By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 34 of 41

• CVE-2026-45479MEDIUM 4.6

  CVE-2026-45479 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an authenticated attacker to inject malicious code into web pages. When a user views the compromised page, the attacker can steal session credentials, redirect users to phishing sites, or perform actions on behalf of the victim. The attack requires both valid SharePoint credentials and user interaction (clicking a malicious link or visiting a crafted page), which moderates its overall risk.

• CVE-2026-45483MEDIUM 4.6

  Microsoft Office Project Server contains a cross-site scripting (XSS) vulnerability that allows an authenticated user to inject malicious code into web pages viewed by others. An attacker would need valid login credentials and would require a victim to interact with a crafted link or page element. The injected code runs in the victim's browser in the context of Project Server, enabling spoofing attacks such as credential theft or unauthorized actions on behalf of the user. This is a moderate-severity issue that primarily affects organizations where Project Server access is restricted to authenticated users.

• CVE-2026-46532MEDIUM 4.6

  A memory reading vulnerability exists in Espressif's ESP-IDF Bluetooth stack, specifically in the AVRCP (Audio/Video Remote Control Profile) vendor command parser. An authenticated attacker with local Bluetooth access could read adjacent memory contents by crafting malformed vendor commands. This could leak sensitive information from the device's memory. The vulnerability affects ESP-IDF versions 5.2.6 through 6.0 across multiple release branches.

• CVE-2026-46609MEDIUM 4.6

  Umbraco CMS versions 14.0.0 through 17.3.x contain a stored cross-site scripting (XSS) vulnerability in a confirmation dialog. Authenticated users can inject malicious HTML into an input field that gets rendered without proper encoding, allowing attackers to execute arbitrary JavaScript in the context of other users' browsers. This requires an attacker to have valid credentials and typically requires user interaction to trigger the payload.

• CVE-2026-46672MEDIUM 4.6

  Actual, a local-first personal finance application, contains a CSV formula-injection vulnerability in its command-line interface (CLI). When users export data to CSV format using the --format csv option, the app's CSV serializer fails to escape special characters that trigger automatic formula evaluation in spreadsheet applications. An attacker with local access could craft malicious transaction data, account names, payee information, or other financial records that, when exported to CSV and opened in Excel, LibreOffice Calc, or Google Sheets, execute arbitrary formulas. This could lead to data exfiltration or further compromise. The vulnerability was patched in version 26.6.0.

• CVE-2026-47637MEDIUM 4.6

  CVE-2026-47637 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an authenticated attacker to inject malicious script into web pages. When a user views a compromised page, the attacker can steal session tokens, redirect users to phishing sites, or perform actions on behalf of the victim. The attack requires an authorized attacker and user interaction (clicking a link or viewing content), limiting its immediate blast radius but still representing a meaningful risk in collaborative environments where SharePoint is heavily used.

• CVE-2026-47638MEDIUM 4.6

  CVE-2026-47638 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an authenticated attacker to inject malicious scripts into web pages. When a user views the compromised page, the attacker's script executes in their browser, enabling spoofing attacks—such as phishing, credential theft, or session hijacking—while appearing to come from a trusted SharePoint instance. The vulnerability requires user interaction and existing authentication, limiting but not eliminating the risk in organizations with many SharePoint users.

• CVE-2026-47640MEDIUM 4.6

  Microsoft Office SharePoint contains a cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject malicious scripts into web pages. When a user with appropriate permissions views a compromised page, the injected script executes in their browser, potentially allowing the attacker to steal session tokens, modify page content, or redirect users to malicious sites. This is a reflected or stored XSS flaw depending on how SharePoint processes and stores the unfiltered input.

• CVE-2026-47641MEDIUM 4.6

  CVE-2026-47641 is a spoofing vulnerability in Microsoft Office SharePoint that allows someone with valid login credentials to impersonate other users or entities through the network. The flaw stems from insufficient validation of user input, meaning malicious insiders or compromised accounts can craft specially formatted requests to bypass identity checks. While this requires an authenticated attacker, the impact—unauthorized identity assumption—is serious enough to warrant prompt attention in environments where SharePoint handles sensitive information or facilitates inter-organizational workflows.

• CVE-2026-4770MEDIUM 4.6

  A DOM-based cross-site scripting (XSS) vulnerability exists in TR7 Cyber Defense Inc.'s Web Application Firewall that allows an authenticated attacker to inject malicious scripts into the application. The vulnerability arises from improper sanitization of user input during web page generation. An attacker with valid credentials can craft a malicious link or payload that, when clicked by another user, executes arbitrary JavaScript in their browser context. This affects WAF versions from 1.0.42.239 up to (but not including) 1.4.0.117.

• CVE-2026-48562MEDIUM 4.6

  CVE-2026-48562 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server that allows an authorized user to inject malicious code into web pages. When other users view the compromised page, the attacker's code executes in their browser, enabling spoofing attacks—impersonation or manipulation of content that appears to come from legitimate sources. This requires an attacker already have valid SharePoint credentials and the victim must interact with the malicious content, but once those conditions are met, the attack is straightforward to execute.

• CVE-2026-49316MEDIUM 4.6

  A vulnerability in the 2025 Indian Motorcycle Scout Bobber + Tech model allows someone with access to the motorcycle's wireless network to disable anti-theft protections and operate the vehicle without proper authorization. An attacker can manipulate error messages on the motorcycle's internal communication system (CAN bus) to silence the Wireless Control Module, which normally enforces shutdown commands tied to the immobilizer. Once this module stops communicating, other systems on the motorcycle treat its silence as normal rather than a security event, leaving the bike vulnerable to theft despite the immobilizer lock never being engaged.

