By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 32 of 41

• CVE-2026-10645MEDIUM 4.9

  Zephyr's ext2 filesystem driver contains memory safety flaws when processing directory entries on ext2-formatted storage devices. An attacker who supplies a crafted ext2 image—via USB drive, SD card, or mounted file—can trigger out-of-bounds reads that leak kernel heap memory, cause the system to hang indefinitely, or corrupt memory. Any filesystem operation (opening files, listing directories, deleting files, renaming) on the malicious volume triggers the defect. The vulnerability affects all Zephyr versions from 3.5.0 through 4.4.0.

• CVE-2026-10736MEDIUM 4.9

  The Tutor LMS plugin for WordPress, a popular learning management system, contains a SQL injection flaw in versions up to 3.9.11. An authenticated administrator can inject malicious SQL commands through the 'data' parameter to extract sensitive database information. This is not an unauthenticated attack—it requires admin-level access—which significantly limits real-world exposure in most WordPress installations.

• CVE-2026-10741MEDIUM 4.9

  Sonatype Nexus Repository Manager versions before 3.93.0 have a flaw that allows repository administrators with delegated authority to access upstream proxy credentials that should be protected. When a Nexus instance is configured to proxy external repositories, it stores credentials needed to authenticate with those upstream servers. An administrator with limited permissions—one who manages only specific repositories—can exploit this vulnerability to retrieve credentials that should remain hidden even from them. This is a credential disclosure issue with medium severity that requires administrator-level access to exploit.

• CVE-2026-11360MEDIUM 4.9

  A SQL injection vulnerability exists in the Advanced Order Export For WooCommerce plugin affecting all versions through 4.0.10. Authenticated users with shop manager privileges or higher can inject malicious SQL commands through the 'sort_direction' parameter to extract sensitive data from the WordPress database. The vulnerability requires valid authentication and specific WordPress capabilities, limiting the attack surface to trusted internal users or compromised administrator accounts.

• CVE-2026-11776MEDIUM 4.9

  The Form Maker by 10Web WordPress plugin is susceptible to SQL injection through the 'groupids' parameter. An authenticated administrator can craft malicious input to execute unauthorized database queries and extract sensitive information. The vulnerability affects all versions up to and including 1.15.43 and requires administrator-level credentials to exploit.

• CVE-2026-11777MEDIUM 4.9

  The Form Maker by 10Web WordPress plugin contains a SQL injection vulnerability in its 'name' parameter that allows authenticated administrators to execute arbitrary SQL queries. An attacker with admin access could extract sensitive database information by injecting malicious SQL code into form submissions. The vulnerability affects all versions up to and including 1.15.43.

• CVE-2026-11789MEDIUM 4.9

  389 Directory Server contains a flaw in its SMD5 password storage plugin that causes the LDAP server to crash when processing certain malformed password hashes. An authenticated attacker with high privileges can trigger this crash by submitting a specially crafted password hash shorter than 16 bytes, which causes the plugin to miscalculate memory boundaries and read beyond allocated buffers. The crash results in denial of service but does not leak sensitive data or compromise authentication logic itself.

• CVE-2026-11790MEDIUM 4.9

  389 Directory Server contains a weakness in how it handles password verification when using PBKDF2-SHA256 encryption. An attacker with administrative access can tamper with a user's stored password hash to include an extremely high iteration count. When that user (or an automated system) attempts to authenticate, the server wastes excessive CPU resources recalculating the password hash, effectively freezing responsiveness for legitimate users. This is a denial-of-service attack that requires the attacker to already have administrative privileges to modify password data.

• CVE-2026-11793MEDIUM 4.9

  A stack buffer overflow vulnerability has been identified in 389 Directory Server's password handling code. When parsing specially crafted credentials, the checkPrefix() function in pw.c fails to validate the length of an algorithm identifier before copying it into a fixed 256-byte buffer. An attacker with Directory Manager credentials can exploit this to crash the LDAP server. While the vulnerability could theoretically allow code execution, compiler protections like FORTIFY_SOURCE limit the practical impact to denial of service in most deployments.

• CVE-2026-11827MEDIUM 4.9

  GitLab Enterprise Edition contains an authorization flaw that allows authenticated maintainers to access other users' stored credentials without proper permission checks. The issue affects multiple release lines and requires an attacker to already have maintainer-level access to the affected project or group. While the technical barrier is moderate, the impact—unauthorized disclosure of sensitive credentials—makes this a notable security concern for organizations running vulnerable GitLab instances.

• CVE-2026-11844MEDIUM 4.9

  CVE-2026-11844 is a path traversal vulnerability in IEI Integration Corp's iVEC-IEI Virtualization Edge Computer that allows an authenticated attacker with elevated privileges to read arbitrary files outside the device's intended directory structure. An attacker with high-level access to the device could potentially access sensitive configuration files, credentials, or other protected data by manipulating file path requests. This is not a vulnerability an unauthenticated external attacker can exploit—it requires someone with administrative or privileged credentials already on the system.

• CVE-2026-11986MEDIUM 4.9

  Keycloak's admin-ui-ext component has a permission-checking flaw that allows limited administrators to strip high-privilege roles from other users or administrators. An attacker with delegated admin rights can exploit bulk role-removal endpoints to bypass intended access controls, potentially locking out legitimate administrators or escalating their own influence within the system.

• CVE-2026-12089MEDIUM 4.9

  The LWS Optimize WordPress plugin contains a path traversal vulnerability that allows authenticated users with Editor-level permissions or higher to read files from the server's filesystem. The plugin's CSS optimization feature trusts stylesheet URLs embedded in HTML without properly validating that resolved file paths stay within WordPress's directory boundaries. An attacker with sufficient WordPress account privileges could exploit this to access sensitive configuration files, database credentials, or other non-public data stored on the server.

