By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 28 of 41

• CVE-2026-13571MEDIUM 5.3

  SourceCodester Simple Food Ordering System version 1.0 contains a vulnerability in its shopping cart functionality that allows attackers to manipulate product prices. By modifying the item_price parameter in the /cart.php file, an attacker can alter the cost of items in a customer's cart, leading to incorrect order totals and potential financial losses. This attack requires no authentication and can be executed over the network by anyone with access to the application.

• CVE-2026-13874MEDIUM 5.3

  A race condition exists in Google Chrome's DataTransfer mechanism that allows attackers to leak sensitive information from process memory. An attacker can craft a malicious HTML page that, when visited by a user, exploits timing vulnerabilities to read data that should be protected. While the attack requires user interaction (visiting a malicious website) and careful timing, the potential exposure of process memory contents makes this a meaningful privacy risk.

• CVE-2026-13875MEDIUM 5.3

  A flaw in how Google Chrome processes graphics instructions on Windows systems could allow an attacker who has already compromised your browser's rendering process to steal sensitive data from your computer's memory. The vulnerability requires the attacker to have already gained control of the renderer—the part of Chrome that displays web pages—and requires you to visit a specially crafted webpage. This is not a direct entry point for attackers, but rather a privilege escalation or lateral movement risk for those already inside your browser sandbox.

• CVE-2026-13877MEDIUM 5.3

  A vulnerability in Google Chrome's ANGLE graphics library allows an attacker who has already gained control of the browser's renderer process to read sensitive data from the browser's memory by tricking a user into viewing a specially crafted webpage. The attacker cannot exploit this directly from the internet—they must first compromise the renderer, making this a secondary attack that increases the severity of other browser vulnerabilities. Chrome versions before 150.0.7871.47 are affected.

• CVE-2026-13890MEDIUM 5.3

  A memory safety flaw in Google Chrome's Chromecast component allows an attacker who has already compromised the browser's renderer process to read sensitive data from process memory. The vulnerability requires user interaction (clicking a malicious link or visiting a crafted website) but does not lead to code execution or system crashes. Chrome versions prior to 150.0.7871.47 are affected across Windows, macOS, and Linux platforms.

• CVE-2026-13911MEDIUM 5.3

  A vulnerability in Google Chrome's spell-check feature allows an attacker who has already compromised the browser's rendering engine to read sensitive data from the Chrome process memory by tricking a user into visiting a malicious webpage. The vulnerability requires the attacker to have already gained control of the renderer process and the user to interact with the crafted page, making it a secondary exploitation target rather than a direct entry point. Chrome version 150.0.7871.47 and earlier are affected.

• CVE-2026-13933MEDIUM 5.3

  A vulnerability in Google Chrome versions before 150.0.7871.47 could allow an attacker who has already compromised Chrome's renderer process to read sensitive information from the browser's memory by tricking a user into visiting a malicious webpage. The attacker needs to have control of the renderer process first, limiting the scope of direct risk, but the ability to extract password-related data from memory represents a meaningful escalation once that foothold exists.

• CVE-2026-13947MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a memory safety issue in the Extended Reality (XR) feature that could let an attacker read sensitive data from the browser's rendering process. The attack requires two preconditions: the renderer process must already be compromised, and the user must interact with a malicious webpage. An attacker cannot exploit this vulnerability through the network alone—they need initial code execution within Chrome's sandbox first.

• CVE-2026-13950MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in GPU memory handling that could allow an attacker who has already compromised your browser's renderer process to read sensitive data from memory. The attacker would need to trick you into viewing a specially crafted web page. This is a medium-severity issue that affects confidentiality but not integrity or availability.

• CVE-2026-13961MEDIUM 5.3

  Google Chrome on Windows contains a flaw in its Developer Tools that fails to properly validate user input. An attacker can craft a malicious webpage that, when visited by a user, tricks them into performing specific interactions with DevTools. This manipulation allows the attacker to read sensitive data stored in the browser's process memory, such as authentication tokens, cached credentials, or other confidential information. The vulnerability requires social engineering—convincing a user to engage with DevTools in a particular way—which makes it moderately difficult to exploit in the wild, but the potential information disclosure is significant.

• CVE-2026-13969MEDIUM 5.3

  A vulnerability in Google Chrome for Android allows attackers who have already compromised Chrome's renderer process to read sensitive information from memory through a specially crafted webpage. The flaw stems from the use of uninitialized memory in the UI component, which can leak data that was previously stored in that memory location. An attacker would need to first gain control of the renderer process—typically through a separate compromise—making this a secondary attack vector rather than a direct entry point.

• CVE-2026-13970MEDIUM 5.3

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how the browser handles uninitialized memory in media processing. An attacker who has already compromised Chrome's renderer process—the component that interprets web content—can craft a malicious HTML page that leaks sensitive information from the browser's memory to the attacker. This is not a vulnerability that allows initial system compromise; it requires a prior breach of the renderer process, typically through another security flaw. Once that foothold exists, however, an attacker could extract passwords, authentication tokens, private keys, or other confidential data residing in memory.

• CVE-2026-13971MEDIUM 5.3

  Google Chrome contains a memory safety issue in its Skia graphics library that could allow an attacker to leak sensitive information from the browser's renderer process. If an attacker first compromises the renderer (the part of Chrome that processes web content), they can craft a malicious web page that reads uninitialized memory—data left over from previous operations that shouldn't be accessible. This could expose passwords, session tokens, or other sensitive data. The vulnerability requires the attacker to already have compromised the renderer and requires user interaction to visit the malicious page, making it a secondary concern in most attack chains.