• CVE-2026-49324MEDIUM 4.6

  A vulnerability in the Wireless Control Module of the 2025 Indian Motorcycle Scout Bobber + Tech allows someone with access to the bike's internal network to permanently disable it. By sending a small number of specially crafted wireless messages, an attacker can trigger a lockout on the motorcycle's immobilizer system—the security mechanism that prevents unauthorized starting. Unlike typical lockouts that reset when you power cycle the device, this one persists even after restarting the bike, leaving owners unable to start their motorcycle until they visit a dealer for service.

• CVE-2026-49325MEDIUM 4.6

  Indian Motorcycle's 2025 Scout Bobber + Tech model contains a physical security flaw in its anti-theft system. An attacker with access to the motorcycle's Wireless Control Module (WCM) wiring harness can disconnect a specific wire pair to bypass the PIN-protected shutdown mechanism, leaving the bike fully operational and vulnerable to theft. The vulnerability exploits a gap in how the motorcycle's engine control unit (ECU) validates shutdown signals—it cannot tell the difference between a legitimate shutdown command and a severed wire.

• CVE-2026-50099MEDIUM 4.6

  Naxclow device firmware exposes sensitive WiFi credentials and encryption keys through an unprotected hardware debugging interface. When devices connect to a network, they broadcast the WiFi password and security keys in plaintext via a labeled UART serial port that runs a command shell. An attacker who can physically access the device for a few minutes—realistic for outdoor-mounted hardware—can extract these credentials and potentially compromise the device's firmware. This is a physical-access vulnerability, but the exposed credentials create downstream network risks.

• CVE-2026-56269MEDIUM 4.6

  Flowise, a popular open-source workflow automation platform, contains a hardcoded encryption secret in versions 3.0.13 and earlier. When administrators don't explicitly configure the TOKEN_HASH_SECRET environment variable, the application defaults to a publicly known weak value ('Secre$t'). This secret is used to encrypt sensitive metadata (user IDs and workspace IDs) embedded within authentication tokens. An attacker who discovers or deploys Flowise with this default secret can decrypt the metadata to learn internal identifiers and potentially manipulate them. While this alone doesn't bypass authentication, it could facilitate privilege escalation or lateral movement by revealing system structure and enabling token forgery attempts.

• CVE-2026-61456MEDIUM 4.6

  The Grav API plugin before version 1.0.3 contains a stored cross-site scripting (XSS) vulnerability in its media upload handler. An authenticated user with API media write permissions can upload an SVG file containing malicious JavaScript. Because the plugin fails to sanitize SVG content and serves the file with an image MIME type, opening the file in a browser causes the embedded script to execute in the administrator's session context. This allows attackers to steal session cookies or hijack admin sessions without requiring any additional user interaction beyond the attacker uploading the payload.

• CVE-2026-6683MEDIUM 4.6

  FatFs R0.16 and earlier has a divide-by-zero defect in its exFAT sync code. When specially crafted filesystem metadata is processed during write or sync operations, internal calculations can attempt division by zero, crashing the file system handler. The vulnerability requires physical access or locally authenticated access in most scenarios, though network-delivered firmware or storage updates could theoretically enable remote exploitation in certain deployment contexts. The impact is denial of service—legitimate I/O operations will fail until the system is restarted or the corrupted metadata is removed.

• CVE-2026-6684MEDIUM 4.6

  FatFs, a widely-used embedded filesystem library, contains a denial-of-service vulnerability in versions before R0.16 when GPT (GUID Partition Table) scanning is enabled with 64-bit LBA support. An attacker with physical access to a storage device can craft a malicious GPT header with an extremely large or unbounded partition count value, causing any system mounting that device to enter an effectively infinite loop during initialization. This results in a hung or unresponsive device at mount time, disrupting availability without requiring authentication or user interaction.

• CVE-2026-6686MEDIUM 4.6

  FatFs R0.16 and earlier has a flaw where the f_lseek() function can expose uninitialized data when it extends a file beyond its current end without properly clearing the newly allocated disk clusters. An attacker with physical access to a system could read sensitive information from unallocated or previously used disk space by crafting a file system that triggers this behavior.

• CVE-2026-9799MEDIUM 4.6

  A vulnerability in Keycloak's User-Managed Access (UMA) system allows an authenticated user to bypass access controls by crafting a specific permission request. If a user has legitimate access to one resource via UMA, they can potentially manipulate their request to gain unauthorized access to all similar resources in the same resource server—even ones they should not have permission to access. This only happens in Keycloak instances configured with permissive policy enforcement mode on typed resources with owner-managed access enabled. The impact is limited to information disclosure or unauthorized modification, not system availability.

• CVE-2026-0410MEDIUM 4.5

  CVE-2026-0410 is a privilege-escalation vulnerability affecting Netgear routers. An authenticated administrator already connected to the local network can exploit improper input validation to gain elevated access and modify router firmware and settings without authorization. The vulnerability requires the attacker to already have valid admin credentials and local network access, which limits the practical threat surface but poses significant risk in environments where router access controls are not tightly managed.

• CVE-2026-0412MEDIUM 4.5

  A vulnerability in NETGEAR JR6150 routers allows someone with administrative access on the local network to modify the router's software and settings without proper authorization. The issue stems from inadequate validation of user input. This router model is quite old—released in 2014 and no longer supported by NETGEAR as of 2018—meaning no security patches will be issued. The vulnerability was discovered through controlled testing of the device's firmware in a lab environment, not on actual deployed hardware.

• CVE-2026-0413MEDIUM 4.5

  A buffer overflow flaw in NETGEAR Orbi mesh router firmware allows authenticated administrators on the local network to modify router software and functionality without authorization. The vulnerability stems from insufficient input validation, meaning an admin account could inject malicious data that overwrites system memory. While exploitation requires valid administrative credentials and local network access, the ability to alter router firmware represents a serious integrity compromise.

