By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

1284 published vulnerabilities · page 3 of 13

• CVE-2026-36605MEDIUM 6.5

  Mercusys AC12G (EU) V1 routers running firmware version AC12G(EU)_V1_200909 contain a denial-of-service vulnerability where an attacker on the local network can send a small number of specially crafted incomplete HTTP requests to crash the router. The device becomes unresponsive and requires a physical power cycle to restore function. This affects network availability for all connected devices.

• CVE-2026-37737MEDIUM 6.5

  A flaw in sanic-cors version 2.2.0 and earlier allows attackers to circumvent CORS (Cross-Origin Resource Sharing) origin restrictions. The vulnerability stems from improper validation of allowed origins: an attacker can register a domain name that starts with a trusted origin string to trick the library into allowing cross-origin requests that should have been blocked. For example, if a site trusts 'trusted.com', an attacker registering 'trusted.com.attacker.com' could bypass the allowlist. This exposes authenticated resources to unauthorized cross-origin access.

• CVE-2026-3870MEDIUM 6.5

  Zyxel VMG4005-B50B routers with firmware up to version 5.13(ABRL.5.4)C0 contain a buffer overflow flaw in their UPnP port-mapping feature. An attacker on the same local network can exploit this to crash the UPnP service temporarily, preventing legitimate port-forwarding operations until the service recovers or the device is rebooted.

• CVE-2026-3871MEDIUM 6.5

  Zyxel VMG4005-B50B gateway devices running firmware version 5.13(ABRL.5.4)C0 and earlier contain a buffer overflow flaw in the UPnP DeletePortMapping command. An attacker on the same local network can exploit this to crash the UPnP service, temporarily disabling port mapping features. The vulnerability requires network adjacency and does not enable data theft or system compromise, but does degrade device functionality.

• CVE-2026-39229MEDIUM 6.5

  Bolt CMS versions up to 3.7.0 contain a SQL injection vulnerability in how it processes the 'order' parameter on content listing pages. An attacker who has legitimate user credentials—even with minimal permissions—can craft malicious input to extract sensitive data from the database. The vulnerability is triggered through the OrderDirective component during normal sorting operations. This is an information disclosure risk; attackers cannot modify or delete data, but they can read information they shouldn't access.

• CVE-2026-39908MEDIUM 6.5

  OpenBullet2 versions up to 0.3.2 running on Windows contain a flaw that leaks the Windows NTLM password hash of the user running the application. An attacker with access to the application can trick it into connecting to a malicious SMB server by providing a fake network path (UNC path) as a proxy source. When OpenBullet2 tries to load proxy settings from that path, Windows automatically attempts to authenticate, and the attacker captures the resulting NTLMv2 hash. That hash can be used in relay attacks or cracked offline to recover credentials.

• CVE-2026-40861MEDIUM 6.5

  CVE-2026-40861 is a path traversal vulnerability in Apache Airflow that allows a DAG (Directed Acyclic Graph) author to read or write arbitrary files on the system when the worker and API server share a log directory. An attacker with DAG authoring privileges can either create symbolic links in their task's log folder to access sensitive files like `/etc/passwd` or `airflow.cfg`, or inject path traversal sequences (`..`) in task IDs to escape the intended log directory. The vulnerability exposes confidential configuration data and could enable file overwrites on the API server's filesystem.

• CVE-2026-41141MEDIUM 6.5

  EspoCRM versions before 9.3.5 contain an access control bypass in the email template preparation endpoint. An authenticated user with basic EmailTemplate read permissions can extract sensitive field data from any Contact, Lead, Account, or User record by providing the target's email address—effectively circumventing role-based visibility restrictions. This allows lower-privileged users to read information they should not have access to, such as financial details, personal fields, or team-restricted records.

• CVE-2026-41184MEDIUM 6.5

  Calico's CNI installer container accidentally logs Kubernetes ServiceAccount tokens to standard output during deployment, specifically when using Canal or Flannel-Calico configurations. Any user with permission to view pod logs in the affected namespace can retrieve this token, which grants the ability to modify pod annotations—a vector for attacking workloads in your cluster. The vulnerability is a regression of a previously fixed issue and does not affect deployments using the default kubeconfig authentication method.

• CVE-2026-41185MEDIUM 6.5

  Calico, a widely-used open-source networking plugin for Kubernetes, logs sensitive authentication credentials to plaintext files when deployed with Azure's IPAM plugin and token-based Kubernetes authentication. The vulnerability occurs because the Calico CNI binary adds subnet information to the configuration before forwarding it to Azure IPAM for processing. During this handoff, the entire configuration—including Kubernetes ServiceAccount tokens, client keys, and certificate authority data—is logged at INFO level to /var/log/calico/cni/cni.log. This happens on every pod scheduling or termination, creating a high-frequency credential leak. Any user or process with read access to node-level logs can extract cluster-wide Calico networking administrator credentials without triggering alarms.

• CVE-2026-42073MEDIUM 6.5

  OpenClaude, an open-source command-line tool for interacting with cloud and local AI models, has a flaw in how it handles user login. When you authenticate using OAuth, the software runs a temporary web server locally to catch the login response. To prevent attackers from hijacking this process, the server checks a security token called a 'state parameter.' However, due to a bug in how the code checks this token, an attacker can bypass the security check entirely and crash the server without even knowing what the token is. This has been fixed in version 0.5.1 and later.

