By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 36 of 41

• CVE-2026-11494MEDIUM 4.3

  A privilege escalation vulnerability has been discovered in TOTOLIK AC1200 T8 running firmware version 4.1.5cu.8611. The flaw resides in the vsftpd (Very Secure FTP Daemon) configuration file and allows an authenticated attacker to modify settings in a way that violates the principle of least privilege. While the vulnerability requires valid login credentials to exploit, successful attacks could lead to unauthorized configuration changes that broaden attacker capabilities on the device. Public disclosure of this issue means exploitation techniques are available in the wild.

• CVE-2026-11512MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability has been discovered in itsourcecode Hospital Management System version 1.0. The flaw exists in the billing module (/billing.php) and can be triggered by manipulating the patientid parameter. An attacker can craft a malicious link or form that, when clicked by a hospital staff member or administrator, injects arbitrary JavaScript into their browser session. This could allow the attacker to steal session credentials, modify billing records, or perform unauthorized actions on behalf of the logged-in user. The vulnerability requires user interaction (a victim must click a malicious link) but needs no authentication to set up the attack. Public exploit details are available, increasing real-world risk.

• CVE-2026-11518MEDIUM 4.3

  SourceCodester Inventory System version 1.0 contains a cross-site scripting (XSS) vulnerability in its user management functionality. An attacker can inject malicious code through the fullname or username fields in the /users.php file, which is then reflected back to users viewing that data. While the vulnerability requires user interaction (such as clicking a malicious link), it could be exploited remotely to steal session cookies, redirect users, or perform actions on their behalf within the application.

• CVE-2026-11554MEDIUM 4.3

  A privilege escalation weakness has been identified in TOTOLINK CP450 version 4.1.0cu.747 affecting the vsftpd FTP service configuration. An authenticated attacker can modify the /etc/vsftpd.conf file in a way that violates the principle of least privilege, potentially allowing them to expand their access or capabilities on the device. The vulnerability requires valid login credentials to exploit, but once leveraged, could enable unauthorized actions. Public details about this issue are already available, increasing the likelihood of active exploitation.

• CVE-2026-11562MEDIUM 4.3

  A capability verification gap in the WS Form LITE WordPress plugin before version 1.11.8 allows low-privilege users—those with subscriber accounts or higher—to change plugin settings they should not be able to modify. An authenticated attacker needs only a basic subscriber-level account to make unauthorized configuration changes, potentially disrupting form functionality or exposing sensitive data depending on what settings are altered.

• CVE-2026-11592MEDIUM 4.3

  The Email Subscribers & Newsletters plugin for WordPress fails to properly check whether contributors and higher-level users should be allowed to perform administrative email and newsletter actions. An authenticated attacker with contributor-level access can exploit this gap to change who emails appear to come from, create mailing lists, add recipients without authorization, set up automated email workflows, and send mass emails to arbitrary addresses. This is an authorization problem—the attacker has legitimate access to WordPress, but can do things they shouldn't be able to do.

• CVE-2026-11595MEDIUM 4.3

  IBM WebSphere Application Server versions 9.0 and 8.5 contain a vulnerability in their administrative console's help system that could leak sensitive information to an attacker on the same network. The attacker needs network-adjacent access but no credentials or user interaction to exploit it. While the information disclosure is limited in scope, the flaw affects widely-deployed enterprise application servers and warrants timely patching.

• CVE-2026-11600MEDIUM 4.3

  The Envo's Templates & Widgets for Elementor plugin contains a flaw that allows authenticated WordPress users (authors and above) to expose private page content to the public. When an attacker with author-level access configures an Envo Tabs widget on a public post, they can reference private pages or templates by ID, and those private contents will display to anonymous visitors who view the public post. The vulnerability exists because the plugin fails to verify whether a visitor should have permission to see the content before displaying it.

• CVE-2026-11665MEDIUM 4.3

  A flaw in Google Chrome's graphics rendering engine (Dawn) on Windows could allow an attacker to trick a user into visiting a malicious webpage that leaks sensitive data from other websites the user is logged into. The vulnerability requires user interaction—the user must visit the crafted page—but does not require any special permissions or complex attack setup. The leaked data is limited in scope and does not include the ability to modify or destroy information.