• CVE-2026-0414MEDIUM 4.5

  NETGEAR has a vulnerability in certain router models that allows authenticated administrators on the local network to bypass input validation controls and modify the router's software and core functionality without proper authorization checks. While the attacker must already have administrative credentials and be connected locally, the lack of proper validation on modification requests means an insider threat or compromised admin account could alter router behavior in ways the organization doesn't intend or expect.

• CVE-2026-0415MEDIUM 4.5

  A validation flaw in NETGEAR Orbi and Nighthawk mesh router firmware allows authenticated administrators on the local network to modify router software and settings without proper authorization checks. While the attacker must already have admin credentials and network access, the insufficient input validation creates a pathway to alter router functionality in unintended ways. This is a medium-severity issue affecting a broad range of NETGEAR mesh and satellite models.

• CVE-2026-0416MEDIUM 4.5

  NETGEAR has identified a vulnerability affecting their RAX Wi-Fi 6 router models (RAXE450 and RAXE500) in which an authenticated administrator on the local network can send specially crafted input through the management interface to bypass built-in security controls. This could allow the attacker to modify the router's protected software or core functionality without authorization. The flaw requires an admin account and physical/local network proximity, which constrains the attack surface but remains a concern in environments where multiple administrators manage network devices.

• CVE-2026-0417MEDIUM 4.5

  NETGEAR has patched an input validation flaw affecting 21 router models. An authenticated administrator on the local network can send specially crafted requests to bypass validation checks and tamper with the router's core configuration or operation. The vulnerability requires administrator-level access and direct network connectivity, which limits the threat to insider risk or compromised admin accounts on the same network segment. The impact is integrity-focused—data confidentiality and system availability are not affected.

• CVE-2026-0418MEDIUM 4.5

  CVE-2026-0418 is a configuration management weakness in Netgear networking devices that allows administrators already logged into the local network to make unauthorized changes to system settings. The vulnerability requires authentication and local network access, limiting its reach to internal threats or compromised admin accounts. Netgear has published this issue affecting routers, mesh systems, and cellular gateways across multiple product lines.

• CVE-2026-10814MEDIUM 4.5

  Milvus, a popular vector database, contains a weakness in how it generates hash identifiers for grantee access control. An attacker with local access and sufficient privileges could exploit weak cryptographic hashing in the Grantee ID Hash Handler to potentially forge or predict access control identifiers, leading to unauthorized data access or modification. The vulnerability requires high technical complexity to exploit and is rated as medium severity.

• CVE-2026-11623MEDIUM 4.5

  A use-after-free memory vulnerability exists in tmux versions up to 3.6a, specifically within the image handling code. An attacker with local system access could trigger this flaw through a complex exploitation chain to read, modify, or crash tmux processes. While a public exploit has been disclosed, the attack requires both local access and deliberate manipulation, making opportunistic exploitation unlikely. The issue is resolved by upgrading to version 3.7-rc or applying the specific patch commit fc6d94a9f8a593bd8b7031650802084385d4ee03.

• CVE-2026-13502MEDIUM 4.5

  A timing vulnerability has been discovered in ANTLR4's Maven plugin (versions up to 4.13.2) that could allow a local attacker to manipulate file operations during the deserialization process. The flaw exploits a race condition between checking and using files, potentially leading to unauthorized access to sensitive data or modification of build artifacts. Exploitation requires local system access, elevated privileges, and significant technical skill, making it a targeted rather than widespread risk.

• CVE-2026-44640MEDIUM 4.5

  NanoMQ is an edge messaging platform that implements the MQTT protocol for lightweight IoT and edge device communication. A type confusion bug exists in versions before 0.24.14 in how the broker handles QUIC connection objects during the dialing and closing lifecycle. When the broker initiates a QUIC connection (dialing), it stores a pointer as one type (nni_quic_conn), but later during cleanup, the code misinterprets that same pointer as a different type (ex_quic_conn). This mismatch causes the broker to read and operate on invalid memory, resulting in hangs or crashes when closing connections. The issue requires local access and user interaction to trigger.

• CVE-2026-49382MEDIUM 4.5

  A vulnerability in JetBrains IntelliJ IDEA's Copyright plugin allows an attacker to execute code on a developer's machine through template injection. The attack requires local access and user interaction—specifically, a developer must open a malicious project or file. While the severity is moderate, this poses a real risk in shared development environments or when developers download untrusted projects.

• CVE-2026-55798MEDIUM 4.5

  Pillow, a widely-used Python image processing library, contains a command injection vulnerability in its Windows image viewer functionality. When Pillow opens an image file on Windows, it constructs a system command to display the image, but fails to properly escape the file path before passing it to the shell. An attacker can craft a malicious image file with shell metacharacters in its name—such as ampersands or pipes—to inject and execute arbitrary Windows commands with the privileges of the user running the Python application. The vulnerability requires user interaction (opening a file) and is fixed in version 12.3.0 and later.

• CVE-2026-8650MEDIUM 4.5

  Progress MOVEit Transfer contains a relative path traversal vulnerability in its Admin Settings module that allows an authenticated administrator to read sensitive files on the server. The flaw exists in versions before 2025.0.7 and 2025.1.x versions before 2025.1.3. While it requires high-privilege access and provides read-only exposure, the ability to traverse the file system and access confidential data presents a meaningful risk to organizations relying on MOVEit for secure file transfer operations.

