress post metadata—including email addresses, phone numbers, billing information, and even login credentials—as long as at least one form on your site uses the plugin's 'get from database' field. The attacker doesn't need to be logged in, and discovery of the necessary parameters is straightforward by simply viewing your public forms.

• CVE-2026-13501MEDIUM 5.3

  ANTLR4, a widely-used parser generator framework, contains a command injection vulnerability in its Go code generation component. The vulnerability exists in how the GoTarget module processes input when invoking the Go formatter (gofmt). An attacker with local system access can craft malicious input that breaks out of the intended command context, allowing arbitrary command execution with the privileges of the user running ANTLR4. This affects ANTLR4 versions up to and including 4.13.2.

• CVE-2026-13503MEDIUM 5.3

  ANTLR4, a widely-used parser generator framework, contains a path traversal vulnerability in how it handles grammar vocabulary imports. An attacker can craft a malicious grammar file that, when processed by the vulnerable tokenVocab handler, reads files outside the intended directory. The flaw requires no authentication and can be exploited remotely by providing a specially constructed grammar option. While the direct impact is limited to information disclosure (reading files the attacker shouldn't access), the vulnerability is now publicly known and actively exploitable.

• CVE-2026-13533MEDIUM 5.3

  Cockpit CMS versions up to 0.12.2 contain a vulnerability in its YAML configuration handler that allows unauthorized file access. An attacker can remotely read sensitive files or access restricted directories without authentication. The issue stems from improper handling of YAML parsing in the configuration module, and exploit code is publicly available. This is a disclosure made without vendor cooperation.