• CVE-2026-13975MEDIUM 5.3

  A memory safety vulnerability exists in the ANGLE graphics library within Google Chrome on macOS that could allow an attacker to read sensitive data from Chrome's memory. The vulnerability requires two conditions: the attacker must first compromise Chrome's renderer process (the part that displays web content), and the user must visit a malicious web page. Once both conditions are met, an attacker could potentially extract sensitive information such as passwords, session tokens, or other data present in Chrome's memory at the time of exploitation.

• CVE-2026-13989MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the PageInfo feature displays information to users. An attacker who has already compromised Chrome's rendering engine can craft a malicious webpage that tricks users into believing they are interacting with a legitimate interface element, when in fact they are not. This is a UI spoofing attack—the attacker cannot steal data or crash the browser, but can deceive users about what they're seeing on screen.

• CVE-2026-14012MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a side-channel vulnerability in how the browser processes CSS that could allow an attacker to leak sensitive information from the browser process's memory. By crafting a malicious HTML page and tricking a user into viewing it, an attacker could potentially extract data that should remain private. The flaw is specific to how CSS rendering interacts with memory access patterns, creating a timing or behavioral difference that leaks information—a classic side-channel attack vector.

• CVE-2026-14049MEDIUM 5.3

  Google Chrome contained a flaw in how it handled GPU operations that could allow an attacker to read sensitive data from memory. The attacker would need to first compromise Chrome's renderer process (the component that processes web page content) and then trick a user into visiting a malicious webpage. If successful, they could extract information that should have remained private. This issue affected Chrome versions before 150.0.7871.47 across Windows, macOS, and Linux systems.

• CVE-2026-14112MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser handles certain user interactions on web pages. An attacker who tricks a user into performing specific gestures (like clicking or dragging) on a malicious webpage can potentially read sensitive data from Chrome's memory. While the Chromium team rates this as low severity, the ability to extract process memory elevates the practical risk. The vulnerability requires active user participation—it cannot be exploited passively.

• CVE-2026-14117MEDIUM 5.3

  A weakness in Google Chrome's developer tools on Windows allows a remote attacker to trick a user into performing specific actions that could leak sensitive information from the browser's process memory. An attacker would craft a malicious webpage and convince a user to interact with it in a specific way—typically involving the DevTools interface—to extract data. This is not a widespread, easily exploitable flaw; it requires user interaction and specific gestures to trigger.

• CVE-2026-14153MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a UI spoofing vulnerability in the Glic component. An attacker can craft a malicious HTML page that, when viewed by a user who performs specific UI gestures (like clicks or interactions), displays fake interface elements that deceive the user into believing they're interacting with legitimate browser controls or content. This is a social engineering attack that relies on user interaction but can expose sensitive information through misdirection.

• CVE-2026-14391MEDIUM 5.3

  An integer overflow vulnerability exists in ANGLE (a graphics abstraction layer used by Chrome) that could allow an attacker who has already compromised your browser's renderer process to read sensitive data from memory. The flaw affects Google Chrome on Windows versions before 150.0.7871.46 and requires both a successful initial compromise and user interaction with a malicious webpage to trigger. While the bar to exploitation is moderately high, the potential exposure of process memory contents warrants timely patching.

• CVE-2026-14414MEDIUM 5.3

  A flaw in Skia, the graphics library used by Google Chrome, allows an attacker who has already compromised Chrome's renderer process to read sensitive information from memory by tricking a user into visiting a malicious webpage. The vulnerability requires the attacker to control the renderer—a significant prerequisite—but once achieved, could leak data like passwords, tokens, or other secrets stored in memory.

• CVE-2026-14500MEDIUM 5.3

  The Bulk Order Update for WooCommerce plugin contains a flaw that allows unauthenticated attackers to read the first line of files stored on affected WordPress servers. The vulnerability exists because an administrative function that processes CSV file uploads accepts user-supplied file paths without proper validation, and doesn't require authentication or verification of the user's identity. This creates two distinct risks: attackers can extract sensitive information (like system configuration files), and they can probe which files exist on the server without triggering alarms.

• CVE-2026-14610MEDIUM 5.3

  Assimp, a widely-used 3D model import library, contains a heap-based buffer overflow flaw in its CSM file handler that allows a local attacker with basic user privileges to corrupt memory and potentially crash the application or cause information disclosure. The vulnerability requires local access and does not grant remote execution, but public exploit code now exists, elevating practical risk.

• CVE-2026-14628MEDIUM 5.3

  NousResearch's hermes-agent contains a path traversal vulnerability in its Live Webhook Endpoint that allows remote attackers to manipulate file paths without authentication. By crafting specific requests to the extract_media function, an attacker can read sensitive files from the server, potentially exposing configuration data, credentials, or other confidential information. The vulnerability affects versions up to 2026.5.16, and exploit code is publicly available.

• CVE-2026-14631MEDIUM 5.3

  webpack-dev-server versions 5.2.5 and earlier can be crashed by an unauthenticated attacker sending a specially crafted HTTP request or WebSocket upgrade message. The vulnerability exists in the host validation logic, which fails to handle malformed headers gracefully. When triggered, it terminates the entire Node.js process running the dev server, causing a denial of service. This affects only development environments and does not expose sensitive data or allow code execution.

• CVE-2026-14687MEDIUM 5.3

  A flaw in 666ghj BettaFish versions up to 1.2.1 allows remote attackers to manipulate how the InsightEngine search-result deduplication function compares strings, potentially causing partial or incomplete string matching. This could lead to incorrect or misleading search results being presented to users. The vulnerability requires no special privileges or user interaction to exploit, and proof-of-concept code has been publicly shared.