• CVE-2026-9210MEDIUM 4.5

  A NETGEAR router firmware vulnerability allows authenticated administrators on the local network to bypass input validation controls and make unauthorized changes to router software and settings. An attacker with admin credentials and direct network access can modify core router functionality without proper authorization checks. This is a localized threat that requires existing administrative access to exploit, limiting its blast radius but still representing a significant risk to network integrity if admin credentials are compromised.

• CVE-2025-13162MEDIUM 4.4

  CVE-2025-13162 is a search path vulnerability affecting ABB's industrial automation software—specifically Control Builder A and the 800xA system for Advant Master. An authenticated local user with limited privileges can manipulate the application's search path to cause unintended file or library loading, potentially leading to unauthorized modifications or unexpected behavior. The vulnerability requires user interaction and a somewhat difficult exploitation path, making it moderately concerning rather than critical. It does not currently appear on CISA's KEV catalog.

• CVE-2025-62851MEDIUM 4.4

  CVE-2025-62851 is a path traversal vulnerability affecting QNAP License Center that allows a local administrator to read files and system data they should not have access to. An attacker who already has administrative credentials can use this flaw to navigate the file system and extract sensitive information. The vulnerability has a CVSS score of 4.4 (Medium severity) and is addressed in License Center version 1.9.56 and later.

• CVE-2026-0268MEDIUM 4.4

  A vulnerability in Palo Alto Networks' Prisma Access Agent for Linux allows a local user on an affected system to bypass security controls and route network traffic outside the intended VPN tunnel. This is a local attack that requires an authenticated user account and does not affect Windows, macOS, iOS, Android, or ChromeOS deployments. An attacker exploiting this could potentially access resources or send data outside the VPN tunnel without proper security monitoring.

• CVE-2026-10100MEDIUM 4.4

  The Simple Custom Login Page plugin for WordPress contains a security flaw that allows administrators to inadvertently inject malicious code into the login page viewed by all users. When a site admin configures colors for the login page through the plugin's settings, an attacker with admin access can craft CSS injection payloads in those color fields. Because the plugin doesn't properly validate these inputs before displaying them, an attacker can break out of the intended styling context and insert arbitrary CSS rules. This enables phishing attacks—for example, by hiding the real login form or overlaying a fake one to steal credentials.

• CVE-2026-10104MEDIUM 4.4

  The Product Video Gallery for WordPress plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated shop managers and higher-privilege users to inject malicious scripts into gallery pages. When other users visit these compromised pages, the injected scripts execute in their browsers. This vulnerability affects all versions up to and including 1.5.1.8 and results from the plugin's failure to properly sanitize and escape user input in the custom_thumbnail parameter.

• CVE-2026-11356MEDIUM 4.4

  The Ivory Search WordPress plugin contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 5.5.15. An administrator with the highest access level can inject malicious code into two plugin settings—menu_title and menu_magnifier_color—that will then execute in the browsers of any user who visits an affected page. This is a persistence risk: the malicious script lives in the database and runs every time someone views the compromised page.

• CVE-2026-11358MEDIUM 4.4

  The Orbit Fox WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in its admin settings panel. An authenticated administrator can inject malicious JavaScript that persists in the database and executes for any user viewing affected pages. The vulnerability exists only in multi-site WordPress installations or single-site setups where the unfiltered_html capability has been disabled—a common hardening practice. Versions up to and including 3.0.6 are affected.

• CVE-2026-11411MEDIUM 4.4

  A path traversal vulnerability exists in the iAI Lab PDF AI App version 4.21.0 for Android. The flaw is located in the chatpdf.pro component's getExternalCacheDir function, where improper handling of the _display_name parameter allows an attacker with local device access to manipulate file paths. This could enable unauthorized file access or modification on the affected device. Public exploit code is available, increasing the practical risk of exploitation.

• CVE-2026-12041MEDIUM 4.4

  The Chatra Live Chat plugin for WordPress contains a security flaw that allows administrators to inadvertently inject malicious scripts into the site through the plugin's settings panel. When an administrator (or anyone with equivalent permissions) saves settings in the plugin, those settings are not properly validated or cleaned, meaning an attacker with admin access could craft a malicious payload that runs in visitors' browsers. This risk is limited to WordPress multisite networks or sites where the 'unfiltered_html' capability has been restricted—standard single-site WordPress installations with unfiltered_html enabled are not affected.

• CVE-2026-12108MEDIUM 4.4

  The Highlighting Code Block plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 2.2.0. An authenticated administrator can inject malicious scripts through the plugin's settings that will execute for any user viewing affected pages. This vulnerability only manifests in WordPress multisite installations or where the unfiltered_html capability has been restricted, which are common hardening configurations.

• CVE-2026-12114MEDIUM 4.4

  A vulnerability in the Team Members – Multi Language Supported Team Plugin for WordPress allows authenticated administrators to inject malicious scripts into plugin settings. When other users visit pages containing these injected scripts, the malicious code executes in their browsers. This is a stored attack—the payload persists in the plugin's configuration. The vulnerability only manifests on WordPress multisite installations or where the unfiltered_html capability has been intentionally restricted, which are less common configurations. An attacker would need full administrator privileges to exploit it.

• CVE-2026-12164MEDIUM 4.4

  Fortra File Integrity Monitoring (FIM), the integrity monitoring solution formerly known as Tripwire Enterprise, contains a permission assignment flaw in its user import functionality. When administrators use the tetool import command to add users while FIM is actively running—especially if the import simultaneously creates or modifies roles and their associated permissions—the system may grant those imported users incorrect or overly permissive access rights. This means a user intended to have limited monitoring privileges could end up with elevated capabilities, creating an unintended privilege escalation within the FIM system itself.