• CVE-2026-11668MEDIUM 4.3

  Google Chrome and Chrome OS contain a weakness in their video codec processing that could allow a remote attacker to steal data from other websites. The flaw stems from uninitialized memory in the codec layer—essentially, the browser fails to properly initialize certain memory regions before use. An attacker can craft a malicious video file that, when opened by a user, exploits this memory state to read sensitive information across security boundaries. The vulnerability affects Chrome on Linux and Chrome OS versions prior to 149.0.7827.103.

• CVE-2026-11685MEDIUM 4.3

  Google Chrome on macOS contains a flaw in how it handles media capture permissions that could allow an attacker to trick you into revealing data meant to be private to a specific website. By crafting a malicious webpage, an attacker can bypass Chrome's protections and leak information across website boundaries—essentially stealing data that should stay isolated to one origin. The vulnerability requires user interaction, such as visiting a malicious page, but does not require special privileges or system-level access.

• CVE-2026-11695MEDIUM 4.3

  Google Chrome prior to version 149.0.7827.103 contains a flaw in its password handling logic that could allow an attacker to leak sensitive data across website boundaries. An attacker would need to craft a malicious HTML page and convince a user to visit it, but the vulnerability itself does not require the user to take additional actions beyond normal browsing. The leaked data is restricted to information accessible within the browser context of the affected user.

• CVE-2026-11773MEDIUM 4.3

  The Masteriyo LMS plugin for WordPress, a popular learning management system used by educational institutions and organizations, has a flaw that lets enrolled students modify course announcements. Specifically, any authenticated user with student-level access or higher can change the text of announcements posted by instructors or administrators. This is a permission control problem—the plugin fails to verify whether a user should have edit rights before allowing the change. It affects all versions up to 2.2.1.

• CVE-2026-11775MEDIUM 4.3

  The User Admin Simplifier WordPress plugin contains a cross-site request forgery (CSRF) flaw that allows an attacker to trick a site administrator into unwittingly resetting or deleting that administrator's saved menu and admin-bar configuration. An attacker can craft a malicious link that, when clicked by an authenticated admin, will overwrite the plugin's stored settings without the admin's knowledge or consent. This requires social engineering—the admin must click a link—but no additional authentication or exploits are needed once that happens.

• CVE-2026-11784MEDIUM 4.3

  The Optimole WordPress image optimization plugin contains a cross-site request forgery (CSRF) vulnerability in its file replacement function. An attacker can craft a malicious link that, when clicked by a site administrator or author, overwrites media files on the WordPress site without their knowledge. The vulnerability affects all versions up to 4.2.6 and requires social engineering to exploit, as the attacker must trick a user into clicking a link. The actual damage is limited to media file replacement since the plugin still checks whether the user has permission to edit the specific post or attachment being targeted.

• CVE-2026-11785MEDIUM 4.3

  CVE-2026-11785 is a flaw in 389 Directory Server that leaks partial stack memory addresses to authenticated users through LDAP responses. An attacker with valid LDAP credentials can trigger a type confusion error during SSO token processing, causing the server to inadvertently expose memory layout information. This is a limited disclosure risk—the attacker must already be authenticated, and only partial address information is exposed—but it can provide a foothold for more advanced attacks that rely on defeating address space layout randomization (ASLR).

• CVE-2026-11847MEDIUM 4.3

  CVE-2026-11847 is a path traversal vulnerability in IEI Integration Corp's iVEC-IEI Virtualization Edge Computer. An authenticated attacker can bypass intended directory restrictions and create folders in arbitrary system locations, potentially disrupting system organization, overwriting critical paths, or laying groundwork for privilege escalation attacks. The vulnerability requires valid credentials to exploit but poses real operational risk in multi-tenant or untrusted-user environments.

• CVE-2026-11887MEDIUM 4.3

  The Salon Booking System WordPress plugin versions before 10.30.20 contain an authorization flaw that allows any logged-in user—even those with minimal privileges like subscribers—to manipulate booking system settings through AJAX requests. Specifically, authenticated users can bypass the manual approval workflow for new bookings, potentially allowing unauthorized modifications to how reservations are processed without administrator oversight.