• CVE-2026-14723MEDIUM 5.3

  AD-Security's AD_Miner version 1.9.0 contains a flaw in its cache analysis component that allows a local user with basic system access to execute arbitrary code by manipulating how the tool processes cached data. An attacker would need to already have a user account on the system to exploit this; remote attacks are not possible. The vulnerability stems from unsafe handling of serialized data without proper validation.

• CVE-2026-14757MEDIUM 5.3

  An integer overflow flaw exists in radare2, a popular open-source reverse engineering framework, affecting versions up to 6.1.6. The vulnerability resides in the core analysis function and can be exploited by an authenticated local user to trigger memory corruption. While the technical mechanics involve integer overflow, the practical impact is limited to local attackers with existing system access, reducing the immediate risk in typical enterprise environments. Public disclosure has occurred, meaning the general security community now has awareness of the issue.

• CVE-2026-14940MEDIUM 5.3

  A flaw in 389 Directory Server allows an attacker to send specially crafted LDAP search requests that cause the server to write data beyond the boundaries of allocated memory. The vulnerability specifically affects how the server processes certain types of directory names (DNs) containing legacy formatting with nested attributes. An unauthenticated attacker on the network can trigger this condition without logging in, potentially crashing the directory service or corrupting its memory. This is not a weakness that grants unauthorized data access, but rather a stability issue that can disrupt service availability.

• CVE-2026-15035MEDIUM 5.3

  A command injection vulnerability exists in bentoml OpenLLM 0.6.30 where attackers with local access can manipulate the `cmd` argument passed to the `async_run_command` function, allowing them to execute arbitrary system commands. The vulnerability requires local system access and valid credentials, limiting its immediate threat scope but posing risk to multi-tenant or shared development environments. Public exploit information is available.

• CVE-2026-15182MEDIUM 5.3

  GNU LibreDWG versions up to 0.13.4 contain a heap-based buffer overflow vulnerability in the BMP image handling code. An attacker with local access can exploit this flaw to read, modify, or crash sensitive data by manipulating how the application processes BMP files. Upgrading to version 0.14 resolves the issue.

• CVE-2026-15193MEDIUM 5.3

  AidanPark's openclaw-android application, in versions up to 0.4.0, contains a local command injection flaw in its Android WebView Bridge component. A user with local access to the device can craft malicious input through the JsBridge.kt interface to execute arbitrary operating system commands with the privileges of the application. While the vulnerability requires local interaction and does not propagate remotely, it could allow an attacker who has already gained a foothold on a device to escalate capabilities or compromise sensitive data accessible to the app.

• CVE-2026-15204MEDIUM 5.3

  A path traversal vulnerability exists in TOTOLINK X5000R routers that allows an unauthenticated remote attacker to access files outside the intended directory structure through the OpenVPN export feature. An attacker can craft requests to the vulnerable CGI endpoint to read sensitive files on the device, potentially exposing configuration data, credentials, or other confidential information stored on the router.

• CVE-2026-15302MEDIUM 5.3

  The ARMember plugin for WordPress has a directory traversal vulnerability that allows unauthenticated attackers to upload files outside the intended upload directory. By manipulating the 'X-FILENAME' HTTP header, an attacker can place malicious files—such as modified CSS files—into directories they shouldn't normally access, potentially compromising site appearance, injecting malicious scripts, or overwriting legitimate files. The vulnerability affects all versions through 4.0.27.

• CVE-2026-20457MEDIUM 5.3

  A vulnerability exists in Modem that can crash the system when it receives specially crafted input that is not properly validated. An attacker controlling a rogue cellular base station could exploit this to deny service to connected users. No special privileges or user interaction are required—the attack triggers automatically when a device connects to the malicious base station.

• CVE-2026-20459MEDIUM 5.3

  A flaw in cellular modem firmware allows an attacker operating a rogue base station to crash a device's modem, temporarily knocking it offline. The vulnerability requires no special privileges and occurs automatically when a user connects to the attacker's malicious network. It does not lead to data theft or system compromise, but causes service disruption.

• CVE-2026-20460MEDIUM 5.3

  A modem vulnerability allows attackers to remotely extract sensitive information when a user connects to a compromised wireless base station. The flaw stems from improper validation of network input, enabling an attacker controlling a rogue base station to read confidential data without needing any special privileges or user interaction. Exploitation requires the target device to connect to the attacker's malicious network, but once connected, data disclosure occurs automatically.

• CVE-2026-20461MEDIUM 5.3

  A memory safety vulnerability exists in modem firmware that allows an attacker to crash the device remotely. By setting up a rogue base station, an attacker can trigger an out-of-bounds memory write that denial-of-services any connected device. No special privileges or user interaction are required—the attack succeeds simply by a user connecting to the malicious base station. The severity is moderate because exploitation requires proximity (the attacker must operate a base station) and doesn't grant further system access or data exposure.

• CVE-2026-20909MEDIUM 5.3

  Gitea, a self-hosted Git service platform, contains a permission validation flaw in its time tracking feature. Versions before 1.25.5 allow unauthenticated or low-privileged users to view time entries that should be restricted to authorized personnel. An attacker can enumerate sensitive project timing data without proper authorization, potentially exposing work patterns, project schedules, or other operational details that should remain confidential within a repository.