• CVE-2026-42358MEDIUM 6.5

  Apache Airflow's secret-masking feature, which is supposed to hide sensitive values in Variables when they're accessed through the UI or API, has a flaw that lets authenticated users read plaintext secrets stored in deeply nested JSON structures. The masking tool gives up checking for sensitive key names (like 'password', 'token', 'secret', 'api_key') once it reaches a certain nesting depth, so secrets buried deeper than that limit slip through unmasked. Any user with permission to read Variables can exploit this. This is a follow-up to an earlier fix; that patch addressed shallow nesting, but didn't raise the depth limit itself, leaving the same bypass hole for deeper structures.

• CVE-2026-42360MEDIUM 6.5

  Apache Airflow has a flaw in how it protects sensitive information embedded within complex data structures (like JSON templates). When a workflow template is large enough to exceed Airflow's size limit for storing template data, the system converts it to plain text before masking secrets—a process that loses track of nested sensitive fields like passwords, tokens, and API keys. An authenticated user with access to read stored template fields could then retrieve these unmasked secrets. The issue affects Airflow deployments where workflow authors pass structured data containing nested sensitive values to operators. Even organizations that patched a related vulnerability (CVE-2025-68438) last year need to apply this additional update, as that earlier fix did not address this specific nested-key masking gap.

• CVE-2026-42399MEDIUM 6.5

  A vulnerability in Kibana allows authenticated users with basic access to crash the application by uploading specially crafted visualizations. An attacker submits a Timelion visualization with deeply nested function calls that causes Kibana to allocate memory without limit, eventually consuming all available RAM and taking the service offline for everyone. This is a denial-of-service attack that requires valid credentials but no administrative privileges.

• CVE-2026-42400MEDIUM 6.5

  CVE-2026-42400 is a denial-of-service vulnerability in Kibana that allows an authenticated user to crash or freeze a Kibana instance by sending a malicious compressed request. The vulnerability exists because Kibana processes and decompresses incoming requests before fully validating user permissions, meaning an attacker can consume excessive memory and CPU resources on the server before authorization checks can stop them. While this requires valid credentials to exploit, the impact is straightforward: a Kibana instance can become unresponsive or crash entirely, disrupting visibility and analysis capabilities that teams depend on.

• CVE-2026-42539MEDIUM 6.5

  IRIS is a web-based platform used by incident response teams to collaborate and share technical details during security investigations. A vulnerability in versions before 2.4.28 causes the platform to leak sensitive information to authenticated users that those users should not have access to. This happens because the application returns unnecessary data in responses, exposing information beyond what the client application actually needs to function. An attacker with valid IRIS credentials can exploit this to view restricted incident data.

• CVE-2026-42671MEDIUM 6.5

  Paolo GeoDirectory versions up to 2.8.157 contain a missing authorization flaw that allows attackers to bypass access controls. Without needing credentials or user interaction, an attacker on the network can exploit misconfigured security levels to gain unauthorized access to sensitive operations, potentially modifying data or causing service disruption.

• CVE-2026-42676MEDIUM 6.5

  myCred, a gamification and community engagement plugin, contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into web pages. Unlike reflected XSS attacks that require victims to click a link, stored XSS persists in the application's database, meaning any user—including administrators—who views the affected content will execute the attacker's code. The vulnerability affects myCred versions up to and including 3.0.4. An authenticated attacker could exploit this to steal session tokens, redirect users, deface content, or perform actions on behalf of legitimate users.

• CVE-2026-42679MEDIUM 6.5

  CVE-2026-42679 is a path traversal vulnerability in Mamunur Rashid Classified Listing that allows authenticated users to read sensitive files outside the application's intended directory structure. An attacker with valid login credentials can craft specially formatted file path requests to access restricted files on the server, potentially exposing configuration data, database backups, or other confidential information. The vulnerability affects Classified Listing versions up through 5.3.8.

• CVE-2026-42824MEDIUM 6.5

  Microsoft Copilot contains a command injection vulnerability that allows an attacker to craft malicious input and execute unintended commands through the application. An attacker can exploit this flaw to extract sensitive information from a user's system or data accessible through Copilot, but only if the user interacts with the malicious input. The vulnerability does not allow the attacker to modify data or disrupt service availability.

• CVE-2026-42903MEDIUM 6.5

  A flaw in Windows Kerberos authentication can be triggered by an authorized network user to crash or hang critical services. The vulnerability requires valid domain credentials to exploit, limiting its attack surface to insider threats or compromised accounts within an organization. While it does not expose data or allow privilege escalation, denial-of-service impact can disrupt authentication infrastructure and dependent business operations.

• CVE-2026-42907MEDIUM 6.5

  CVE-2026-42907 is a medium-severity information disclosure vulnerability in Windows Shell that allows an authorized user to leak sensitive data over the network. The flaw requires valid credentials to exploit but does not need user interaction, making it a concern for organizations where user trust boundaries are weak or privilege separation is inadequate. No code execution or system damage occurs; the risk is purely confidentiality loss.

• CVE-2026-43951MEDIUM 6.5

  Apache HTTP Server contains an out-of-bounds read vulnerability in the mod_headers and mod_mime modules when handling responses with multiple language variants. An unauthenticated attacker on the network can trigger this flaw to read sensitive data from server memory without requiring user interaction or special privileges. The vulnerability affects all versions from 2.4.0 through 2.4.67.

• CVE-2026-44653MEDIUM 6.5

  LibreChat versions up to 0.8.3 expose sensitive credentials to users with view-only access to MCP (Model Context Protocol) servers. When a user with limited permissions queries the server configuration API, they receive plaintext API keys and OAuth secrets that should remain encrypted and admin-only. This breaks the intended access control model where viewers should never see the credentials needed to authenticate with external AI providers. An attacker with even basic read access can steal these secrets and impersonate the legitimate service.