• CVE-2026-11890MEDIUM 4.3

  Devolutions Server versions 2026.2.5 and 2026.1.21 contain an access control flaw that allows any authenticated user to view account discovery scan results they should not have permission to access. An attacker with valid credentials to the server can retrieve sensitive account information gathered during automated discovery scans, potentially exposing credentials or account details that should be restricted to authorized administrators.

• CVE-2026-11900MEDIUM 4.3

  The Ad Inserter plugin for WordPress contains a flaw that allows authenticated users with basic contributor permissions to read private, draft, and password-protected content from other users' posts. An attacker can exploit this by inserting a specially crafted shortcode into a post they own, then previewing it to extract sensitive content. The vulnerability affects versions up to 2.8.16.

• CVE-2026-11981MEDIUM 4.3

  The GiveWP WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to disable donation email notifications without authentication. An attacker would need to trick a WordPress site administrator into clicking a malicious link or visiting a compromised page, which would then silently disable the site's donation notification system. This affects GiveWP versions up to and including 4.15.3.

• CVE-2026-11987MEDIUM 4.3

  The Dokan WordPress plugin, which enables multi-vendor marketplaces similar to Amazon or Etsy, contains a flaw that lets any logged-in vendor see other vendors' product listings—including unpublished drafts and pending items. An attacker needs only a basic subscriber account and knowledge of another vendor's product ID to retrieve sensitive details like names, prices, and descriptions. The vulnerability stems from insufficient access controls: the plugin checks that a user has generic vendor permissions but fails to verify they actually own the product being accessed.

• CVE-2026-11992MEDIUM 4.3

  The Easy Appointments plugin for WordPress allows authenticated users with author-level access to cancel all future appointments across the entire site without proper permission checks. An attacker with author credentials can mark every upcoming appointment as abandoned, disrupting scheduling for the site and its users. The vulnerability stems from a flawed authorization mechanism combined with the nonce (a security token) being visible to low-privileged users on an accessible admin page.

• CVE-2026-11997MEDIUM 4.3

  The Bulk SEO Image WordPress plugin versions up to 1.1 contain a Cross-Site Request Forgery (CSRF) vulnerability in its settings page. An unauthenticated attacker can craft a malicious link or page that, when clicked by a site administrator, will automatically bulk-overwrite the ALT-text metadata for all images across the WordPress site. The vulnerability exists because the plugin fails to implement proper nonce validation—a standard WordPress security mechanism that prevents requests from being executed without explicit authorization.

• CVE-2026-12049MEDIUM 4.3

  pgAdmin 4 contains an open redirect flaw in its multi-factor authentication (MFA) flow. When a user completes MFA validation or registration, the application accepts a 'next' parameter—meant to redirect users back to their intended destination—without verifying that the target is actually part of pgAdmin. An attacker can craft a malicious link that redirects an authenticated user to an external website after they complete MFA, making the redirect appear to originate from the trusted pgAdmin domain. This is primarily a phishing amplification risk: the attacker doesn't gain access to pgAdmin or databases, but leverages pgAdmin's legitimate domain to increase the credibility of follow-on credential theft attempts.

• CVE-2026-12050MEDIUM 4.3

  A SQL injection vulnerability exists in pgAdmin 4's restore point functionality. When an authenticated user interacts with the named restore point endpoint, user-supplied input is concatenated directly into an SQL query rather than being safely parameterized. This allows an attacker to inject additional SQL statements. However, the injected SQL runs under the same database role the attacker already has access to through pgAdmin's Query Tool, so the practical impact is limited to what that role can already do. The vulnerability primarily concerns the fact that SQL execution bypasses the documented interface, which could matter for deployments that restrict Query Tool access at the application layer.

• CVE-2026-12111MEDIUM 4.3

  The Appointment Booking Calendar plugin for WordPress contains a vulnerability that allows low-privilege users (Contributors and above) to view sensitive customer booking information they shouldn't have access to. Specifically, attackers can manipulate a query parameter to retrieve email addresses, names, phone numbers, booking times, and comments from any calendar in the system. The flaw stems from inadequate permission checks—the plugin only verifies basic admin access rather than confirming whether a user owns or manages the specific calendar being queried.