• CVE-2026-2128MEDIUM 5.3

  The Breeze WordPress plugin through version 2.5.2 contains a flaw that allows attackers to view content meant only for administrators. When the "Cache Logged-in Users" feature is enabled, the plugin trusts cookie information without properly verifying it belongs to a real, authenticated user. An attacker can craft a fake cookie claiming to be an administrator, and the plugin will serve them the cached pages generated for that admin—exposing private posts, administrative controls, security tokens, and other sensitive data. No authentication or special privileges are required to attempt this attack.

• CVE-2026-21368MEDIUM 5.3

  A memory corruption flaw exists in how Qualcomm processors and connectivity modules parse JPEG commands. During validation checks, the code writes extra data to a buffer beyond what is accounted for, potentially corrupting memory. An attacker with local access and user-level privileges can exploit this to read sensitive data, modify system behavior, or cause a crash. The vulnerability affects a broad range of Qualcomm chipsets used in smartphones, AR/XR devices, and networking hardware.

• CVE-2026-21369MEDIUM 5.3

  A memory corruption vulnerability exists in Qualcomm firmware and chipsets that control LED indicators on wireless and audio devices. The flaw occurs when an application modifies LED count values in memory, but the firmware continues using stale (outdated) count information when processing flash commands. This mismatch can cause the firmware to write data to incorrect memory locations, potentially corrupting device state or enabling further attacks. The vulnerability requires local access and moderately difficult conditions to exploit, but affects a broad range of Qualcomm connectivity and audio chipsets used in mobile devices, routers, and accessories.

• CVE-2026-21370MEDIUM 5.3

  Qualcomm Wi-Fi and cellular chipset firmware contains a memory corruption vulnerability that can be triggered when input validation fails to properly check batch size and buffer plane count parameters. An attacker with local access and low privileges can exploit this flaw to read or write memory, potentially affecting system stability or confidentiality. The vulnerability affects dozens of Qualcomm chipsets across FastConnect, G3X, IQ, and QCA product lines.

• CVE-2026-21384MEDIUM 5.3

  A memory corruption vulnerability exists in multiple Qualcomm wireless and connectivity chipsets when processing prepared commands with incorrect port index values supplied by local users. The flaw allows a user with local system access to trigger out-of-bounds memory writes, potentially compromising system confidentiality, integrity, and availability. This is a medium-severity local attack that requires specific knowledge of the affected firmware interfaces and cannot be exploited remotely.

• CVE-2026-2238MEDIUM 5.3

  GitLab has patched a flaw that allowed unauthenticated users to view confidential issue references on public projects. The vulnerability stems from insufficient authorization checks in the application, meaning someone without a GitLab account could potentially discover sensitive issue information that should have been restricted. The issue affects multiple recent versions of GitLab Community and Enterprise editions.

• CVE-2026-25440MEDIUM 5.3

  Essential Addons for Elementor versions prior to 6.6.0 contain a vulnerability that allows unauthenticated users to modify data without proper authorization checks. Because the plugin fails to validate user permissions before processing certain requests, an attacker can make unauthorized changes to website content or settings without needing valid credentials. This is a server-side access control failure rather than a client-side bypass.

• CVE-2026-25782MEDIUM 5.3

  Gitea, a popular self-hosted Git service, has a flaw in how it validates permissions when users attempt to delete time-tracking entries. The vulnerability allows an attacker to delete time entries that belong to a different issue than the one being accessed, bypassing the expected scope restriction. This occurs in versions before 1.25.5 and requires no special privileges or user interaction to exploit.

• CVE-2026-26053MEDIUM 5.3

  CVE-2026-26053 is a privilege escalation flaw in Allegro's Command Centre Server that allows authenticated operators with limited access rights to perform administrative or otherwise restricted actions they shouldn't normally be able to execute. An attacker must already have a valid login account with restricted permissions to exploit this; the vulnerability does not grant unauthenticated access. The risk is rated medium severity because it requires prior authentication and involves integrity impact rather than data confidentiality loss.

• CVE-2026-26825MEDIUM 5.3

  A use-of-uninitialized memory vulnerability in libxls 1.6.3 allows attackers to craft malformed XLS files that trigger memory safety issues during file parsing. When the library processes these files, uninitialized heap memory from the OLE (Object Linking and Embedding) layer may be read, leading to unpredictable behavior, incorrect file interpretation, or disclosure of sensitive data from memory. This does not require authentication and affects any application using the vulnerable library to open untrusted XLS files.

• CVE-2026-27409MEDIUM 5.3

  Webba Booking, a WordPress plugin, contains a missing authorization flaw that allows unauthenticated attackers to modify certain data or functionality due to incorrectly configured access controls. An attacker can exploit this vulnerability over the network without authentication or user interaction, though the impact is limited to data integrity—not confidentiality or availability. Versions up to and including 6.4.13 are affected.

• CVE-2026-27435MEDIUM 5.3

  WofficeIO Woffice contains a missing authorization vulnerability that allows attackers to exploit improperly configured access controls. An unauthenticated attacker can bypass security level restrictions to modify data or functionality within the application. This affects Woffice versions before 5.4.33.

• CVE-2026-28705MEDIUM 5.3

  Gitea, a popular self-hosted Git service, contains a path traversal vulnerability in how it handles release asset exports. When Gitea dumps release assets, it uses the release tag name and asset file name directly as path components without proper sanitization. An attacker can craft specially named release tags or assets to manipulate where files are written on the server's filesystem, potentially writing outside the intended directory. This could allow unauthorized information disclosure if sensitive files become readable, though the vulnerability does not grant write or delete capabilities to arbitrary locations.