• CVE-2026-44740MEDIUM 6.5

  Billy, a Go library that abstracts filesystem operations, contains multiple input validation flaws that can cause denial-of-service conditions. When processing untrusted repository or filesystem data, the library can panic, enter infinite loops, or consume excessive system resources due to missing safeguards like cycle detection and recursion limits. Authenticated users can trigger these conditions over the network. The issue affects versions prior to 5.9.0 and 6.0.0-alpha.1.

• CVE-2026-44744MEDIUM 6.5

  SAP S/4HANA (On-Premise) contains a SQL injection flaw in a remote-enabled function module that allows authenticated users to craft malicious database queries. An attacker with valid credentials could bypass normal access controls and retrieve sensitive data they shouldn't see. The vulnerability does not affect system availability or data integrity—only confidentiality is at risk.

• CVE-2026-44796MEDIUM 6.5

  Nautobot, a network automation and source-of-truth platform, contains a denial-of-service vulnerability in its bulk-rename feature. An authenticated attacker can craft malicious regular expressions in the 'find' field and enable the regex flag to cause the application to hang or become unresponsive, disrupting access for all users. The flaw affects versions before 2.4.33 and 3.1.2.

• CVE-2026-44884MEDIUM 6.5

  Portainer Community Edition versions 2.33.0 through 2.33.7 and 2.39.0 contain a flaw that lets any logged-in user view template files they shouldn't have access to. By trying different ID numbers, an attacker can enumerate and read custom template files that may hold sensitive credentials or connection strings—data that administrators likely assume only authorized users can see. The vulnerability has been patched in versions 2.33.8 and 2.39.1.

• CVE-2026-45149MEDIUM 6.5

  The brace-expansion library, a utility for generating string sequences from patterns, has a performance handling flaw in versions 5.0.0 through 5.0.5. When users expand large numeric ranges—such as {1..10000000}—the library was constructing the entire intermediate sequence in memory before applying user-defined limits. This means even if you set a maximum output of 10 items, the library would still build all 10 million elements first, consuming roughly 505 MB of memory and 800 milliseconds of processing time before discarding them. The flaw is fixed in version 5.0.6 and later.

• CVE-2026-45192MEDIUM 6.5

  Apache Airflow's connection API endpoint leaks sensitive credentials that should have been hidden. When a user with permission to read connections retrieves connection details via the REST API, the system fails to redact secrets stored in the connection's extra fields if they don't match known credential field names. This means passwords, API keys, and tokens for services like Slack can be exposed to any authenticated user with basic connection-read access—a permission that's often broadly granted in Airflow deployments.

• CVE-2026-45267MEDIUM 6.5

  Nextcloud versions before 5.2.6 contain a security flaw where the application fails to properly check user permissions when handling form submissions. This allows authenticated users to view form submission data belonging to other users—data they should not have access to. An attacker with valid Nextcloud credentials can exploit this to read sensitive information submitted by colleagues or other organization members through forms. The vulnerability requires an existing user account but does not need special privileges or user interaction to trigger.

• CVE-2026-45275MEDIUM 6.5

  A vulnerability in Nextcloud's Approval app allows users to bypass permission controls and force files to be shared with approvers, even when they lack sharing rights. An attacker with basic user credentials can exploit this to distribute restricted files without authorization. Nextcloud addressed this in version 2.7.2.

• CVE-2026-45282MEDIUM 6.5

  Nextcloud Server contains a flaw that allows an authenticated user to download file attachments from password-protected or restricted link shares if they know the share token and have access to a document ID. This bypasses the intended security controls around shared links. The attacker can only extract attached files, not the shared documents themselves, and the vulnerability requires prior authentication and knowledge of specific document identifiers.

• CVE-2026-45306MEDIUM 6.5

  pyLoad, a Python-based download manager, contains a directory traversal weakness that allows authenticated users to access other users' session files. An attacker with login credentials can manipulate the storage folder setting to point to a sensitive Flask session directory and then download session tokens belonging to other accounts. This could enable account takeover without requiring additional exploitation. The vulnerability exists because a prior security fix addressed some directory restrictions but overlooked the Flask session storage location.

• CVE-2026-45454MEDIUM 6.5

  A path traversal vulnerability in Microsoft SharePoint Server allows an authenticated user to access files and data outside intended boundaries, potentially leading to unauthorized code execution across the network. An attacker with valid credentials can manipulate file paths to reach restricted directories and execute arbitrary code—a serious concern in multi-tenant or shared SharePoint environments where user trust is assumed but not absolute.

• CVE-2026-45501MEDIUM 6.5

  CVE-2026-45501 is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server that allows an authenticated attacker to manipulate the server into making requests on their behalf, potentially enabling network-based spoofing attacks. The vulnerability requires valid credentials to exploit, limiting its immediate blast radius, but poses a meaningful risk for organizations where internal attackers or compromised user accounts exist. The vulnerability affects multiple versions of Exchange Server and Exchange Server Subscription Edition.

• CVE-2026-45582MEDIUM 6.5

  n8n-MCP, an AI assistant integration layer for the n8n workflow automation platform, fails to fully sanitize sensitive data before transmitting workflow information to its telemetry backend. The flaw allows fragments of URLs and embedded credentials—such as API keys, tenant IDs, and signed request parameters—to leak into the project's anonymous telemetry collection. This occurs when users configure HTTP-Request-style nodes with sensitive parameters in their URLs. The vulnerability affects versions before 2.51.3, where the telemetry sanitizer was enhanced to properly redact these values before transmission.