• CVE-2026-12920MEDIUM 4.9

  The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent WordPress plugin contains a SQL injection vulnerability in versions 4.3.5 and earlier. An authenticated administrator can craft malicious input through the 's' parameter to inject arbitrary SQL commands and extract sensitive data from the WordPress database. While the vulnerability requires admin-level access to exploit, it poses a meaningful risk in multi-user WordPress environments or where admin credentials have been compromised.

• CVE-2026-12936MEDIUM 4.9

  The Recurio – Ultimate Subscription for WooCommerce plugin contains a SQL injection vulnerability in its 'data' parameter that allows authenticated shop managers and administrators to extract sensitive database information. The vulnerability exists because user input is not properly sanitized before being used in database queries. An attacker with legitimate shop manager credentials or higher can craft malicious requests to execute unintended SQL commands and access confidential data like customer records, payment information, or other sensitive details stored in the WordPress database.

• CVE-2026-13357MEDIUM 4.9

  The Houzez Property Feed plugin for WordPress contains a SQL injection vulnerability in versions up to 2.5.46. An attacker with administrator-level access can manipulate the 'orderby' parameter to execute arbitrary SQL queries and steal sensitive data from the website's database. The vulnerability exists because user input is only lightly sanitized before being inserted into an SQL statement, bypassing WordPress's built-in protection mechanisms.

• CVE-2026-13434MEDIUM 4.9

  KubeVirt's network annotation generator fails to validate user-supplied network names before writing them into pod configuration. A tenant with edit permissions can craft a malicious network name containing JSON that tricks Multus (the Kubernetes networking plugin) into connecting workloads to networks in other namespaces, bypassing network isolation. This risk is amplified when the ExternalNetResourceInjection feature gate is enabled, which skips additional safety checks. The attacker gains access to segregated network segments and can spoof IP and MAC addresses.

• CVE-2026-14342MEDIUM 4.9

  The Mail Mint WordPress plugin, used for email marketing and WooCommerce integration, contains a SQL injection vulnerability affecting all versions up to 1.24.2. An authenticated administrator can manipulate the 'contact_ids' parameter to inject malicious SQL commands and extract sensitive data from the WordPress database. While access requires administrator-level privileges, the vulnerability allows unauthorized data exfiltration once those credentials are compromised or misused.

• CVE-2026-14362MEDIUM 4.9

  HashiCorp's memberlist library, a Go package used for cluster membership and failure detection, contains a flaw in how it processes incoming gossip protocol messages that can cause a process to run out of memory and crash. An attacker with network access to the gossip port can trigger this condition remotely. The vulnerability is resolved in memberlist version 0.6.0 and later.

• CVE-2026-14475MEDIUM 4.9

  The WPLP Cookie Consent plugin for WordPress contains a SQL injection vulnerability affecting all versions up to 4.3.6. An attacker with WordPress administrator access can manipulate the 'scan_id' parameter to inject malicious SQL commands and extract sensitive data from the website's database. While this requires high-level credentials to exploit, the impact on data confidentiality is significant.

• CVE-2026-36778MEDIUM 4.9

  A stack overflow vulnerability has been identified in Tenda O3 Wireless Router version 1.0.0.5(4180). The flaw exists in how the router processes the username parameter when handling certain web requests. An attacker with elevated privileges on the network can send a specially crafted HTTP request that causes the router to crash, resulting in a denial of service. The router would need to be rebooted to restore functionality. This is a medium-severity issue that requires administrative-level access to exploit, limiting its immediate threat in most environments.

• CVE-2026-41280MEDIUM 4.9

  Apache DolphinScheduler contains an authorization flaw that allows authenticated users with system login privileges to delete task definitions in projects they shouldn't have access to. The vulnerability arises from insufficient permission checks when handling task definition deletion requests. An attacker with valid system credentials could exploit this to disrupt workflow orchestration by removing critical task definitions from other projects, potentially causing operational disruption. The issue is limited to versions before 3.4.2 and requires existing system access to exploit.

• CVE-2026-41412MEDIUM 4.9

  alf.io is an open-source ticketing platform used by conferences and events to manage reservations. The vulnerability lies in how alf.io sandboxes custom extensions (plugins) that users can write to extend functionality. The sandbox was designed to safely run untrusted extension code, but it failed to protect file access. Specifically, extensions have access to an HTTP client tool that includes a method for uploading files. This method does not validate or restrict which files can be read—a malicious extension can read any file that the alf.io application has permission to access on the server, then send that file's contents to an attacker's server. An attacker would need to either write a malicious extension or trick an administrator into installing one, but once active, the extension can quietly exfiltrate sensitive data like configuration files, database credentials, or user records.

• CVE-2026-42147MEDIUM 4.9

  Coolify, an open-source platform for managing servers and cloud infrastructure, contains a vulnerability that allows authenticated administrators with storage permissions to trick the application into making requests to sensitive internal systems. When configuring S3 storage endpoints, Coolify validates only the URL format without blocking access to private networks or cloud metadata services. An attacker with legitimate admin credentials could exploit this to probe internal systems, potentially discovering sensitive configuration data or service credentials exposed through metadata endpoints. The vulnerability is fixed in version 4.0.0-beta.474.

• CVE-2026-43752MEDIUM 4.9

  FileMaker Server contains a vulnerability in the Open Source LLM setup feature accessible from the Admin Console. An authenticated administrator can upload a specially crafted file that leads to arbitrary code execution on the underlying host system. The vulnerability requires admin-level access and has been patched in FileMaker Server 26.0.1.

• CVE-2026-44917MEDIUM 4.9

  A vulnerability in OpenStack Ironic before version 35.0.2 allows authenticated project administrators or managers to read sensitive files directly from the Ironic conductor server through a specially crafted PXE template. This is a credential-required attack where an insider with project admin or manager privileges can exploit the template processing mechanism to access files they shouldn't be able to retrieve, potentially exposing configuration secrets, credentials, or other sensitive data stored on the conductor.