• CVE-2026-12399MEDIUM 4.4

  The Gutenverse WordPress plugin—a page builder and site editor tool—contains a stored cross-site scripting (XSS) vulnerability in its admin settings. An editor or administrator with site access could inject malicious code that persists in the WordPress database. When other users visit affected pages, that injected code executes in their browsers. The vulnerability only manifests in WordPress multisite networks or installations where the unfiltered_html capability has been disabled, making it a targeted but real risk for certain WordPress configurations.

• CVE-2026-12430MEDIUM 4.4

  Blocksy Companion, a popular WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 2.1.45. Authenticated users with editor-level permissions or higher can inject malicious scripts into the plugin's admin settings that will execute for anyone viewing the affected pages. This vulnerability only manifests in WordPress multisite installations or single-site setups where the unfiltered_html capability has been disabled—a common hardening practice. The threat is limited to authenticated attackers but can lead to session hijacking, credential theft, or site defacement.

• CVE-2026-12560MEDIUM 4.4

  The Editorial Rating plugin for WordPress contains a cross-site scripting (XSS) vulnerability that allows administrators to inject malicious scripts through the 'Link URL' field. These scripts execute when anyone visits the affected page, potentially compromising site visitors. The vulnerability affects all plugin versions up to 4.0.5 and requires admin-level access to exploit, limiting its immediate blast radius but presenting a significant insider threat risk.

• CVE-2026-12892MEDIUM 4.4

  GStreamer, a popular multimedia framework used in many Linux applications and media players, contains a parsing flaw in its H.264 video handling. When a specially crafted video file with malformed extension data is opened, the parser can read one byte of memory it shouldn't have access to, potentially crashing the application or exposing a small amount of sensitive heap data. The vulnerability requires user interaction—someone must deliberately open a malicious video file—which limits its attack surface.

• CVE-2026-13316MEDIUM 4.4

  CVE-2026-13316 is a Server-Side Request Forgery (SSRF) vulnerability in Foreman and Red Hat Satellite that allows authenticated users with high privileges to manipulate HTTP proxy parameters. By doing so, an attacker can trick the application into making unauthorized requests to cloud metadata services—such as those available on AWS, GCP, or Azure—potentially exposing sensitive credentials and configuration data. The vulnerability requires high-privilege access and local interaction, limiting its immediate risk but posing a significant concern in environments where infrastructure metadata is valuable.

• CVE-2026-13728MEDIUM 4.4

  WatchGuard Fireware OS running on FireCluster deployments may use a hard-coded encryption key under certain rare conditions to encrypt saved credentials for Access Portal resources. If exploited, an attacker with high-level administrative privileges could potentially decrypt and recover those stored credentials. The vulnerability does not affect standalone Fireboxes or devices without Access Portal capability.

• CVE-2026-14969MEDIUM 4.4

  A security issue has been discovered in 389 Directory Server (Red Hat's LDAP directory solution) where sensitive data stored in the database is encrypted using a method that doesn't change the encryption key's starting point between different entries. This means an attacker who can access the filesystem and has administrative privileges could potentially figure out when two encrypted database entries contain the same plaintext information by looking at the encrypted data patterns—a weakness that undermines the confidentiality protection encryption is meant to provide.

• CVE-2026-15283MEDIUM 4.4

  WPvivid Backup for MainWP, a WordPress plugin used for backup management in multi-site setups, contains a stored cross-site scripting (XSS) flaw in its admin settings panel. An authenticated administrator can inject malicious scripts that persist in the database and execute in the browsers of other users who access the affected pages. The vulnerability is limited to WordPress multi-site installations or sites where the 'unfiltered_html' capability has been explicitly disabled—standard single-site WordPress installations with default settings are not at risk.

• CVE-2026-21901MEDIUM 4.4

  A flaw in Juniper Networks Junos OS and Junos OS Evolved allows a local administrator or privileged user to crash the management daemon by configuring or deactivating a specific SSH parameter. The vulnerability stems from improper handling of configuration data, where the system attempts to access memory that hasn't been allocated. Repeating the misconfiguration causes the daemon to restart repeatedly, disrupting management access. Only users with high-level administrative privileges can trigger this issue, and patched versions are available from Juniper.

• CVE-2026-2500MEDIUM 4.4

  The Quick Playground plugin for WordPress has a path traversal flaw that allows WordPress administrators to read sensitive files from the server. An authenticated admin could retrieve files like wp-config.php or /etc/passwd without proper authorization. The vulnerability only affects sites synchronized with WordPress Playground or running on playground.wordpress.net, which significantly constrains real-world exposure. All versions up to and including 1.3.4 are affected.

• CVE-2026-3620MEDIUM 4.4

  The Word Replacer plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 0.4. An attacker with administrator-level access can inject malicious scripts through the plugin's 'replacement' parameter. These scripts persist in the WordPress database and execute whenever any user visits an affected page, potentially allowing credential theft, session hijacking, or defacement. The vulnerability stems from inadequate input validation and output encoding in the plugin code.

• CVE-2026-38973MEDIUM 4.4

  mrubyc, a lightweight Ruby virtual machine implementation, contains a flaw that allows the software to read memory beyond allocated boundaries when looking up missing methods. An attacker with local access could trigger this vulnerability through user interaction, potentially exposing sensitive data in memory or causing the application to crash. The vulnerability affects mrubyc through version 3.4.1.

• CVE-2026-41701MEDIUM 4.4

  Spring AMQP's RabbitTemplate.sendAndReceive() method uses predictable correlation IDs when configured with a fixed reply queue. An attacker with elevated privileges and network access could potentially intercept or manipulate message correlations because the IDs follow a simple counter pattern rather than being cryptographically random. This affects multiple versions across four release branches of Spring AMQP.