• CVE-2026-45619MEDIUM 6.5

  WWBN AVideo, an open-source video hosting platform, contains a DNS-rebinding vulnerability in its Server-Side Request Forgery (SSRF) protections. When the application checks whether a URL is safe to fetch, it validates the domain name but then makes the actual network request without

• CVE-2026-45679MEDIUM 6.5

  OpenTelemetry eBPF Instrumentation versions before 0.9.0 leak sensitive data through telemetry systems. When Redis commands fail, the instrumentation captures and exports the raw error messages produced by Redis. Attackers or misconfigured systems can craft Redis error responses containing authentication tokens, personally identifiable information, or other secrets. These sensitive values then flow into your telemetry backend—where security teams, SREs, and external monitoring vendors can see them—and may propagate into downstream analysis, alerting, or visualization tools. This is a data exfiltration vulnerability that risks exposing confidential input into systems where it was never intended to be visible.

• CVE-2026-46357MEDIUM 6.5

  CVE-2026-46357 is a denial-of-service vulnerability in HAX CMS (NodeJS version) that allows an authenticated user to crash the entire application with a single malformed request to the site creation endpoint. The impact is severe from an availability perspective: the application goes completely offline and requires manual server restart to recover. This affects only the NodeJS backend; PHP deployments are not impacted.

• CVE-2026-46397MEDIUM 6.5

  HAX CMS, a content management system for building microsite networks, contains a flaw that lets authenticated users read files they shouldn't have access to. An attacker with a valid login (even a low-privilege account) can manipulate how the system saves site configuration data, causing it to expose sensitive files like system passwords, API keys, or database credentials stored on the web server. This is a classic file inclusion attack that works over the network without requiring special browser interaction. The vendor has patched this in version 26.0.0.

• CVE-2026-46443MEDIUM 6.5

  Flowise, a no-code platform for building custom language model workflows, contains a credential exposure flaw in versions before 3.1.2. When users or applications retrieve stored credentials using a filter parameter, the system fails to remove encrypted credential data from the response—information that should never leave the server. An attacker with legitimate access to the Flowise instance could exploit this to extract encrypted credentials, potentially compromising downstream services or enabling lateral movement. The vulnerability does not affect credential retrieval when no filter is applied, indicating incomplete input-handling logic.

• CVE-2026-46718MEDIUM 6.5

  Apache Calcite versions 1.5.0 through 1.41 contain a vulnerability that allows attackers to supply malicious input which the application then uses to dynamically load arbitrary Java classes. This unsafe reflection flaw requires only network access and no authentication, enabling remote attackers to potentially execute unintended code or access sensitive data. The vulnerability has been resolved in version 1.42.

• CVE-2026-47284MEDIUM 6.5

  Visual Studio Code contains a flaw that can expose sensitive information to attackers over the network. An attacker can trick a user into performing an action that leads to the disclosure of confidential data, though the attacker cannot modify systems or interrupt services. This is a moderate-severity issue requiring user interaction to exploit.

• CVE-2026-47287MEDIUM 6.5

  Visual Studio Code contains a path traversal vulnerability that could allow an attacker to modify files on your system through a malicious link or network request. The vulnerability requires user interaction—such as clicking a link or opening a file—but does not require authentication. An attacker cannot read sensitive data through this vulnerability, but they can alter or corrupt files if they successfully exploit it.

• CVE-2026-47644MEDIUM 6.5

  A flaw in Microsoft Edge's Copilot Chat feature allows attackers to inject specially crafted code into the application, potentially exposing sensitive information. The vulnerability requires user interaction (such as clicking a malicious link) but does not require authentication. Once triggered, it could disclose data over the network without the user's knowledge.

• CVE-2026-47655MEDIUM 6.5

  Microsoft Graph contains a flaw that allows an authorized attacker to access sensitive information they should not be able to see. The vulnerability requires the attacker to already have valid credentials, but once authenticated, they can retrieve confidential data over the network without performing additional interactions. This is classified as a medium-severity issue because exploitation requires prior authentication, limiting the attack surface to insiders or compromised accounts.

• CVE-2026-47742MEDIUM 6.5

  Shopper is a headless e-commerce admin platform that manages product catalogs and inventory. A flaw in versions prior to 2.8.0 allowed any logged-in panel user to modify product information—including prices, stock levels, SEO details, shipping dimensions, and media attachments—even if they lacked explicit permission to edit products. The vulnerability stems from missing authorization checks on specific sub-form components and the ability for attackers to manipulate product IDs client-side to target arbitrary products. An authenticated attacker with minimal privileges could cause significant data integrity issues without detection.

• CVE-2026-47745MEDIUM 6.5

  Shopper, a headless e-commerce admin panel used to manage online stores, contains a permission-checking flaw in versions before 2.8.0. Admin users with low-level access can manipulate critical payment and fulfillment settings—such as disabling all payment methods, changing the default currency, or removing shipping carriers—even though they shouldn't have permission to do so. Any employee or contractor with admin panel access, regardless of their intended role, can trigger a complete checkout blockade or corrupt pricing data. The vendor has resolved this in version 2.8.0.

• CVE-2026-48101MEDIUM 6.5

  7-Zip versions 9.21 through 26.00 contain a memory disclosure flaw in their UEFI capsule parser. When processing truncated or specially crafted .scap files, the application allocates a large heap buffer without clearing it first, then fails to verify that the file contents completely filled that buffer. Any unread portion of the buffer retains leftover data from previous memory allocations—potentially sensitive information—which then leaks to the user when the archive is extracted. This affects any organization or individual using affected 7-Zip versions to handle capsule files, and is fixed in version 26.0.1.