• CVE-2026-28898MEDIUM 5.3

  Swift-NIO-HTTP2, Apple's open-source networking library for HTTP/2 protocol handling, contains a validation gap in its HTTP/2-to-HTTP/1.1 converter. The library failed to check pseudo-header values (like :path, :authority, :scheme, :method, and :status) for control characters—specifically carriage return (CR), line feed (LF), and null (NUL) bytes—before translating HTTP/2 frames into HTTP/1.1 messages. An attacker could craft malicious HTTP/2 requests or responses containing these characters to bypass security controls or potentially inject unintended content into downstream systems that process the converted HTTP/1.1 messages. Version 1.44.1 and later reject such messages at the connection level.

• CVE-2026-29007MEDIUM 5.3

  U-Boot versions through 2026.04-rc3 contain a flaw in how they process incoming TCP network packets when TCP networking is enabled. An attacker can send a specially crafted packet with mismatched length fields to trick U-Boot into reading data beyond the actual packet boundaries. This can corrupt internal TCP connection variables, potentially disrupting network communication and causing denial of service. The vulnerability requires no authentication and can be triggered from any network-connected attacker.

• CVE-2026-31983MEDIUM 5.3

  CVE-2026-31983 is a missing authentication vulnerability in the SSH keys synchronization endpoint of Nozomi Networks products. An attacker without credentials can query this endpoint to retrieve sensitive information: a complete list of users who have uploaded SSH keys, their group memberships, and the actual public SSH keys themselves. This is a straightforward authentication bypass that exposes information an attacker would typically need valid credentials to access.

• CVE-2026-33463MEDIUM 5.3

  Kibana contains a flaw where access tokens that should expire at a specific time continue to work indefinitely. An attacker who obtains one of these tokens—even after it should have stopped being valid—can use it to read sensitive information they shouldn't have access to. The vulnerability stems from improper validation of token expiration times, allowing the system to forget when a token was supposed to stop working.

• CVE-2026-34198MEDIUM 5.3

  Coolify, an open-source server and application management tool, contains a vulnerability that allows unauthenticated attackers to hijack user accounts by manipulating password reset emails. The vulnerability stems from weak proxy trust settings and a broken host validation mechanism that together allow an attacker to redirect password reset links to their own domain, capturing the reset token and gaining access to victim accounts. The flaw affects Coolify versions prior to 4.0.0-beta.471.

• CVE-2026-35159MEDIUM 5.3

  Dell Client Platform BIOS has a security flaw that bypasses authentication controls. An attacker with physical access to the computer could circumvent security checks, potentially exposing sensitive information stored in system memory or BIOS settings. This is not a remote vulnerability—the attacker must have hands-on access to the machine.

• CVE-2026-3640MEDIUM 5.3

  The STRABL checkout plugin for WordPress has a critical flaw in how it handles webhook communications. The plugin exposes a REST API endpoint that accepts incoming order notifications without verifying that requests actually come from STRABL's servers. This means anyone on the internet can craft fake webhook messages to create bogus orders, modify existing orders, create user accounts, issue refunds, or cancel sales—all without authorization. The vulnerability affects all versions of the plugin up to and including 4.5.

• CVE-2026-36726MEDIUM 5.3

  Bookcars v8.3 contains a vulnerability that allows attackers to delete files from a server without authentication. The flaw exists in an API endpoint designed to remove temporary license files, but it doesn't properly validate file paths. An attacker can exploit this by injecting directory traversal sequences (like '../') into the request to delete files outside the intended temporary directory, potentially removing critical application or system files.

• CVE-2026-38978MEDIUM 5.3

  Transmission, a popular BitTorrent application, contains a clickjacking vulnerability affecting versions up to and including 4.1.1. The flaw allows an attacker to trick users into performing unintended actions through the application's web interface or RPC (remote procedure call) endpoints by overlaying malicious content on top of legitimate interface elements. This requires user interaction but does not require the attacker to be authenticated or have any special privileges to exploit.

• CVE-2026-39899MEDIUM 5.3

  Cacti, a widely-used open source monitoring framework, contains a path traversal vulnerability in its package import functionality. An attacker can exploit a filename parameter in package_import.php to access files outside the intended directory, potentially reading sensitive configuration files or other protected data. The vulnerability requires no authentication and can be triggered remotely, but the confidentiality impact is limited. Cacti versions 1.2.30 and earlier are affected; upgrading to 1.2.31 or later resolves the issue.

• CVE-2026-40012MEDIUM 5.3

  A caching vulnerability in DNS implementations supporting EDNS Client Subnet (ECS) allows improperly scoped DNS responses to persist in the packet cache. When ECS is enabled, certain DNS answers that should remain client-specific are being stored globally, potentially exposing query information across different network segments. This is a moderate confidentiality concern affecting only systems with ECS explicitly configured.

• CVE-2026-40209MEDIUM 5.3

  CVE-2026-40209 is a denial-of-service vulnerability where specially crafted IXFR (Incremental Zone Transfer) queries can cause outgoing TCP connections to backend systems to hang indefinitely, persisting only until a network timeout triggers a release. This resource exhaustion can degrade or disable services if the affected system has finite connection limits or runs low on file descriptors.

• CVE-2026-40211MEDIUM 5.3

  CVE-2026-40211 is a denial-of-service vulnerability affecting DNS over HTTP/3 (DoH3) implementations. An attacker can craft malicious DoH3 queries that trigger an exception in the server, causing a buffer to remain in memory longer than intended. While the buffer is eventually freed when the QUIC connection closes, an attacker with the ability to open many concurrent DoH3 streams could exhaust server memory and force a denial of service. This is a network-accessible vulnerability requiring no authentication or user interaction.