• CVE-2026-45559MEDIUM 4.9

  Roxy-WI, a web management interface for HAProxy, Nginx, Apache, and Keepalived servers, contains an LDAP injection vulnerability in its user authentication module. An administrator can manipulate the username parameter to break out of the intended LDAP search filter and enumerate or extract sensitive user attributes—such as email addresses—that should remain hidden. The vulnerability exists because user input is directly concatenated into the LDAP query without proper sanitization or escaping. While exploitation requires administrative privileges, the attack is straightforward once access is obtained, making it a credential harvesting risk in multi-tenant or federated identity environments.

• CVE-2026-45684MEDIUM 4.9

  OpenTelemetry eBPF Instrumentation versions 0.7.0 through 0.8.x contain a buffer handling flaw in the log enricher component. When log injection is enabled, attackers can craft a multi-segment write operation that tricks the instrumentation into reading beyond the intended buffer boundary, potentially overwriting memory. This could lead to information disclosure, data corruption, or application instability on systems using the affected versions.

• CVE-2026-45731MEDIUM 4.9

  WWBN AVideo, an open-source video hosting platform, contains a file-read vulnerability in its database migration feature. An authenticated administrator can manipulate the migration process to read sensitive text files from the server's filesystem. This requires existing admin access, so it poses a targeted insider risk rather than a mass-exploitation threat, but it can expose configuration files, credentials, or other data to a compromised or malicious admin account.

• CVE-2026-46464MEDIUM 4.9

  Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7, along with specific LTS releases (8.6.1.0–8.6.1.10, 8.3.1.0–8.3.1.30, and 7.13.1.0–7.13.1.70), contain a link-following vulnerability that could allow a high-privileged remote attacker to access sensitive information. The flaw stems from improper validation of symbolic links or file path traversal before accessing files on the system. While the attack requires elevated privileges and does not permit system modification or unavailability, the potential for information disclosure in a data protection appliance warrants attention.

• CVE-2026-48947MEDIUM 4.9

  CVE-2026-48947 is a medium-severity access control flaw in Joomla that allows privileged users to overwrite media files even when they lack explicit editing permissions. The vulnerability stems from an improper check during file operations, enabling privilege escalation within the application's permission model. While the issue requires an authenticated attacker with elevated privileges, it can lead to unauthorized modification of critical media assets.

• CVE-2026-49198MEDIUM 4.9

  CVE-2026-49198 is a medium-severity access control flaw in Acer Predator Connect W6X MQTT brokers that allows high-privileged users to subscribe to wildcard topics, inadvertently gaining visibility into all MQTT traffic flowing through the system. While the vulnerability requires authenticated access with elevated permissions, once exploited it enables an insider or compromised admin account to eavesdrop on sensitive IoT communication without additional authorization constraints. This is a confidentiality risk with no impact to system availability or integrity.

• CVE-2026-50219MEDIUM 4.9

  libexpat, a widely-used XML parsing library, contains a use-after-free vulnerability in versions before 2.8.2. The flaw occurs when certain XML parsing functions (XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset) are called from within event handlers without proper depth tracking. This can lead to memory safety violations and potentially allow attackers to crash applications or, in some scenarios, execute arbitrary code. The vulnerability requires local access and specific conditions to trigger, making it a moderate-risk issue rather than a widespread internet-facing threat.

• CVE-2026-50224MEDIUM 4.9

  The Acer Connect M6E 5G router's web administration panel is configured to listen on all public IPv6 addresses on port 8080, without built-in firewall protections. This means the internal API endpoints used to manage the device can be reached directly over the internet by anyone who knows the device exists and its IPv6 address, potentially allowing unauthorized access to sensitive configuration and status information.

• CVE-2026-50565MEDIUM 4.9

  Fission, an open-source serverless framework for Kubernetes, had a configuration flaw in versions before 1.24.0 where builder pods automatically mounted sensitive service account credentials into user-supplied container images. This meant anyone deploying a function through Fission could potentially access the credentials needed to interact with your Kubernetes cluster, such as listing resources or reading secrets. The issue stems from Kubernetes' default behavior of auto-mounting service account tokens unless explicitly disabled—Fission wasn't disabling this protection for builder pods. The flaw has been patched in version 1.24.0.

• CVE-2026-55079MEDIUM 4.9

  Coder, a platform for provisioning remote development environments via Terraform, contains a memory exhaustion vulnerability in its provisioner daemon. When clients upload files, the daemon fails to validate the claimed file size before allocating memory, allowing an authenticated attacker to trigger out-of-memory conditions by claiming extremely large file sizes. The vulnerability affects versions 2.24.0 through 2.34.1 across multiple release branches, and has been patched in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2.

• CVE-2026-56080MEDIUM 4.9

  Capgo versions before 12.128.2 have a bug in their password policy enforcement system. When a Super Admin enables the Enforce Password Policy feature and changes their password to meet the requirements, the system incorrectly continues to treat the account as non-compliant. This causes the backend to repeatedly force password reset prompts, effectively locking the Super Admin out of their organization—even though their credentials are valid. The result is a denial of service affecting administrative access.

• CVE-2026-56131MEDIUM 4.9

  libexpat, a widely-used XML parsing library, contains a use-after-free vulnerability in versions before 2.8.2. The flaw occurs when the XML_ResumeParser function is called from within a handler and a policy violation is detected. In such cases, the library fails to properly track the call stack depth, leaving freed memory accessible and potentially exploitable. This is analogous to an earlier vulnerability (CVE-2026-50219) in the same codebase.