• CVE-2026-48112MEDIUM 6.5

  7-Zip versions 9.18 through 26.00 contain a memory safety defect in their handler for Unix ar archives—specifically when parsing BSD-style symbol tables. The flaw allows an attacker to craft a malicious ar archive that, when opened by 7-Zip, causes the parser to read 4 bytes of uninitialized heap memory beyond the intended buffer boundary. This disclosure of uninitialized data could leak sensitive information from the process memory. The vulnerability requires user interaction: a victim must open the malicious archive file. Version 26.01 resolves the issue.

• CVE-2026-48208MEDIUM 6.5

  OTRS and OTRS Community Edition contain a vulnerability that allows attackers to embed malicious SVG (Scalable Vector Graphics) code within email messages sent to the ticketing system. When an agent or customer opens an affected ticket, the crafted SVG content can consume excessive browser resources, rendering the application unresponsive or forcing a browser crash. This is a denial-of-service attack that requires no special privileges and occurs automatically when viewing a compromised ticket—the attacker simply needs to send an email to the OTRS system.

• CVE-2026-48726MEDIUM 6.5

  Apache Airflow has a logout bypass vulnerability where JWT tokens remain valid after users log out through the web UI. When users click logout, the system fails to properly revoke their authentication tokens in deployments using FAB (Flask-AppBuilder) or Keycloak authentication. An attacker with a stolen or previously-issued JWT can continue making authenticated API calls as that logged-out user until the token naturally expires. This is a follow-up to an earlier fix that patched cookies but missed the JWT revocation paths in these two authentication modules.

• CVE-2026-4881MEDIUM 6.5

  Octopus Server contains a missing permission check in one of its API endpoints. Any authenticated user—even with minimal privileges—can exploit this flaw to make server-level changes, such as modifying configuration or access controls. The vulnerability is deceptive: the API returns an error message to the caller, but the requested changes are applied anyway. This allows a low-privileged insider or compromised account to escalate their impact significantly.

• CVE-2026-49094MEDIUM 6.5

  A vulnerability in Kibana allows authenticated users with basic viewer access to cause the service to become unavailable by submitting specially crafted requests to analytics collection endpoints. When Kibana processes these requests, it exhausts system CPU and memory resources, forcing administrators to manually restart the service to restore availability. The attacker does not need elevated permissions—standard viewer-level credentials are sufficient to trigger the denial of service.

• CVE-2026-49095MEDIUM 6.5

  CVE-2026-49095 is a privilege escalation vulnerability in Elastic Kibana's Fleet agent policy management. An authenticated user with Fleet management permissions can manipulate how agent policies are configured in a way that bypasses input validation. This manipulation tricks Elastic Agents into receiving API keys with permissions beyond what they should have, potentially allowing unauthorized access to Elasticsearch security indices. The vulnerability requires an authenticated attacker with existing Fleet management privileges, limiting the immediate blast radius but posing a significant insider risk to organizations managing large agent fleets.

• CVE-2026-49144MEDIUM 6.5

  BrowserStack Runner versions up to 0.9.5 contain a path traversal flaw that allows attackers on the same network to read sensitive files from affected systems. The vulnerability exists in an unauthenticated HTTP server that runs by default, giving attackers a direct avenue to escape the intended project directory and access files elsewhere on the filesystem. No special privileges or user interaction are required to exploit this issue.

• CVE-2026-49204MEDIUM 6.5

  A firmware vulnerability in Acer Connect M6E 5G devices contains hardcoded credentials embedded in debug modules that should have been removed before release. These credentials provide access to internal AWS Cognito test environments, potentially allowing attackers to authenticate to backend services without legitimate credentials. The flaw affects both the device firmware and the product line itself.

• CVE-2026-49376MEDIUM 6.5

  JetBrains TeamCity versions prior to 2026.1 contain a vulnerability in the SAML authentication plugin where usernames are not properly validated. This weakness allows an attacker to bypass normal username restrictions and potentially gain unauthorized access or manipulate user identity claims during the authentication process. The vulnerability requires network access but no special credentials or user interaction to exploit.

• CVE-2026-49379MEDIUM 6.5

  JetBrains TeamCity versions prior to 2026.1 contain a credential exposure vulnerability where sensitive authentication information could leak through thread names. An authenticated attacker with access to the TeamCity server could potentially extract credentials from system logs or monitoring output that display thread identities. This is a server-side information disclosure issue that does not require user interaction and affects the confidentiality of stored credentials.

• CVE-2026-49385MEDIUM 6.5

  JetBrains YouTrack contains an access control flaw that allows standard users to modify service accounts—privileged system identities that handle automated tasks and integrations. This is a privilege escalation risk because service accounts typically have elevated permissions, and unauthorized modification could allow an attacker to hijack critical workflows or lateral-move within the organization. The vulnerability affects YouTrack versions prior to 2026.1.13570.

• CVE-2026-49386MEDIUM 6.5

  JetBrains YouTrack versions prior to 2026.1.13570 contain an access control flaw that allows authenticated users to discover restricted issues and articles on the Planning Canvas feature. While attackers cannot modify or delete content, they can enumerate sensitive information that should be hidden from their permission level. This is a credential-based attack—an attacker must have valid YouTrack login credentials to exploit it, but once authenticated, the vulnerability requires no special interaction or additional privileges.

• CVE-2026-49818MEDIUM 6.5

  A path traversal flaw in Apache Airflow's Samba provider allows attackers to write files to unintended locations on Samba file shares. The vulnerability exists in the `GCSToSambaOperator`, which copies objects from Google Cloud Storage to Samba without validating that the destination path remains within the configured boundary. An attacker who can upload files to the source GCS bucket (a common scenario when external data producers have write access) could craft object names using directory traversal sequences like `../` to escape the intended destination and write files anywhere on the target Samba system. This is particularly dangerous in shared data pipelines where the GCS bucket is not exclusively controlled by the DAG author.