• CVE-2026-12113MEDIUM 4.3

  The Appointment Booking Calendar plugin for WordPress has a flaw that allows staff members with contributor-level access or higher to view sensitive customer booking information they shouldn't have access to. This includes customer names, email addresses, phone numbers, appointment notes, and other personally identifiable details. The vulnerability exists in all versions up to and including 1.4.02 and requires an authenticated user account to exploit—meaning someone with legitimate but low-level access to your WordPress site could abuse it to extract booking records.

• CVE-2026-12117MEDIUM 4.3

  Devolutions Server 2026.2.5 contains an access control flaw that allows authenticated users to view metadata about social login configurations they shouldn't have permission to access. An attacker with a valid vault membership can craft specific API requests to enumerate social login entry details, potentially revealing sensitive integration information. This is a low-risk exposure of metadata rather than a direct compromise mechanism, but it can aid reconnaissance or inform follow-up attacks against connected identity systems.

• CVE-2026-12133MEDIUM 4.3

  The JoomSport plugin for WordPress contains a flaw that allows subscribers and higher-privilege users to delete any sports group managed by the plugin, even if they shouldn't have permission to do so. An attacker with a basic subscriber account can craft a request that bypasses authorization checks and removes groups from the system. The vulnerability exists in versions 5.7.8 and earlier.

• CVE-2026-12134MEDIUM 4.3

  The JoomSport plugin for WordPress, used to manage sports leagues and teams, contains a flaw that allows low-privilege users to bypass access controls. Any authenticated user with a basic subscriber account or higher can create new season groups or alter existing tournament structures—actions normally restricted to administrators. The vulnerability requires the attacker to obtain a security token (joomsportajaxnonce) that is publicly visible on pages displaying JoomSport content, making exploitation straightforward once that token is retrieved.

• CVE-2026-12176MEDIUM 4.3

  A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0. An attacker can inject malicious JavaScript through the 'action' parameter in /index.php, which executes in a victim's browser when they visit a crafted link. The vulnerability requires user interaction (clicking a link) but can be exploited remotely without authentication. Public exploit details are available, increasing the practical risk of opportunistic attacks.

• CVE-2026-12207MEDIUM 4.3

  A vulnerability in medkey's patient management API allows authenticated users to access patient records they shouldn't be able to view by manipulating ID parameters. An attacker with login credentials can request patient data belonging to other patients, potentially exposing sensitive medical information. The flaw affects the patient lookup function in medkey's HTTP REST API and has already been disclosed publicly, though the vendor has not acknowledged or addressed it.

• CVE-2026-12212MEDIUM 4.3

  A flaw in hcengineering's Huly Platform versions up to 0.7.0 allows authenticated users to access sensitive mailbox secrets they should not be able to read. The vulnerability resides in the RPC interface used to manage account operations and stems from weak access controls on a specific function. An attacker with valid credentials can exploit this remotely to view confidential data. Public disclosure has already occurred, and the vendor has not responded to early notification attempts.

• CVE-2026-12213MEDIUM 4.3

  A flaw in hcengineering's Huly Platform allows authenticated users to view information about other user accounts they should not have access to. The vulnerability exists in the user information retrieval function and stems from insufficient permission checks. While the issue requires an attacker to already have login credentials, the simplicity of exploitation and public availability of details increase risk. The vendor has not responded to early disclosure attempts.

• CVE-2026-12303MEDIUM 4.3

  A flaw in Firefox and Thunderbird's WebGPU graphics component can expose sensitive information to attackers. The vulnerability stems from improper boundary checking that allows data normally kept private to leak when certain graphics operations are performed. An attacker must trick a user into visiting a malicious webpage to trigger the disclosure. The vulnerability is rated MEDIUM severity and has been patched in Firefox 152 and Thunderbird 152.

• CVE-2026-12320MEDIUM 4.3

  A flaw in Firefox and Thunderbird's Password Manager allows sensitive credential information to be disclosed to an attacker under certain conditions. The vulnerability requires user interaction to exploit—an attacker cannot trigger it remotely without the user taking action. The exposure is limited to confidentiality; attackers cannot modify data or cause service disruption. Mozilla has addressed this issue in Firefox 152 and Thunderbird 152.