• CVE-2026-56149MEDIUM 4.9

  A vulnerability in Elasticsearch allows users with administrative or elevated privileges to crash an Elasticsearch node by submitting a malicious machine learning request. The attack causes the affected node to consume excessive memory until it becomes unavailable, effectively denying service to legitimate users. This is a resource exhaustion issue that requires elevated permissions to exploit, limiting its immediate blast radius but still posing operational risk in multi-tenant or shared Elasticsearch environments.

• CVE-2026-56228MEDIUM 4.9

  Capgo versions before 12.128.2 contain a flaw that allows organization administrators to set an impossibly high minimum password length requirement—potentially billions of characters—without any safeguards. Once enabled, this broken policy locks out all users in the organization from changing their passwords or logging in, effectively shutting down access to the application for everyone. This is a self-inflicted denial of service that requires admin-level access to trigger but can paralyze an entire organization.

• CVE-2026-56412MEDIUM 4.9

  libexpat, a widely-used XML parsing library, contains a use-after-free vulnerability in its CDATA section handling. The issue stems from incomplete depth tracking when handlers are invoked during XML processing, allowing memory already freed by one operation to be accessed by another. This affects versions before 2.8.2. While the immediate trigger requires specific XML policy violations and local system access, the underlying condition can lead to crashes or potentially arbitrary code execution if an attacker controls the malicious XML input.

• CVE-2026-59819MEDIUM 4.9

  LiteLLM, a proxy server used to standardize API calls to large language models, contains a vulnerability in its connection testing endpoint that allows authorized administrators to read sensitive files from the server's filesystem. An attacker with legitimate access to the `/health/test_connection` API could craft requests that reference local files via OIDC configuration parameters, effectively bypassing normal file access restrictions. This affects versions before 1.83.10-stable and is particularly concerning in shared or multi-tenant environments where proxy administration privileges may be distributed.

• CVE-2026-59854MEDIUM 4.9

  SiYuan is a popular open-source personal knowledge management platform. Versions prior to 3.7.1 contain a file-access vulnerability in the global file copy API endpoint that allows authenticated users with administrator privileges or valid API tokens to extract sensitive credential files from the host system. An attacker can exploit a gap in the file-path validation logic to copy commonly-used credential stores—such as Git credentials, SSH keys, database passwords, Kubernetes configuration, and Docker authentication tokens—from the user's home directory into the SiYuan workspace, then download them via the file API. The vulnerability requires valid authentication, limiting exposure to insider threats or compromised service accounts.

• CVE-2026-6448MEDIUM 4.9

  The Quiz and Survey Master plugin for WordPress contains a SQL injection flaw in how it processes the 'order' parameter. An admin-level attacker can craft malicious requests to extract sensitive data from the WordPress database. The vulnerability is time-based and blind, meaning attackers infer results through response delays rather than direct output. If the plugin's secret key becomes public, lower-privileged users could exploit it without admin credentials.

• CVE-2026-7547MEDIUM 4.9

  The Woosa – Marktplaats for WooCommerce plugin contains a path traversal vulnerability that allows authenticated site administrators to read sensitive files from the server, such as the WordPress configuration file. An attacker with admin credentials can manipulate a file parameter to escape the plugin's intended log directory and access arbitrary files, potentially exposing database credentials and other secrets stored in wp-config.php.

• CVE-2026-7565MEDIUM 4.9

  The LearnPress – Backup & Migration Tool plugin for WordPress contains a flaw that allows site administrators to read files from anywhere on the server by manipulating a parameter called 'import-user-file'. While this requires admin-level access to exploit, the impact is serious: attackers with those credentials could retrieve sensitive configuration files, database credentials, or other confidential data stored on the server.

• CVE-2026-8978MEDIUM 4.9

  The OptinCraft WordPress plugin contains a SQL injection vulnerability in its 'order_by' parameter that allows authenticated administrators to extract sensitive database information. The flaw exists because user input is not properly escaped before being used in database queries. While this requires admin-level access to exploit, it represents a significant insider threat risk, especially in multi-user WordPress environments where administrative accounts may be compromised or operated by untrusted parties.

• CVE-2026-9083MEDIUM 4.9

  Keycloak realm administrators with "manage-realm" permissions can craft specially designed filesystem paths when setting up key provider components, allowing them to determine which files exist and can be read by the Keycloak service. This reconnaissance capability enables attackers to map the system's file structure and identify sensitive files before attempting further compromise.

• CVE-2026-9197MEDIUM 4.9

  Smart Slider 3, a popular WordPress plugin, contains a directory traversal vulnerability affecting all versions up to 3.5.1.36. An authenticated WordPress administrator can exploit the replaceHTMLImage function to read sensitive files from the server, including configuration files, database credentials, and other confidential data. The attack requires administrator-level privileges and direct knowledge of the server's file paths, but poses a meaningful risk in environments where admin access is delegated or compromised.

• CVE-2026-9576MEDIUM 4.9

  The Fluent Booking WordPress plugin contains an authorization flaw that allows Calendar Managers to download attendee personal information from booking groups they don't have permission to access. An authenticated user with the Calendar Manager role can exploit this to retrieve names, emails, phone numbers, addresses, and payment details of attendees from groups outside their scope. This vulnerability affects versions prior to 2.1.2 and requires administrator intervention to patch.

• CVE-2026-9801MEDIUM 4.9

  Keycloak has a vulnerability that allows a high-privileged attacker—such as a realm administrator or someone who has compromised an upstream LDAP server—to crash the Keycloak service by sending a specially crafted LDAP password policy response. When triggered during authentication, this causes the Java process to run out of memory and shut down, knocking the service offline for all users on that node. The attack requires either legitimate administrative access to configure a malicious LDAP directory or prior compromise of an existing LDAP backend.