• CVE-2026-49938MEDIUM 6.5

  CVE-2026-49938 is an access control flaw affecting Fortinet FortiPortal that allows authenticated users to access data or functions they should not have permission to reach. The vulnerability exists in FortiPortal versions 7.0 (all versions), 7.2.0 through 7.2.8, and 7.4.0 through 7.4.7. An attacker with valid credentials can exploit this to gain unauthorized visibility into sensitive information. This is not a remote unauthenticated attack—the threat actor must first obtain legitimate login credentials.

• CVE-2026-49940MEDIUM 6.5

  Net::CIDR::Set, a Perl library for managing IP address ranges, has a parsing vulnerability in versions up to 0.20. The library incorrectly accepts non-ASCII Unicode digits (such as Arabic-Indic numerals) in IP addresses and network masks. Because these Unicode characters aren't properly converted to their numeric values, network masks may be parsed incorrectly, potentially causing the library to accept a broader range of IP addresses than intended. This could allow an attacker to bypass network access controls or firewall rules that rely on this library for IP validation.

• CVE-2026-50212MEDIUM 6.5

  CVE-2026-50212 is a denial-of-service vulnerability in Acer Connect M6E 5G devices that allows an attacker on the same network segment to remotely disconnect other users' devices without authorization. The flaw stems from inadequate validation in the device dissociation API—the mechanism that normally unbinds user endpoints from the network. An attacker can exploit this to force legitimate users offline, disrupting service availability. No authentication is required, and the attack succeeds with minimal complexity.

• CVE-2026-5074MEDIUM 6.5

  ARMember Premium, a WordPress plugin, contains a SQL Injection vulnerability in its AJAX handler that processes user-supplied sort parameters without proper validation. An authenticated user with basic Subscriber privileges or higher can craft malicious input to extract sensitive data from the site's database. The vulnerability only impacts sites that have explicitly enabled the optional 'User Private Content' addon, which is disabled by default, limiting the blast radius.

• CVE-2026-5737MEDIUM 6.5

  The Independent Analytics WordPress plugin has a flaw that lets unauthenticated attackers make the server fetch files from anywhere on the internet or internal networks. The issue stems from two weaknesses: the plugin accepts attacker-controlled domain names via a public API endpoint, and a background job that downloads favicons doesn't validate where those requests go. By crafting a request with a forged signature (which is feasible because the signing key is embedded in public JavaScript), an attacker can inject a malicious domain into the database. When the favicon fetcher runs, it will make requests to that domain on behalf of your server, potentially exposing internal services or exfiltrating data.

• CVE-2026-7048MEDIUM 6.5

  The Photo Gallery by 10Web WordPress plugin contains a SQL injection vulnerability in its gallery ordering feature. An attacker with contributor-level WordPress access or higher can craft a malicious gallery shortcode that executes arbitrary SQL queries against the site database when the shortcode renders. This allows unauthorized extraction of sensitive data like user credentials, email addresses, and other database contents. The vulnerability affects all versions up to 1.8.40.

• CVE-2026-7542MEDIUM 6.5

  The Slider Revolution WordPress plugin (versions 7.0 to 7.0.10) contains a critical information disclosure flaw that allows low-privileged users to read sensitive server files. The vulnerability chains three design weaknesses: the plugin exposes AJAX security tokens to all logged-in users, it incorrectly allows unauthenticated access to a file-copying function, and it fails to properly validate and restrict which files can be copied to the public web directory. An attacker with a basic Subscriber account can exploit this to extract configuration files, database backups, credentials, keys, and logs—essentially any non-blacklisted file type on the server.

• CVE-2026-8045MEDIUM 6.5

  A vulnerability in Schneider Electric's StruxureWare Data Center Expert allows authenticated users with Data Center Expert account privileges to disclose sensitive files from the server by submitting malicious XML files to SOAP service endpoints. The vulnerability exploits improper handling of XML external entities (XXE), a well-known attack vector that lets attackers reference external files and retrieve their contents. An attacker must have valid Data Center Expert credentials to exploit this—it is not remotely exploitable by unauthenticated users.

• CVE-2026-8653MEDIUM 6.5

  MasterStudy LMS Pro Plus, a WordPress plugin used for learning management, contains a SQL injection flaw in how it processes the 'columns' parameter. Attackers with instructor-level or higher access can exploit this to run unauthorized database queries and steal sensitive data. The vulnerability affects all versions up to 4.8.20 and requires authentication but no user interaction.

• CVE-2026-8714MEDIUM 6.5

  A flaw in the RTSP (Real Time Streaming Protocol) server component of TP-Link Tapo C520WS v2 cameras allows an attacker on the local network to send specially crafted malformed input that causes the streaming service to stop responding. Once triggered, the camera's video streaming capability becomes unavailable until the service is restarted, effectively taking the camera offline for monitoring purposes.

• CVE-2026-8722MEDIUM 6.5

  A vulnerability in the Perl Net::Async::Statsd::Client library allows attackers to inject arbitrary metrics into statsd monitoring systems by exploiting insufficient input validation. Because the library fails to sanitize metric names for special characters (newlines, colons, and pipes), an attacker who controls metric input can inject additional monitoring data, potentially disrupting observability or falsifying application metrics.