• CVE-2026-41978MEDIUM 4.4

  A permission control vulnerability exists in a clone module that could allow an unauthorized user to access sensitive information. The issue arises from improper permission checks when cloning resources, potentially exposing confidential data. While the vulnerability requires local access and user interaction to exploit, it carries a medium risk profile and warrants timely remediation to protect data confidentiality.

• CVE-2026-44268MEDIUM 4.4

  Dell PowerProtect Data Domain contains a permissions vulnerability that could allow a high-privileged local attacker to read sensitive data. The issue stems from incorrect file or resource permission assignment in affected versions. An attacker with existing administrative or root access could escalate their capabilities to access confidential information they shouldn't be able to reach. This is not a remote vulnerability—it requires someone already on the system with elevated privileges.

• CVE-2026-44269MEDIUM 4.4

  Dell PowerProtect Data Domain contains a symlink-following vulnerability that allows an attacker with high-level local system access to read sensitive files they shouldn't be able to access. The flaw exists in versions 7.7.1.0 through 8.6, affecting multiple support branches (LTS2026, LTS2025, and LTS2024). While the attacker must already have elevated privileges on the system, the vulnerability could lead to unauthorized disclosure of confidential data stored on the backup appliance.

• CVE-2026-45279MEDIUM 4.4

  Nextcloud Server contains a path traversal vulnerability that allows non-admin users to copy files into their own Nextcloud directories in certain scenarios. The vulnerability exists in specific versions and depends on underlying Unix file system permissions. An attacker would need already-elevated user privileges within Nextcloud to exploit this issue, limiting the practical threat surface.

• CVE-2026-45702MEDIUM 4.4

  OP-TEE, a security-focused component running on Arm processors, contains a type confusion flaw when handling memory-sharing requests from the normal operating system. The vulnerability only affects specific OP-TEE configurations used to manage secure applications (when both SPMC mode and secure partition features are enabled). An attacker with high system privileges can trigger a denial of service, though the flaw does not expose sensitive data or allow code execution. Upgrading to OP-TEE version 4.11.0 or later resolves the issue.

• CVE-2026-46388MEDIUM 4.4

  osquery, a widely-used operating system monitoring framework, has a file permission flaw that allows unprivileged users to read sensitive data during file carve operations. When osquery extracts files (a feature called 'carving'), it creates temporary directories with overly permissive access controls. An attacker with local access can watch these temporary locations and read files being extracted before they're cleaned up—potentially including system files the attacker shouldn't be able to access. This is a local privilege escalation risk that requires an attacker to already have some level of system access and user interaction to exploit.

• CVE-2026-46468MEDIUM 4.4

  Dell PowerProtect Data Domain contains a vulnerability where the system doesn't properly check symbolic links before accessing files. An attacker with high-level local system access could exploit this to read sensitive information they shouldn't normally access. While the attack requires significant privileges and local access, the potential exposure of confidential data makes this a meaningful security concern for organizations relying on Data Domain for backup and archival operations.

• CVE-2026-47190MEDIUM 4.4

  IPAM (IP Address Manager) for Cluster API Provider Metal3 granted its controller pod excessive permissions to read, modify, and delete Kubernetes Secrets—a capability it never uses during normal operation. If an attacker compromised the controller pod through a supply chain attack or container escape, they could exploit these overly broad permissions to steal sensitive credentials and other secret data stored in the cluster. This permission misconfiguration has been corrected in patched versions.

• CVE-2026-47733MEDIUM 4.4

  Rocket.Chat versions before 8.5.0 contain a flaw in how the ImageElement component processes user-supplied image URLs in markdown content. When rendering image links, the component fails to filter dangerous protocol prefixes like javascript: and data:, allowing an authenticated attacker to craft a malicious markdown image that executes arbitrary JavaScript when clicked by another user. The vulnerability requires user interaction (clicking the link) and works primarily on older browsers, but poses a real risk in environments where users share untrusted markdown content or where attackers have internal access.

• CVE-2026-47778MEDIUM 4.4

  Envoy proxy versions before 1.35.11, 1.36.7, 1.37.3, and 1.38.1 contain a certificate validation bypass vulnerability. An attacker can craft a certificate with a malicious DNS Subject Alternative Name (SAN) containing a hidden NUL byte character. Due to improper string handling in the validation logic, Envoy truncates the certificate's SAN at the NUL byte and compares only the truncated portion against expected values, allowing an invalid certificate to pass validation. This could enable a sophisticated attacker with certificate-issuance capability to impersonate legitimate upstream services in Envoy-routed environments.

• CVE-2026-49088MEDIUM 4.4

  Kibana's optional application performance monitoring (APM) feature can inadvertently record sensitive HTTP request headers in application logs. If an operator with log file access gains visibility into these logs, they may be exposed to sensitive information such as authentication tokens or API keys that were passed in request headers. This is a logging misconfiguration issue rather than a direct attack vector—the vulnerability requires both APM instrumentation to be enabled and an insider or log-access breach to be exploited.

• CVE-2026-5051MEDIUM 4.4

  HashiCorp Vault and Vault Enterprise versions prior to 2.0.1 contain a flaw in how they validate audit device configurations when using the legacy file audit path feature. The vulnerability stems from inconsistent application of plugin directory protections, which could allow a high-privileged attacker to read sensitive information from the system. This is not an active exploitation target in the wild, but requires administrative-level access to trigger.

• CVE-2026-52757MEDIUM 4.4

  Ghidra, the National Security Agency's widely-used reverse-engineering and binary analysis platform, contains a memory safety bug in its decompiler. When a specially crafted binary file is opened in Ghidra's decompiler view, the application can access memory that has already been freed, potentially corrupting data or crashing the program. An attacker would need to distribute a malicious binary and convince a user to analyze it in Ghidra—the vulnerability itself does not allow remote code execution or network-based attacks.