• CVE-2024-1248MEDIUM 4.8

  A vulnerability in federated authentication systems allows an attacker to hijack and reassign user roles when a federated identity provider has silent just-in-time account provisioning enabled. If a federated user shares a username with an existing local account, the provisioning process can overwrite the local user's roles with whatever the federated system assigns. An attacker needs to know a legitimate local username and have access to a federated identity provider configured with silent JIT provisioning to execute this attack. The impact is limited to role changes (typically to minimal access levels) rather than full account takeover.

• CVE-2026-0266MEDIUM 4.8

  A stored cross-site scripting (XSS) vulnerability exists in Palo Alto Networks PAN-OS that allows an authenticated administrator to inject malicious JavaScript into the web interface. The payload persists in the system and executes when other users access the affected interface, potentially compromising their sessions or stealing sensitive data. The vulnerability requires valid administrator credentials to exploit, which significantly limits the attack surface but remains a genuine concern for insider threats or compromised admin accounts.

• CVE-2026-10057MEDIUM 4.8

  ITS Intelligent SCADA System contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with elevated privileges to inject malicious JavaScript code into the application. Once injected, this code persists in the system and executes automatically whenever other users load affected pages in their browsers. This is distinct from reflected XSS because the payload remains embedded in the application, posing a sustained risk to all users who access the compromised content.

• CVE-2026-10058MEDIUM 4.8

  ITS Intelligent SCADA System contains a stored cross-site scripting (XSS) flaw that lets high-privilege attackers inject malicious JavaScript into the system. When other users load affected pages, that injected code runs in their browsers automatically. This is a persistence threat—the malicious script stays in the system until removed, affecting anyone who accesses the compromised page.

• CVE-2026-10634MEDIUM 4.8

  A race condition in Zephyr's TCP stack allows an attacker on the local network to crash the system or potentially read sensitive memory. The vulnerability exists in how the TCP layer iterates through active connections while a background thread can simultaneously free those connections, causing the iterator to access memory that has already been released. While the attacker needs local network access and user privileges to trigger the issue reliably, the outcome is denial of service or information disclosure on affected embedded and IoT devices running Zephyr.

• CVE-2026-10639MEDIUM 4.8

  Zephyr's IPv4 networking stack contains a use-after-free vulnerability in how it handles ping (ICMP echo) responses. When the device sends back a reply to an incoming ping, it processes the packet through the transmission path, which may immediately free the packet's memory. The code then attempts to read data from that freed memory to update network statistics, creating a window for reading corrupted or recycled data. An attacker can trigger this by sending repeated pings to a Zephyr device, potentially causing statistics corruption or a crash. The vulnerability requires specific configuration options to be enabled and the timing must align with the kernel's memory recycling, making exploitation probabilistic but feasible over a network without authentication.

• CVE-2026-10652MEDIUM 4.8

  A flaw in the Zephyr real-time operating system's DNS resolver allows an attacker to read unintended memory contents from a device. When a malicious or spoofed DNS server sends a specially crafted response with a TXT or SRV record claiming to be larger than it actually is, the resolver reads beyond the DNS response packet into adjacent memory—potentially exposing stale data from prior DNS queries or uninitialized memory pools. An attacker on the network, intercepting DNS traffic, or (if multicast DNS is enabled) any device on the local network can trigger this. The leaked data is typically small (under 64 bytes) and read-only, but in some cases could cause a crash. Zephyr versions 4.3.0 and 4.4.0 are affected.

• CVE-2026-12491MEDIUM 4.8

  vLLM, a widely-used open-source library for running large language models, has a flaw in how it processes images. When the library converts images to a standard format (RGB), it does not properly preserve image metadata like EXIF orientation information or transparency data (PNG tRNS chunks). This mishandling can cause transparent pixels to be rendered incorrectly or remapped unexpectedly, distorting the original image content that the model sees. The result is that the language model may misinterpret what's in the image, compromising data integrity.

• CVE-2026-12549MEDIUM 4.8

  A regression in HTTP Range request handling allows clients to craft requests that bypass security checks, resulting in malformed responses and potential service disruption. When a Range request specifies a suffix length larger than the content being served, the code fails to properly validate the resulting negative offset, leading to incorrect HTTP 206 Partial Content responses and excessive logging that can consume resources.

• CVE-2026-13373MEDIUM 4.8

  WatchGuard Fireware OS contains a stored cross-site scripting (XSS) vulnerability in its Tigerpaw Technology Integration module. An attacker with high privilege access can inject malicious scripts that remain permanently stored in the system and execute when other users view affected pages. This is a secondary exploitation path related to CVE-2025-13936. The vulnerability requires user interaction to trigger and affects a wide range of WatchGuard Firebox appliances and FireboxCloud/FireboxV platforms.

• CVE-2026-13374MEDIUM 4.8

  WatchGuard's Fireware operating system contains a stored cross-site scripting (XSS) vulnerability in the ConnectWise Technology Integration module. An attacker with high-level administrative privileges can inject malicious scripts that persist in the system and execute in the browsers of other users who view affected pages. This is a secondary attack path related to the previously disclosed CVE-2025-13937. The vulnerability requires user interaction to trigger and affects the confidentiality and integrity of data visible to victims, but does not impact system availability.

• CVE-2026-13375MEDIUM 4.8

  WatchGuard Fireware OS contains a stored cross-site scripting (XSS) vulnerability in its Autotask Technology Integration module. An authenticated attacker with high privileges can inject malicious scripts that remain in the system and execute in the browsers of other users who interact with affected pages. This is a secondary attack vector for an earlier vulnerability (CVE-2025-13938). The vulnerability requires administrator-level access and user interaction to exploit, limiting immediate risk but warranting attention in environments with untrusted or compromised admin accounts.