• CVE-2026-12408MEDIUM 4.3

  A WordPress security plugin called Slim SEO has a flaw that allows contributors and editors to read content they shouldn't be able to see. Specifically, the plugin's AI-powered REST API endpoint for generating meta tags doesn't properly verify user permissions before returning summaries of post content. An attacker with basic contributor-level access can request summaries of private posts, drafts, or password-protected content written by other users, and the plugin will generate and return AI-powered summaries that expose the underlying content. This is a classic authorization bypass where the plugin checks if a user can edit posts in general, but doesn't confirm they have permission to access the specific post being requested.

• CVE-2026-12433MEDIUM 4.3

  The Hydra Booking plugin for WordPress contains a flaw that allows hosts with elevated permissions to view booking details that don't belong to them. When a host requests booking information through the plugin's REST API, the system only checks that they have the right administrative role—not whether they actually manage that specific booking. An attacker with host-level access can guess or iterate booking IDs to access sensitive attendee information like names, emails, phone numbers, addresses, payment details, and internal notes from other hosts' bookings.

• CVE-2026-12435MEDIUM 4.3

  The Motors car dealership plugin for WordPress contains a flaw that allows authenticated users to tamper with other users' car listings. Any subscriber or higher-level user who has created their own listing can steal a special security token from their own listing page and use it to fraudulently mark another user's listing as sold—without the owner's permission. This creates a 'Sold' badge on the victim's listing and removes its featured status. The attack requires no special tools and leaves minimal traces, making it a sneaky way for competitors or malicious users to sabotage active listings.

• CVE-2026-12446MEDIUM 4.3

  Google Chrome versions before 149.0.7827.155 contain a flaw in how passwords are handled that allows attackers to trick users into visiting a malicious website, which can then leak sensitive information from other websites the user has visited. The vulnerability requires user interaction—specifically clicking a link or visiting a crafted page—but does not require the user to install anything or be an administrator. Once triggered, an attacker gains access only to what the browser can see, not the user's entire system.

• CVE-2026-12469MEDIUM 4.3

  A memory initialization flaw in Google Chrome's GPU rendering engine on Android can allow attackers to steal sensitive data from other websites. When you visit a malicious webpage, the attacker could potentially read information from other sites you're currently accessing in different tabs or windows, thanks to uninitialized data being exposed through graphics processing. This is a local attack requiring user interaction—the victim must click on or interact with a crafted link—but the potential for cross-origin data leakage makes it a meaningful security concern for mobile users.

• CVE-2026-12471MEDIUM 4.3

  The Spexo WordPress theme contains a privilege escalation flaw affecting versions through 2.0.11. Authenticated users with basic subscriber permissions can bypass security checks to activate certain plugins without authorization. While the attacker must already have legitimate access to the WordPress site, the missing permission validation allows them to expand their capabilities by installing plugins—a privilege normally restricted to administrators.

• CVE-2026-12515MEDIUM 4.3

  CVE-2026-12515 is a security flaw in Katello, the content management component of Red Hat Satellite, that allows authenticated users with product-editing permissions to discover what content exists in repositories they shouldn't have access to. An attacker with edit_products permission could query the ContentUploadsController to learn whether specific files or packages exist in off-limits repositories—potentially valuable reconnaissance for follow-up attacks. The vulnerability does not enable attackers to actually modify, import, or publish content; it's strictly an information disclosure issue.

• CVE-2026-12729MEDIUM 4.3

  The weDocs WordPress plugin contains a missing authorization flaw that allows any logged-in user with Subscriber-level access or higher to trigger a full data migration from BetterDocs without permission. An attacker could exploit this to create fake documentation entries, modify site settings, and forcibly deactivate competing plugins—all without needing admin approval or additional verification. The vulnerability affects versions up to 2.3.0 and requires no special technical skills beyond basic WordPress access.

• CVE-2026-12799MEDIUM 4.3

  BerriAI's litellm library contains an authorization flaw in its user management interface. An authenticated attacker can view unauthorized user information by exploiting an incomplete fix to a prior vulnerability. The issue affects versions up to 1.82.2 and requires valid credentials to exploit, limiting the immediate attack surface but posing a meaningful risk to multi-tenant deployments where user isolation is critical.