• CVE-2026-54325MEDIUM 4.4

  Pi is a lightweight terminal-based coding environment that, prior to version 0.79.0, automatically loaded configuration files and extensions from a `.pi` directory in any repository without asking the user for permission first. An attacker could place malicious executable code (disguised as project-local extensions written in TypeScript or JavaScript) in a repository's `.pi` directory. When a user ran Pi in that directory, the malicious code would execute with the same privileges as the Pi process itself—essentially running whatever the attacker wanted on the user's machine. The fix in version 0.79.0 addresses this by requiring explicit user trust before loading project-local resources.

• CVE-2026-54776MEDIUM 4.4

  CoreWCF is a .NET Core implementation of Windows Communication Foundation that allows applications to build service-oriented systems. A security weakness exists in how CoreWCF handles client authentication when services use Unix Domain Sockets with PosixIdentity credentials. Specifically, the vulnerability allows an attacker with local system access to bypass the authentication process by connecting without completing the required security handshake, potentially gaining unauthorized access to service functionality. This affects CoreWCF versions before 1.8.1 and 1.9.1.

• CVE-2026-56788MEDIUM 4.4

  RTKLIB, an open-source GNSS/GPS processing toolkit, contains a flaw that crashes the application when it encounters RINEX observation files with unrecognized code types. An attacker can craft malicious RINEX files that trigger the crash and potentially expose sensitive data from the application's memory. The vulnerability affects versions through 2.4.3 and requires user interaction—someone must open or process the malicious file—but no special privileges are needed.

• CVE-2026-57966MEDIUM 4.4

  A path traversal flaw in spice-vdagent allows a malicious or compromised SPICE host to write arbitrary files anywhere on a guest system. When a SPICE host initiates a file transfer, the agent doesn't validate the filename, enabling an attacker to place files in sensitive directories with the privileges of the logged-in user. This is a real but constrained risk: it requires either control of or a compromise of the SPICE host itself, not just network access.

• CVE-2026-59831MEDIUM 4.4

  GitHub CLI (gh) versions 2.10.0 through 2.95.0 contain a vulnerability in the `gh codespace jupyter` command that can lead to arbitrary command execution. When opening a Jupyter notebook in a Codespace, the tool fails to validate that the JupyterLab URL is legitimate, allowing an attacker controlling a malicious Codespace to craft a specially formatted vscode:// or vscode-insiders:// URL. This URL is then passed to VS Code without validation, potentially leading to command execution on the user's local machine. The vulnerability requires an authenticated user to connect to a malicious Codespace, making it a supply-chain or social engineering risk for development teams.

• CVE-2026-7421MEDIUM 4.4

  A WordPress plugin called Passeum Ticketing contains a vulnerability that allows site administrators to inadvertently (or maliciously in compromised accounts) inject malicious scripts into a website. The plugin fails to properly validate the shop name setting, allowing an attacker with admin access to point the site to a malicious domain. When this happens, the plugin loads JavaScript and CSS files from that attacker-controlled domain, which then executes on every page of the website for all visitors. This is a stored cross-site scripting (XSS) vulnerability specific to multisite WordPress installations.

• CVE-2026-7430MEDIUM 4.4

  The Post Snippets plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting all versions up to 4.0.19. An authenticated administrator can inject malicious code through the plugin's import feature. When that code is imported, it gets embedded unsafely into the post editor's JavaScript, allowing the attacker to execute arbitrary scripts that run whenever any administrator opens a post editor page. This is a privilege-escalation and persistence risk: an attacker with admin access can compromise the experience of other admins and potentially maintain control across sessions.

• CVE-2026-8330MEDIUM 4.4

  GitLab has patched a vulnerability in both Community Edition (CE) and Enterprise Edition (EE) that could leak sensitive information into application logs. The issue affects a CI/CD API endpoint and requires high privileges to trigger—an authenticated admin or user with elevated permissions must perform a specific action. While the exposure is localized to logs (not remote network access), the leaked data could include credentials, tokens, or other secrets that would normally be protected. Administrators should update to the patched versions as part of normal security maintenance.

• CVE-2026-8853MEDIUM 4.4

  MW WP Form, a WordPress plugin used for form management, contains a stored cross-site scripting (XSS) flaw in how it handles memo field data. An attacker with editor-level WordPress access or higher can inject malicious scripts into memo fields that will execute in the browsers of anyone viewing affected pages. The vulnerability exists because the plugin stores memo data directly without properly cleaning or escaping it, and uses a database storage method that bypasses WordPress's built-in security filters.

• CVE-2026-8991MEDIUM 4.4

  A WordPress plugin called 'Drag and Drop Multiple File Upload for Contact Form 7' contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.3.9.7. An attacker with administrator access can inject malicious scripts into the plugin's settings, which will then execute in the browsers of any user who views the affected pages. This is a privilege-escalation risk that exploits insufficient input validation on two specific settings fields.

• CVE-2026-9594MEDIUM 4.4

  The WP Maps plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 4.9.4. An attacker with administrator access or a custom role granted the wpgmp_manage_location capability can inject malicious scripts into location messages. These scripts execute whenever site visitors access pages containing the injected content, potentially compromising user sessions, stealing credentials, or redirecting visitors to malicious sites. The vulnerability requires authenticated access and administrative privileges, limiting its immediate risk but making it a concern for organizations with admin account security gaps or custom role configurations.

• CVE-2026-9651MEDIUM 4.4

  CVE-2026-9651 is a file permission vulnerability affecting Schneider Electric industrial control system products. An attacker with administrative or privileged local access to an affected device can read system files that contain password hashes, potentially enabling account compromise. The vulnerability requires high-level local privileges to exploit and does not allow remote access or denial of service, which limits its immediate risk profile but remains concerning for insiders or those who have already gained local foothold on vulnerable systems.