• CVE-2026-13376MEDIUM 4.8

  WatchGuard's Fireware OS contains a stored cross-site scripting (XSS) vulnerability in the spamBlocker module that allows authenticated attackers to inject malicious scripts into web pages. Because the payload is stored, any user accessing the affected page will execute the attacker's code in their browser. This is a secondary attack path related to the previously disclosed CVE-2025-1071 and requires administrative privilege to exploit, but once injected, affects all viewers of the compromised content.

• CVE-2026-13377MEDIUM 4.8

  WatchGuard Fireware OS contains a stored cross-site scripting (XSS) vulnerability in its SIP Proxy module that allows authenticated attackers with high privileges to inject malicious scripts into web pages. When other users access the affected page, the injected script executes in their browser, potentially compromising their session or stealing sensitive information. This is a follow-on attack vector for an earlier vulnerability (CVE-2025-6947) that was not fully mitigated. The vulnerability affects a broad range of WatchGuard Firebox appliances and FireboxCloud deployments.

• CVE-2026-14154MEDIUM 4.8

  CVE-2026-14154 is a UI spoofing vulnerability in Google Chrome's DevTools that requires an attacker to trick a user into installing a malicious extension. Once installed, the extension can display fake interface elements to deceive users, potentially leading to credential theft or social engineering attacks. While Google rates this as low severity, the attack chain depends on user action to install the extension, which limits but does not eliminate risk.

• CVE-2026-14781MEDIUM 4.8

  Keycloak's OIDC identity provider feature contains a flaw in how it validates email addresses when integrating with external authentication systems. When configured to trust email claims from an upstream OIDC provider, Keycloak retrieves the actual email address from one source (userinfo endpoint) but checks whether that email is verified using a claim from a different source (the id_token). If an attacker controls the upstream OIDC provider and makes these two sources return different email addresses, Keycloak will incorrectly mark the userinfo email as verified based on the id_token claim, even though that claim refers to a completely different email address. This allows an attacker to bypass email verification controls and potentially take over accounts in applications that rely on the email_verified flag for account linking.

• CVE-2026-22674MEDIUM 4.8

  Hashgraph Guardian versions up to 3.6.0 contain a stored cross-site scripting (XSS) flaw in the branding configuration feature. An authenticated user with the STANDARD_REGISTRY role can inject malicious JavaScript by submitting a specially crafted company name through the branding API. This injected script executes automatically in every authenticated user's browser on each page load, potentially allowing the attacker to steal session tokens, perform unauthorized actions, or redirect users to malicious sites.

• CVE-2026-25558MEDIUM 4.8

  QloApps versions up to 1.7.0 contain a stored cross-site scripting (XSS) vulnerability in the admin file manager. An authenticated administrator can upload a specially crafted SVG file containing malicious JavaScript code. When any user subsequently views or accesses that file, the embedded script executes in their browser, potentially compromising their session or stealing sensitive information. The vulnerability requires administrator-level access to exploit but poses a persistent risk once injected.

• CVE-2026-26145MEDIUM 4.8

  Azure Synapse contains an access control weakness that allows an already-authenticated user to gain elevated privileges through network interaction. An attacker with valid credentials can exploit improper permission enforcement to access capabilities or data they should not be able to reach, provided the victim performs a specific action. The vulnerability requires high effort to exploit and does not enable lateral movement to other systems or direct data modification.

• CVE-2026-27882MEDIUM 4.8

  Coolify, an open-source platform for server and application management, contains a vulnerability in how it validates GitLab webhook requests. The flaw stems from using a standard string comparison method that takes slightly different amounts of time depending on where characters match or differ. An attacker can exploit this timing difference—measuring how long the validation takes—to systematically guess the webhook secret token character by character, similar to picking a lock by listening for clicks. The vulnerability affects versions prior to 4.0.0-beta.461 and is resolved in that beta release.

• CVE-2026-28301MEDIUM 4.8

  CVE-2026-28301 is a URL redirection vulnerability that allows an attacker to craft a malicious link which, when followed by an authorized user, redirects them to an attacker-controlled website. The vulnerability requires an attacker to be on the same network segment as the target and needs a user with some level of system access to click the malicious link, but does not require the victim's interaction with a confirmation dialog. The attack results in confidentiality exposure rather than data modification or system unavailability.

• CVE-2026-34127MEDIUM 4.8

  A stored cross-site scripting (XSS) vulnerability exists in TP-Link's TL-SG108PE v5 managed switch web interface. When an administrator imports a configuration file containing malicious code in the SYSNAM parameter, that code is stored without proper sanitization. The next time an administrator accesses the web management interface, the injected script executes in their browser. This could allow an attacker (who must already have administrator credentials) to steal session cookies, modify switch settings, or extract sensitive information from the management interface.

• CVE-2026-34694MEDIUM 4.8

  Adobe Experience Manager Forms JEE contains a stored cross-site scripting (XSS) vulnerability in form fields that allows a high-privileged attacker to inject malicious JavaScript code. When other users visit a page containing the compromised form field, the malicious script executes in their browser, potentially compromising their session, credentials, or sensitive data. The vulnerability affects versions LTS SP1, 6.5.24.0 and earlier.

• CVE-2026-36460MEDIUM 4.8

  Dovestones Software's ADPhonebook application before version 4.0.1.1 contains a Cross-Site Scripting (XSS) vulnerability in its administrative configuration API. An authenticated administrator can inject malicious JavaScript code into various system configuration sections, which is then stored and executed in the browsers of other users who access those settings. This requires both admin privileges and user interaction (a victim must view the affected configuration), limiting but not eliminating the risk.

• CVE-2026-40210MEDIUM 4.8

  CVE-2026-40210 is a medium-severity vulnerability affecting the SetMacAddrAction function. When this action is invoked, a flaw in memory boundary checking can allow the software to read beyond allocated memory, potentially exposing uninitialized data that may be transmitted over the network or causing the application to crash. The vulnerability requires specific conditions to exploit but does not demand special privileges or user interaction.