• CVE-2026-40898MEDIUM 5.3

  quic-go, a Go-based QUIC protocol library, contains a denial-of-service flaw in its HTTP/3 implementation that allows remote attackers to exhaust server and client memory by sending malicious HTTP trailer fields. The vulnerability stems from inadequate validation of decoded trailer sizes—the library checks the compressed frame size but fails to enforce limits on the decompressed result. An attacker can craft QPACK-encoded headers with numerous unique field names or oversized values in the trailer section, forcing unbounded memory allocation and potentially crashing affected services.

• CVE-2026-40997MEDIUM 5.3

  Spring Web Services has a flaw where integration with Spring Security can leak information about user account status to unauthenticated SOAP clients. When an attacker attempts to log in via a SOAP endpoint, the system may reveal whether a username exists, is locked, or is disabled—rather than returning a generic "authentication failed" message. This information disclosure helps attackers enumerate valid accounts and understand their lifecycle state without needing valid credentials.

• CVE-2026-41001MEDIUM 5.3

  Spring Boot applications using embedded Artemis message brokers face a local privilege-escalation risk when no explicit data directory is configured. The affected versions default to a predictable, fixed path that an attacker with local system access can exploit before the application starts—either by pre-creating the directory or installing a symlink. This allows the attacker to read, modify, or disrupt the message broker's data, potentially compromising application integrity and confidentiality.

• CVE-2026-41150MEDIUM 5.3

  Mermaid, a popular JavaScript library for creating diagrams from text, contains a denial-of-service vulnerability in versions before 10.9.6 and 11.15.0. The flaw occurs when rendering Gantt charts that use the excludes attribute to block out all dates. An attacker can craft a malicious diagram that, when processed and rendered, causes the application to hang or consume excessive resources, disrupting service availability. The vulnerability only manifests during actual diagram rendering; simply parsing the diagram syntax does not trigger the issue unless the ganttDb.getTasks() function is subsequently called.

• CVE-2026-41159MEDIUM 5.3

  Mermaid, a popular JavaScript library for creating diagrams from text, contains a CSS injection vulnerability in its configuration options. Attackers can inject malicious CSS through the fontFamily, themeCSS, and altFontFamily settings that breaks out of the intended diagram sandbox and affects the entire web page. This could enable page defacement or extraction of sensitive information through CSS selectors. The vulnerability affects versions before 10.9.6 and 11.15.0, and has been patched in those releases.

• CVE-2026-41178MEDIUM 5.3

  OpenTelemetry-Go versions 1.41.0 and 1.43.0 contain a denial-of-service vulnerability in their baggage header parsing logic. The removal of size validation allows attackers to send oversized or malformed baggage headers that cause the application to process arbitrarily large inputs, log excessive errors, and potentially exhaust system resources. This is a network-accessible vulnerability requiring no authentication, making it exploitable by any remote actor.

• CVE-2026-41207MEDIUM 5.3

  A vulnerability exists in Netty's binary HTTP parser (netty-incubator-codec-ohttp) where cryptographic key generation can fail silently and default to all-zero keys without raising an error. This occurs in the HKDF_expand and EVP_HPKE_CTX_export functions, which are supposed to generate random key material for encrypting HTTP responses. Instead of signaling failure, these functions return zero-filled byte arrays that are indistinguishable from legitimate keys. An attacker who understands this behavior could predict the encryption keys and decrypt sensitive response data, compromising the confidentiality of encrypted messages. The issue was resolved in version 0.0.21.Final.

• CVE-2026-41730MEDIUM 5.3

  Spring Data REST, a popular framework for building REST APIs on top of Spring Data repositories, has a flaw where detailed error messages—including information from the underlying database layer—are exposed directly to API clients. When an exception occurs during request processing, the full chain of causes is serialized into HTTP error responses. This means a remote attacker can trigger exceptions and receive detailed stack traces and system internals that should remain hidden. The vulnerability affects multiple versions across the 3.7, 4.3, 4.4, 4.5, and 5.0 release lines.

• CVE-2026-41837MEDIUM 5.3

  Spring Data REST's filtering feature bypasses Jackson customizations when processing user-supplied filter parameters, potentially allowing attackers to access sensitive object properties that should be restricted. An unauthenticated attacker can craft malicious filter requests to extract unauthorized information from the application's data layer without modifying or disrupting service.

• CVE-2026-41851MEDIUM 5.3

  Spring Framework contains a vulnerability in how it handles Spring Expression Language (SpEL) expressions when applications allow user input to be evaluated as SpEL code. An attacker can craft specially designed expressions that cause the framework's internal cache to grow without bounds, consuming memory until the application becomes unresponsive or crashes. This is a denial-of-service (DoS) condition that requires no authentication and can be triggered remotely.

• CVE-2026-41853MEDIUM 5.3

  Spring Framework versions 5.3.0 through 7.0.7 contain a vulnerability allowing attackers to perform multipart request smuggling attacks. This vulnerability lets unauthenticated remote attackers craft malformed multipart HTTP requests that can be interpreted differently by intermediate proxies or load balancers versus the Spring application itself, potentially leading to request confusion and unauthorized actions. No user interaction is required, and the vulnerability affects both Spring MVC and WebFlux application handlers.