• CVE-2026-8993MEDIUM 6.5

  The D.Launcher 2 component in the Slovak eID client ecosystem improperly handles custom URL protocols, allowing attackers to trigger NTLM authentication attempts or SMB connections to their servers, or conduct Server-Side Request Forgery (SSRF) attacks. The vulnerability requires a user to click a malicious link, making it a social engineering vector rather than an automated remote code execution. The exposure is primarily information disclosure through credential capture or network reconnaissance.

• CVE-2026-9493MEDIUM 6.5

  BankPro E-Service Technology's Service Center contains a flaw that allows someone with valid login credentials to view order details belonging to other customers. An attacker would modify a query parameter to bypass access controls and retrieve sensitive EC order information that should only be visible to the rightful account owner. This is a classic authorization bypass—the application fails to verify that the requesting user actually owns the data they're asking for.

• CVE-2026-9792MEDIUM 6.5

  Keycloak's Client Policies feature contains a bypass that weakens its security controls. When administrators configure policies to block the Resource Owner Password Credentials (ROPC) grant flow—a less secure authentication method—the system fails to enforce this restriction under certain conditions. An attacker can exploit this to obtain authentication tokens without proper authorization, potentially accessing sensitive data or impersonating legitimate users. The vulnerability affects how Keycloak validates policy conditions when client type, roles, attributes, or scopes are involved.

• CVE-2026-9796MEDIUM 6.5

  Keycloak has a timing vulnerability that allows an authenticated administrator with `manage-clients` permissions to temporarily escalate themselves to `realm-admin` role during a narrow window when role checks occur. Once granted, this elevated access persists indefinitely—even after the attacker's own admin permissions are removed or the system restarts. This creates a privilege escalation path that is difficult to detect and remediate after the fact.

• CVE-2026-9829MEDIUM 6.5

  Photo Gallery by 10Web, a popular WordPress plugin for creating mobile-friendly image galleries, contains a SQL injection vulnerability in versions up to 1.8.41. An attacker with contributor-level WordPress access (a lower-privileged account type) can inject malicious SQL commands through a shortcode parameter called 'compact_album_order_by'. The attacker stores this payload via an unprotected AJAX function, and it executes when the gallery is viewed on the front end, allowing the attacker to extract sensitive database information. This is a stored vulnerability—once the malicious shortcode is saved, it affects all site visitors.

• CVE-2026-9882MEDIUM 6.5

  CVE-2026-9882 is a memory safety flaw in the ANGLE graphics library used by Google Chrome that allows attackers to steal data from websites you're visiting, provided they trick you into viewing a specially crafted web page. The vulnerability stems from an integer overflow—a programming error where a number wraps around unexpectedly—enabling unauthorized cross-origin data leakage. While the Chromium team rated this as "Critical," the CVSS base score of 6.5 reflects that successful exploitation requires user interaction (clicking or viewing content) and doesn't enable code execution or system-level damage. The flaw affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-9908MEDIUM 6.5

  CVE-2026-9908 is a memory disclosure flaw in Google Chrome's ANGLE graphics library that lets attackers read uninitialized or sensitive data from your browser process. An attacker crafts a malicious HTML page; when you visit it, the bug leaks information that shouldn't be accessible—such as encryption keys, session tokens, or other sensitive values that happened to be in memory. The vulnerability requires user interaction (clicking through to a malicious site) but no authentication, and it affects Chrome versions before 148.0.7778.216.

• CVE-2026-9912MEDIUM 6.5

  A flaw in Google Chrome's GPU processing on Android allows attackers to steal sensitive information from your device's memory. An attacker can craft a malicious web page that, when you visit it, extracts data from Chrome's process memory without your knowledge. No action from you is required beyond visiting the page—the vulnerability is triggered automatically during normal browsing.

• CVE-2026-9917MEDIUM 6.5

  Google Chrome on Android contains a flaw in its WebGL graphics processing that fails to properly initialize memory before use. When a user visits a malicious webpage, an attacker can read sensitive data left in process memory—such as parts of cached images, passwords, or other application state—without needing special permissions or bypass techniques. This affects Chrome versions before 148.0.7778.216 on Android devices.

• CVE-2026-9953MEDIUM 6.5

  CVE-2026-9953 is a memory safety bug in the ANGLE graphics library used by Google Chrome that allows an attacker to read sensitive data from the browser process. An attacker can craft a malicious HTML page that, when visited by a user, exploits an out-of-bounds read to leak information like passwords, session tokens, or other confidential data stored in Chrome's memory. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require special privileges and works across Windows, macOS, and Linux. Google has assigned it high severity within Chromium's security framework.

• CVE-2026-9981MEDIUM 6.5

  A flaw in the Skia graphics rendering library within Google Chrome allows attackers to trick users into visiting malicious web pages that expose sensitive data from the browser's memory. The vulnerability requires user interaction (clicking a link or visiting a site) but needs no special privileges to exploit, making it a realistic threat to everyday Chrome users.

• CVE-2026-9996MEDIUM 6.5

  A flaw in Google Chrome's WebRTC component allows a remote attacker to trick a user into visiting a malicious webpage that reads sensitive data from the browser's memory. The vulnerability affects Mac users running Chrome versions before 148.0.7778.216. No user action beyond visiting a crafted page is required for the attacker to attempt exploitation.

• CVE-2021-47982MEDIUM 6.4

  WordPress administrators using the WP-Paginate plugin version 2.1.3 should be aware of a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into the plugin's settings. An attacker with login credentials can submit crafted requests to the plugin configuration page, embedding JavaScript payloads that are permanently stored in the database and executed whenever site administrators access those settings. This means the payload runs in the admin's browser session, potentially allowing the attacker to steal session tokens, modify site content, create new admin accounts, or perform other harmful actions on behalf of the compromised administrator.