• CVE-2026-40641MEDIUM 4.8

  Dell PowerFlex Manager versions before 5.1.0.1 use weak cryptographic algorithms that could allow remote attackers without credentials to access or modify sensitive data. An attacker would need specific conditions to succeed, but the risk centers on information disclosure and tampering rather than system availability.

• CVE-2026-40986MEDIUM 4.8

  Spring Web Flow contains a flaw in how it handles error responses from the JavaScript RemotingHandler. When an error occurs, the framework renders the response body as HTML regardless of the actual content type, which can allow an attacker to inject malicious scripts into the browser. An attacker could craft a request that triggers an error response containing attacker-controlled input (such as a parameter value), and if that input is reflected in the error details without proper sanitization, it executes as JavaScript in the victim's browser. This requires the victim to be logged in and click on a malicious link, making it a moderate-risk vulnerability.

• CVE-2026-40996MEDIUM 4.8

  Spring Web Services incorrectly defaulted to accepting a weaker cryptographic key transport mechanism—RSA PKCS#1 v1.5—during inbound WS-Security message decryption. This override applied only to specific versions and would allow an attacker positioned to intercept and modify encrypted SOAP messages to exploit the known mathematical weaknesses in RSA v1.5 padding. Organizations using affected versions would need to manually reconfigure the security interceptor to reject this algorithm; the safer option was not the default.

• CVE-2026-41697MEDIUM 4.8

  Spring Data Relational, a widely-used Java framework for database access, contains a vulnerability in its Query By Example (QBE) feature. When developers use string matching options like STARTING, ENDING, or CONTAINING, the framework fails to properly escape wildcard characters from user-supplied input. An attacker can exploit this by injecting wildcard characters to perform boolean-based blind SQL inference attacks—essentially asking yes-or-no questions about the underlying database without directly viewing the data. The vulnerability affects multiple versions across 2.4, 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, and 4.0 release lines.

• CVE-2026-41838MEDIUM 4.8

  Spring Framework's WebSocket session management generates predictable IDs instead of using cryptographic randomness. An attacker with valid login credentials could potentially guess or enumerate these session identifiers and, when combined with weak authorization controls, gain unauthorized access to other users' WebSocket sessions to view sensitive data. The vulnerability requires both authentication and specific authorization gaps to exploit, making it a moderate-risk issue requiring immediate attention in security-sensitive deployments.

• CVE-2026-41847MEDIUM 4.8

  Spring WebFlux applications using Kotlin Router DSL are vulnerable to a security bypass that could allow an attacker to circumvent intended access controls. The issue affects Spring Framework versions 5.3.0 through 5.3.48 and requires specific configuration conditions to exploit, making it a moderate-severity concern for teams running these versions in production.

• CVE-2026-44040MEDIUM 4.8

  UltraVNC versions up to 1.8.2.2 use a weak random number generator to create the authentication challenge sent during VNC login. An attacker observing the authentication exchange can predict the challenge by brute-forcing the seed value, which is based only on the system's clock time and process ID—both publicly observable. This enables an attacker to forge authentication or crack the VNC password offline. The vulnerability affects the rfb/vncauth.c code path; Windows binaries may be partially protected by the use of CryptGenRandom on that platform, though the exact code path in shipped binaries is still being verified.

• CVE-2026-44490MEDIUM 4.8

  Axios, a widely-used HTTP client for JavaScript environments, contains two prototype-pollution vulnerabilities that can be exploited when an upstream dependency (such as lodash) has already polluted JavaScript's Object.prototype. An attacker cannot directly trigger these gadgets, but if your application uses a vulnerable dependency alongside axios, malicious code or data flowing through your supply chain could cause axios to either leak polluted properties in HTTP headers or crash on every request with a TypeError. Versions before 0.32.0 (for the 0.x line) and before 1.16.0 (for the 1.x line) are affected.

• CVE-2026-45446MEDIUM 4.8

  OpenSSL's implementations of two advanced encryption modes, AES-SIV and AES-GCM-SIV, contain a flaw in how they verify message authenticity when the encrypted content is empty. An attacker can craft a fraudulent message with attached metadata (AAD) and an empty ciphertext that will pass authentication checks without knowing the encryption key. This is only exploitable in custom applications that implement their own protocols using OpenSSL's EVP interface and skip processing when receiving empty ciphertext.

• CVE-2026-47673MEDIUM 4.8

  Hono, a JavaScript Web application framework, contains a flaw in its JWT authentication middleware that fails to enforce the Bearer scheme requirement. Prior to version 4.12.21, the jwt and jwk middlewares accept any two-part Authorization header value—regardless of whether it uses Bearer, Basic, Token, or any other scheme name—and proceed directly to JWT verification if the token is valid. This means an attacker could authenticate by presenting a valid JWT under an incorrect scheme (like Basic auth) and gain the same access as a properly formatted Bearer token request. The vulnerability is fixed in version 4.12.21.

• CVE-2026-47692MEDIUM 4.8

  Envoy, a widely-used proxy for cloud applications, has a defect in how it generates PROXY Protocol v2 headers when handling larger request metadata. The issue occurs when the headers become too large—exceeding 65,535 bytes—but the proxy still marks them as fitting within that limit. This mismatch can cause leftover data to slip through to the upstream server, potentially leading to request smuggling attacks. The vulnerability affects Envoy versions 1.34.0 and later through specific releases in the 1.35, 1.36, 1.37, and 1.38 branches.

• CVE-2026-47933MEDIUM 4.8

  Adobe ColdFusion versions 2023.19, 2025.8 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious JavaScript into form fields. When other users view pages containing these compromised fields, the attacker's script executes in their browsers. This is a persistence mechanism rather than a one-time attack—the malicious code remains embedded in the application until remediated.