• CVE-2026-41981MEDIUM 5.3

  CVE-2026-41981 is a medium-severity vulnerability affecting the IPC (Inter-Process Communication) module that allows an attacker with local access to write data outside the intended memory boundaries. This out-of-bounds write can corrupt system memory and lead to service disruptions or unexpected behavior. The vulnerability requires local access and user-level privileges to exploit, reducing its immediate threat surface but still warranting timely remediation in multi-user or containerized environments.

• CVE-2026-42389MEDIUM 5.3

  CVE-2026-42389 is a medium-severity vulnerability affecting DNS resolver software in the 5.4.x branch. The issue stems from insufficient validation of responses received from authoritative DNS servers, which could allow an attacker to inject or manipulate DNS answers. The vendor has addressed this by implementing additional hardening checks. While the vulnerability does not currently appear on CISA's Known Exploited Vulnerabilities (KEV) catalog, organizations running vulnerable versions should treat it as a standard update priority.

• CVE-2026-42390MEDIUM 5.3

  A validation bypass has been identified in ZONEMD (Zone Message Digest) verification logic. Under specific configurations, DNS zones with invalid signatures can incorrectly pass validation checks, potentially allowing corrupted or maliciously modified zone data to be accepted as legitimate. This affects systems using ZoneToCache with ZONEMD validation enabled.

• CVE-2026-42489MEDIUM 5.3

  CVE-2026-42489 is a fairness issue in Xen's domain control lock mechanism. When the control domain or related privilege holders use domctl operations to create and manage guest domains, a system-wide lock is employed to serialize certain operations. However, this lock does not implement fairness guarantees, meaning some requesters can be starved indefinitely while others gain repeated access. An attacker with high privileges who can issue domctl operations could exploit this to cause denial of service by monopolizing the lock and preventing legitimate domain management tasks from completing.

• CVE-2026-42500MEDIUM 5.3

  CVE-2026-42500 is a denial-of-service vulnerability triggered when software attempts to decode a specially crafted BMP image file with palette colors that reference invalid color table entries. The flaw causes the application to crash rather than handle the malformed data gracefully. An attacker can exploit this by distributing or hosting a malicious BMP file that, when opened or processed, crashes the affected application.

• CVE-2026-42505MEDIUM 5.3

  CVE-2026-42505 is a privacy disclosure flaw in TLS implementations that support Encrypted Client Hello (ECH). When a client initiates an encrypted handshake using ECH, the pre-shared key (PSK) identifier—which can uniquely identify the client—remains visible in the unencrypted portions of the ClientHello message. This allows a passive network observer (someone monitoring traffic without modifying it) to correlate and de-anonymize connections, undermining the privacy guarantees that ECH was designed to provide. The vulnerability affects Go's TLS library and has a CVSS score of 5.3 (Medium severity), reflecting confidentiality impact without allowing code execution or service disruption.

• CVE-2026-42507MEDIUM 5.3

  CVE-2026-42507 is a moderate security issue affecting Go's net/textproto package where error messages can inadvertently expose or reflect user-supplied input. An attacker could craft malicious input that, when an error occurs, gets embedded into the error message itself. If those messages are logged, displayed to users, or forwarded to monitoring systems, the attacker's injected content appears as legitimate system output. This creates an integrity risk by allowing misleading information to be introduced into logs and alerts.

• CVE-2026-42769MEDIUM 5.3

  A defect in OpenSSL's Certificate Management Protocol (CMP) implementation allows an attacker with valid Registration Authority credentials to trick CMP clients into accepting a forged root CA certificate as legitimate. The flaw stems from a typo in certificate chain validation code that disabled critical signature verification checks during root CA key rollover operations. While the vulnerability requires the attacker to already possess RA-level credentials, successful exploitation would grant them root CA authority over affected clients—a significant privilege escalation. The FIPS module implementation of OpenSSL is not affected.

• CVE-2026-42914MEDIUM 5.3

  A vulnerability in Windows Kerberos allows an authenticated attacker to cause a denial-of-service condition by reading memory outside the intended bounds. The attacker must already have network access and valid credentials to exploit this issue, which means it poses a risk primarily in environments where internal adversaries or compromised accounts could launch attacks. The impact is limited to service disruption rather than data theft or system compromise.

• CVE-2026-42932MEDIUM 5.3

  Naxclow devices use predictable device identifiers that are generated using fixed manufacturing prefixes and simple sequential counters. This design flaw allows an attacker to easily predict or enumerate which devices exist on a network without authentication. Additionally, the platform exposes a publicly accessible endpoint that reveals the highest device identifier currently in use, making it trivial to determine the size and composition of an active Naxclow fleet.

• CVE-2026-4360MEDIUM 5.3

  CVE-2026-4360 is a vulnerability in Python's tarfile extraction mechanism where the security filter parameter is bypassed when extracting hardlinks from tar archives. When a developer uses the `filter='data'` parameter—intended to restrict file ownership changes—the filter is not applied to hardlinks, allowing an attacker to craft a malicious tar file that assigns unexpected user and group identifiers (uid/gid) to extracted files. This could lead to privilege escalation or file ownership manipulation on systems processing untrusted archives.

• CVE-2026-43704MEDIUM 5.3

  A memory management flaw in Apple's Safari browser and related operating systems could allow a malicious web extension to crash the browser or application unexpectedly. The vulnerability (CVE-2026-43704) stems from improper handling of memory after it has been freed, a class of bug that can be exploited by attackers who craft malicious extensions. Apple has patched the issue across Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.