• CVE-2021-47983MEDIUM 6.4

  The Stripe Payments WordPress plugin version 2.0.39 contains a stored cross-site scripting (XSS) vulnerability that allows logged-in attackers to inject malicious JavaScript code into plugin settings. When an administrator views these compromised settings, the injected script executes in their browser with full administrative privileges. This type of attack is particularly dangerous because the malicious code persists in the database and affects all administrators who access the settings page.

• CVE-2021-47984MEDIUM 6.4

  The WP24 Domain Check WordPress plugin version 1.6.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with plugin access to inject malicious JavaScript code. When an admin later views the plugin's settings page, that injected code executes in their browser, potentially allowing the attacker to perform unauthorized actions on their behalf or steal sensitive information. This is a persistence threat—once injected, the malicious script remains in the plugin settings until manually removed.

• CVE-2025-14042MEDIUM 6.4

  The Automotive Car Dealership Business WordPress Theme contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 13.4.1. An attacker with contributor-level or higher permissions can inject malicious scripts into Portfolio Item 'Project Details' fields. These scripts will execute when other users view the affected pages, potentially compromising visitor sessions, stealing credentials, or defacing content. The vulnerability stems from the theme's failure to properly sanitize and escape user input in a custom field.

• CVE-2025-59610MEDIUM 6.4

  A memory corruption vulnerability affects numerous Qualcomm chipsets and platforms when processing IOCTL (input/output control) requests that contain mismatched API versions. The flaw stems from concurrent modification of user-space buffers during processing, allowing a privileged local attacker to corrupt kernel memory and potentially gain elevated code execution. The vulnerability requires high privilege access and specific conditions to trigger, limiting opportunistic exploitation but posing significant risk in compromised or malicious insider scenarios.

• CVE-2026-0409MEDIUM 6.4

  NETGEAR Orbi 370 series mesh routers contain a vulnerability that allows attackers to execute arbitrary commands on the device. An attacker must intercept and modify network traffic between the router and the Internet, then wait for the device administrator to perform specific management actions. The vulnerability affects Orbi 370, 371, 372, and 374 models running firmware versions prior to V12.1.2.7.

• CVE-2026-10024MEDIUM 6.4

  The TinyMCE shortcode Addon plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 1.0.0. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code into pages via the 'btnrel' shortcode attribute. Because the plugin fails to properly sanitize and escape this input, the injected script will execute in the browsers of anyone who views the affected page. This is a *stored* vulnerability, meaning the malicious code persists in the page content until explicitly removed.

• CVE-2026-10732MEDIUM 6.4

  The decompress package contains a critical flaw that allows attackers to write files anywhere on a system by uploading a specially crafted ZIP archive. The vulnerability exploits a race condition in how the library processes ZIP entries: when a ZIP contains two entries with identical paths—first a symlink pointing to an arbitrary location, then a regular file—the library writes the file's contents through the symlink to a location outside the intended extraction folder. This bypasses protections added in previous fixes, potentially enabling remote code execution if an attacker can control ZIP uploads or extraction workflows.

• CVE-2026-10738MEDIUM 6.4

  The jQuery Hover Footnotes plugin for WordPress allows attackers who can write or edit content on a site (author-level access or higher) to hide malicious scripts inside footnote markup. These scripts execute whenever anyone views the affected page. The vulnerability exists because the plugin doesn't properly clean user input before storing it, and the hidden scripts bypass WordPress's built-in protections by using a specific syntax that avoids HTML tags.

• CVE-2026-10862MEDIUM 6.4

  The Accordions plugin for WordPress has a security flaw that allows authenticated users with custom-level permissions or higher to inject malicious scripts into accordion content. When other users view pages containing these injected scripts, the scripts execute in their browsers, potentially exposing sensitive information or performing unwanted actions on their behalf. This vulnerability affects all versions up to and including 2.3.23.

• CVE-2026-20454MEDIUM 6.4

  CVE-2026-20454 is a privilege escalation vulnerability in MediaTek's geniezone component affecting multiple system-on-chip (SoC) models. An attacker who already holds System privilege can exploit a race condition in memory handling to read or modify sensitive data and potentially gain higher-level control. No user interaction or network access is required—exploitation occurs locally once System privilege is obtained.

• CVE-2026-2382MEDIUM 6.4

  The FPW Category Thumbnails WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.9.5. Any user with Subscriber-level access or higher can inject malicious JavaScript through the 'id' parameter in an AJAX function. This script persists in the plugin's settings and executes whenever an administrator views that page, potentially compromising administrator accounts. The vulnerability stems from the plugin failing to properly clean and escape user input before storing and displaying it.

• CVE-2026-25600MEDIUM 6.4

  PDBM application contains a critical cryptographic weakness: a single hard-coded encryption secret embedded in the executable file that is identical across all installations. This secret is used to encrypt and decrypt user credentials stored in the application's configuration files. An attacker with local system access can extract this secret from the PDBM.exe binary, then use it to decrypt stored administrative credentials. Because the default configuration assigns these credentials administrative privileges within PDBM, successful exploitation grants attackers complete control over the application's management functions and operational capabilities.

• CVE-2026-3011MEDIUM 6.4

  The Recipe Card Blocks Lite WordPress plugin contains a flaw that allows authenticated authors and above to inject malicious scripts into recipe blocks. These scripts execute when anyone views the published post or its print version, potentially compromising visitor sessions or redirecting them to malicious sites. The vulnerability exists because the plugin decodes special character sequences after security checks have already been completed, bypassing intended protections.