• CVE-2026-48142MEDIUM 4.8

  NGINX Plus and NGINX Open Source contain a flaw in character encoding handling that can be exploited by remote attackers to leak small amounts of memory or cause the web server to crash. The vulnerability requires a specific configuration—using both UTF-8 source encoding and an alternative target charset (like KOI8-R) in the same location block—and attackers need circumstances partially outside their control to trigger it. The impact is limited to confidentiality and availability; no data modification is possible.

• CVE-2026-48783MEDIUM 4.8

  Postiz, an AI-powered social media scheduling platform, contained a security flaw in versions before 2.21.8 where an unauthenticated endpoint failed to validate the purpose of authentication tokens. An attacker could exploit this by using a signed token to trigger subscription-enforcement side effects within their own organization—such as disabling team members, removing integrations, or resetting scheduled posts—without needing to authenticate normally. The vulnerability is self-contained; attackers cannot use it to affect other organizations' accounts. The issue has been patched in version 2.21.8.

• CVE-2026-48823MEDIUM 4.8

  Shaarli, a self-hosted bookmarking application, contains a stored cross-site scripting (XSS) flaw in how it handles user-supplied tags. An authenticated attacker can embed malicious JavaScript into a bookmark's tags field. When other users search by tag on the homepage, the attacker's code executes in their browser. This affects anyone using the tag filtering feature, including administrators. The issue is fixed in version 0.16.2.

• CVE-2026-50009MEDIUM 4.8

  Netty, a widely-used framework for building network applications, contains a flaw in its QUIC protocol implementation that leaks sensitive reset tokens onto the network. These tokens act like cryptographic keys that allow an attacker positioned on the network path to forge denial-of-service packets and disrupt connections. The vulnerability requires the attacker to be on-path and able to observe traffic, but no special privileges or user interaction are needed. This affects Netty versions before 4.2.15.Final.

• CVE-2026-50623MEDIUM 4.8

  Apache CXF contains an authentication bypass flaw in its OAuth2 token introspection endpoint. A missing security check allows unauthenticated attackers to access the /services/oauth2/introspect endpoint if authentication has not been explicitly enabled on that service. While the vulnerability requires a pre-existing misconfiguration, it could expose token metadata or enable further attacks against OAuth2 flows. Patched versions 4.2.2 and 4.1.7 address the underlying code defect.

• CVE-2026-52756MEDIUM 4.8

  Ghidra, the NSA's reverse-engineering framework, contains a path traversal flaw in its IsfServer network component. An unauthenticated attacker can connect to the default listening port and craft specially formatted messages to probe and enumerate files on the system running Ghidra. The vulnerability allows limited information disclosure and potential denial of service, but does not enable code execution or file modification.

• CVE-2026-53624MEDIUM 4.8

  Fiber, a popular Go web framework modeled after Express, has a flaw in its security middleware that prevents HTTPS security headers from being properly configured. When developers set up Strict-Transport-Security (HSTS) protection—a critical safeguard that tells browsers to only connect via encrypted HTTPS—the middleware fails to apply it because it's checking the wrong property in the connection context. This leaves applications vulnerable to protocol downgrade attacks even when administrators believe they've enabled the protection. The issue is resolved in Fiber version 3.4.0.

• CVE-2026-53877MEDIUM 4.8

  Django's GIS (Geographic Information System) module contains a buffer over-read vulnerability when processing binary geographic data. An attacker could craft malicious geographic data that, when parsed by a Django application, either exposes sensitive information from the server's memory or crashes the application. The vulnerability affects Django 6.0 before version 6.0.7 and 5.2 before version 5.2.16, with earlier unsupported versions potentially vulnerable as well.

• CVE-2026-54289MEDIUM 4.8

  Hono, a JavaScript web framework, has a vulnerability affecting AWS Lambda@Edge deployments prior to version 4.12.25. When CloudFront forwards requests to Lambda@Edge, it may send repeated headers (like X-Forwarded-For) as separate entries. The vulnerable Hono adapter incorrectly overwrites each duplicate header value instead of preserving all of them, so only the last value reaches the application. This silent truncation can break security controls that rely on the full header chain and lose audit trail information about request routing.

• CVE-2026-54800MEDIUM 4.8

  CPCI85 Central Processing/Communication and SICORE Base system ship with OPC UA (a widely-used industrial communication protocol) security disabled by default. This means an attacker on the network could interact with these systems without authentication, potentially reading sensitive data or modifying operations. The vulnerability exists in all versions before V26.20 and requires specific network conditions to exploit, but the risk is real in connected industrial environments.

• CVE-2026-54887MEDIUM 4.8

  Erlang/OTP's DTLS server uses a predictable cookie value during startup instead of a random one, allowing attackers to forge valid DTLS cookies within a narrow window (0-15 seconds after server restart). The DTLS cookie is a security mechanism designed to prevent attackers from using spoofed IP addresses to force a server into expensive cryptographic operations. By observing unencrypted ClientHello messages, an attacker can compute the cookie themselves and bypass this protection, enabling amplification attacks with forged source addresses. This affects DTLS deployments in OTP versions 20.0 through 29.0.2 and specific patch releases.

• CVE-2026-55766MEDIUM 4.8

  guzzlehttp/psr7, a widely-used PHP library for handling HTTP messages, fails to properly sanitize certain HTTP protocol fields when processing attacker-controlled input. Specifically, carriage return and line feed (CR/LF) characters are not rejected in the request method, protocol version, and response reason phrase. If an application accepts untrusted data and uses psr7 to serialize messages for network transmission, an attacker could inject additional HTTP headers into the serialized output, potentially bypassing security controls or manipulating message intent. The vulnerability requires deliberate serialization to HTTP/1.x format; simply creating or modifying a PSR-7 object is not exploitable on its own.