• CVE-2026-44188MEDIUM 5.3

  Ansible Lightspeed contains a session management flaw that allows attackers to hijack user access tokens. If a threat actor obtains a valid OAuth access token—either through theft or interception before a user logs out—they can reuse it to authenticate and access the Ansible instance long after the legitimate user believes they have disconnected. The core problem is that Lightspeed doesn't actively revoke tokens on the backend when sessions end; tokens remain valid until they naturally expire on their own schedule. This grants unauthorized read access to sensitive infrastructure-as-code assets like inventories, playbooks, and configuration details.

• CVE-2026-44332MEDIUM 5.3

  Fiber, a popular Go web framework modeled after Express.js, contains a timing-based username enumeration vulnerability in its BasicAuth middleware. When authentication is attempted, the framework's default authorizer function checks whether a username exists before validating the password. An attacker can exploit this by observing subtle differences in response times—valid usernames return faster than invalid ones because the password comparison step is skipped entirely for non-existent users. This allows an attacker to reliably discover which usernames are active on a system without needing valid credentials. The flaw affects all versions prior to 3.3.0.

• CVE-2026-44342MEDIUM 5.3

  New API, an LLM gateway and AI asset management platform, contains a cross-site request forgery (CSRF) vulnerability in its account binding functionality. Versions before 0.12.0-alpha.1 use GET requests for sensitive operations that should require POST, allowing attackers to trick logged-in users into binding attacker-controlled email addresses or OAuth identities to their accounts without explicit consent. The vulnerability requires an attacker to craft a malicious link or webpage and relies on a user clicking it while authenticated to New API, but the impact—account takeover through OAuth binding—is significant enough to warrant immediate attention.

• CVE-2026-44505MEDIUM 5.3

  Nimiq's network-libp2p component has a flaw in how it handles responses from peer nodes during Distributed Hash Table (DHT) lookups. When a peer returns a record that fails verification, the code fails to properly clean up internal tracking structures and notify waiting callers. This leaves caller processes hanging indefinitely, unable to complete their operations. The issue affects Nimiq versions prior to 1.4.0 and is resolved in that release.

• CVE-2026-44518MEDIUM 5.3

  liboqs, an open-source cryptographic library implementing post-quantum algorithms, contains an out-of-bounds read flaw in its XMSS and XMSS^MT signature verification routines. When a verification function receives a signature buffer shorter than expected, the code reads beyond the buffer boundary without length validation. While the out-of-bounds bytes are only used internally for hashing and cannot leak sensitive data, the read can crash the verifying process if it accesses unmapped memory, creating a denial-of-service risk. The issue is resolved in version 0.16.0.

• CVE-2026-44545MEDIUM 5.3

  Daphne, a popular ASGI application server for Django, contains a configuration flaw that leaves WebSocket connections vulnerable to denial-of-service attacks. Versions before 4.2.2 fail to enforce limits on WebSocket message and frame sizes, allowing unauthenticated attackers to send extremely large messages that consume server memory until the application becomes unresponsive. This occurs because Daphne does not pass payload size constraints to the underlying Autobahn WebSocket library, which defaults to unlimited sizes.

• CVE-2026-44646MEDIUM 5.3

  LiquidJS, a JavaScript template engine compatible with Shopify and GitHub Pages, has a flaw in how it handles security settings when rendering partial templates using the {% render %} tag. When a developer configures LiquidJS with a permissive default setting but then tries to tighten security for specific untrusted template content, that tightened security is silently ignored for any partials rendered within it. This allows an attacker to access properties from the JavaScript prototype chain—essentially reading unintended internal object data—even when the developer believed they had locked down access.

• CVE-2026-44967MEDIUM 5.3

  OpenTelemetry-cpp, the C++ library for exporting observability data (traces, metrics, logs), has a flaw in how it handles HTTP responses from collector endpoints. Before version 1.27.0, the library reads entire HTTP responses into memory without any limit. An attacker who controls the collector endpoint—or intercepts the connection—can send arbitrarily large responses to exhaust the application's memory, causing it to crash or become unresponsive. This is a denial-of-service risk for applications instrumented with vulnerable versions of OpenTelemetry-cpp.

• CVE-2026-45031MEDIUM 5.3

  ImageMagick, a widely-used open-source image processing tool, contains a vulnerability in its PSD (Photoshop) file decoder that allows an attacker to circumvent resource limits designed to prevent denial-of-service attacks. By crafting a malicious PSD file, an attacker can cause excessive resource consumption during image decoding, potentially disrupting services that rely on ImageMagick to process untrusted image uploads. The vulnerability affects versions prior to 6.9.13-47 and 7.1.2-22, and patches are now available.

• CVE-2026-45045MEDIUM 5.3

  A flaw in the Fiber web framework allows attackers to inject a false X-Real-IP header that bypasses the proxy's intended override mechanism. When Fiber's BalancerForward proxy helper processes requests, it appends attacker-supplied IP values instead of replacing them, causing upstream systems to log or enforce policies based on the attacker's spoofed IP rather than the true client IP. This undermines logging accuracy, rate-limiting enforcement, and IP-based access controls downstream.

• CVE-2026-45085MEDIUM 5.3

  Discourse, a popular open-source discussion platform, contains four separate authorization and information disclosure flaws in its chat plugin (and one overlapping with the calendar plugin). The vulnerabilities allow read-only category members to create chat threads they shouldn't, permit users to recover deleted messages even after losing channel access, expose unrelated private messages to moderators reviewing flagged content, and leak chat channel details and message content to unauthorized viewers including anonymous users. These gaps bypass intended access controls and leak sensitive conversation data. The issues affect Discourse instances with the chat plugin enabled; the calendar-related exposure additionally requires the discourse-calendar plugin.