• CVE-2016-20067MEDIUM 4.3

  WordPress CP Polls version 1.0.8 contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick administrators into performing unintended actions on their WordPress sites. An attacker can create a malicious webpage that, when visited by a logged-in site administrator, silently executes poll-related operations without the administrator's knowledge or consent. This works because the plugin fails to validate that requests originate from legitimate sources.

• CVE-2016-20074MEDIUM 4.3

  The Lazy Content Slider WordPress plugin version 3.4 is vulnerable to cross-site request forgery (CSRF), a type of attack where an attacker tricks an authenticated site administrator into unknowingly changing the plugin's settings. An attacker would craft a malicious web page that, when visited by a logged-in WordPress admin, silently submits configuration changes to the plugin—such as altering color schemes or display counts—without the administrator's knowledge or consent. This vulnerability requires the attacker to socially engineer an admin into visiting a malicious page, but the actual attack happens without additional user interaction once the admin is tricked.

• CVE-2019-25717MEDIUM 4.3

  Dräger's Infinity Delta, Delta XL, and Kappa patient monitors expose sensitive log files to unauthenticated attackers on the local network. An attacker with network access can retrieve device internals, location data, and network configuration without needing credentials. This is a network-adjacent threat that discloses operational details but does not enable direct device compromise or manipulation.

• CVE-2022-47150MEDIUM 4.3

  A cross-site request forgery (CSRF) vulnerability exists in weDevs' WooCommerce Conversion Tracking plugin through version 2.0.10. This flaw allows attackers to trick site administrators into performing unintended actions—such as modifying tracking settings or disabling conversion monitoring—by crafting malicious web pages or emails. The attack requires user interaction but does not require authentication, making it a moderate-severity issue for e-commerce sites relying on this plugin.

• CVE-2023-32959MEDIUM 4.3

  CVE-2023-32959 is a missing authorization flaw in Sparkle WP MetroStore, a WordPress plugin, affecting versions up to 1.3.2. An authenticated attacker with basic user privileges can modify data or content they should not have access to because the plugin fails to properly enforce access control checks. The vulnerability requires login credentials but does not require user interaction from a victim, making it a practical concern in multi-user WordPress environments.

• CVE-2024-24709MEDIUM 4.3

  Shareaholic versions up to 9.7.11 contain a missing authorization flaw that allows authenticated users to modify data they shouldn't have access to. Because the plugin fails to properly enforce access control checks on certain functions, a logged-in user with minimal permissions could exploit misconfigured security levels to alter content or settings beyond their intended scope. This is a privilege-escalation scenario where authorization logic is absent rather than broken.

• CVE-2024-31435MEDIUM 4.3

  CVE-2024-31435 is a missing authorization flaw in the Inisev Social Media & Share Icons plugin (versions up to 2.8.6) that allows unauthenticated attackers to modify content through incorrectly configured access controls. An attacker can exploit this by tricking a user into visiting a malicious link, then making unauthorized changes without proper permission checks. This is a moderate-severity vulnerability that affects the integrity of plugin functionality but does not expose sensitive data or cause service disruption.

• CVE-2024-32110MEDIUM 4.3

  The WpEvently WordPress plugin through version 4.1.2 contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick authenticated users into performing unintended actions on the site without their knowledge. An attacker can craft a malicious webpage that, when visited by a logged-in WordPress administrator or user, silently executes actions on behalf of that user—such as modifying plugin settings or creating unauthorized content. The vulnerability requires user interaction (visiting a malicious link or page) but does not require the attacker to have direct access to the WordPress installation.

• CVE-2024-33685MEDIUM 4.3

  Startupzy contains a missing authorization vulnerability that allows authenticated users to perform actions they shouldn't be permitted to perform. The issue stems from incorrectly configured access control security levels—essentially, the application fails to properly verify what operations a logged-in user is allowed to execute. An attacker with valid credentials can exploit this to modify data or perform unauthorized changes, though they cannot read sensitive information or crash the system.

• CVE-2024-34810MEDIUM 4.3

  Skyline WP, a WordPress theme distributed by Extend Themes, contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to trick authenticated administrators into performing unintended actions on the site. An attacker could craft a malicious webpage or email that, when visited by a logged-in WordPress admin, would execute administrative functions without explicit user consent. The vulnerability affects all versions of Skyline WP through version 1.0.10.

• CVE-2024-35648MEDIUM 4.3

  A cross-site request forgery (CSRF) vulnerability exists in Andy Moyle Emergency Password Reset versions up to and including 8.0. An attacker can craft a malicious web page or email that, when visited by an authenticated user, triggers unintended password reset actions without the user's knowledge or consent. The attack succeeds because the application does not properly validate the origin or intent of password reset requests.

• CVE-2024-37496MEDIUM 4.3

  CVE-2024-37496 is a missing authorization flaw in Rara Themes' Metro Magazine WordPress theme that allows unauthenticated users to perform certain actions they shouldn't be able to perform due to improperly configured access controls. An attacker could exploit this to modify content or settings without logging in, though the vulnerability requires user interaction (such as a click on a malicious link) to trigger. The issue affects Metro Magazine versions up to and including 1.3.7.

• CVE-2024-47273MEDIUM 4.3

  Synology Hyper Backup versions before 4.1.2-4036 contain a path traversal vulnerability in the Backup Task feature that allows an authenticated user to write files outside their intended directory. An attacker with valid credentials could exploit this to place files in restricted locations on the system, potentially compromising system integrity or enabling lateral movement.