• CVE-2026-12804MEDIUM 4.3

  CVE-2026-12804 is an open redirect vulnerability in lemonldap-ng, an open-source authentication and authorization platform, affecting versions up to 2.23.0. An attacker can manipulate a URL parameter in the SAML Common Domain Cookie (CDC) endpoint to redirect users to arbitrary external websites. This occurs when a user clicks a malicious link—the vulnerability requires user interaction and does not grant the attacker direct access to systems. The vendor has confirmed a fix is available in version 2.23.1.

• CVE-2026-12811MEDIUM 4.3

  Kortix-AI's Suna application (versions up to 0.8.38) contains a cross-site scripting (XSS) vulnerability in its authentication page. An attacker can manipulate the returnURL parameter to inject malicious code that executes in a user's browser when they visit a crafted link. The vulnerability requires user interaction—someone must click a malicious link—but carries no authentication barrier. Public exploit code exists. Upgrading to version 0.8.39 eliminates the risk.

• CVE-2026-12891MEDIUM 4.3

  A memory reading flaw exists in GStreamer's H.266 video codec handler. When a malicious video file with a specially crafted aspect ratio value is processed, the parser reads beyond its intended memory boundaries, potentially exposing small amounts of sensitive data from the application's memory. The risk is modest because exploitation requires user interaction (opening a video) and the leaked information is typically limited, but it can occur over a network.

• CVE-2026-12902MEDIUM 4.3

  Kadence Blocks, a popular WordPress page builder plugin, contains a flaw that allows contributors and higher-level users to upload images to the site's media library in ways they shouldn't be able to. Normally, WordPress limits who can upload files based on user roles. This vulnerability bypasses that restriction by letting authenticated attackers with basic posting privileges download external images directly to the server without proper permission checks. An attacker would need to already have an account on the target WordPress site, but the damage they can cause—polluting the media library, potentially hosting malicious images, or filling server storage—extends beyond what their role should allow.

• CVE-2026-12904MEDIUM 4.3

  A WordPress plugin called Kadence Blocks contains a flaw that lets authenticated users with basic contributor permissions view or delete optimization analysis data they shouldn't have access to. The vulnerability stems from a mismatch: the plugin checks whether a user can edit a post based on one identifier, but then actually reads or deletes data based on a different, attacker-supplied file path. An attacker can exploit this by providing their own post ID (which passes permission checks) along with a victim's actual file path, gaining unauthorized access to that victim's optimizer records. This affects Kadence Blocks versions up to 3.7.7.

• CVE-2026-1291MEDIUM 4.3

  The Meow Gallery plugin for WordPress contains a flaw in its REST API that allows authenticated authors and above to modify gallery records without proper permission checks. An attacker with author-level credentials can create new gallery shortcodes or overwrite existing ones by directly specifying record IDs, potentially altering or injecting malicious gallery content into a WordPress site.

• CVE-2026-12955MEDIUM 4.3

  The GDPR Cookie Consent plugin for WordPress contains a privilege escalation vulnerability that allows lower-level users to modify critical plugin settings they shouldn't be able to access. An authenticated user with basic Subscriber permissions can change the plugin's cookie scan schedule configuration through an unprotected AJAX function. This bypasses WordPress's built-in permission checks and allows attackers to manipulate administrative settings without proper authorization.

• CVE-2026-13021MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.197 contain a flaw in how it handles device-bound session credentials that could allow an attacker to bypass the browser's same-origin policy—a critical security boundary that normally prevents websites from accessing data belonging to other sites. An attacker could craft a malicious HTML page that, when visited by a user, potentially gains unauthorized access to sensitive information from other origins. The vulnerability requires user interaction (visiting a malicious page) and is limited to information disclosure; it does not enable data modification or system unavailability.

• CVE-2026-13211MEDIUM 4.3

  The genucenter web interface leaks SNMP authentication and encryption keys in HTTP responses to users with Service or Admin roles. An authenticated user with these permissions can view sensitive credentials in plain sight during normal web interface interactions, potentially exposing network authentication material that could be reused for unauthorized access to monitored devices.

• CVE-2026-13422MEDIUM 4.3

  The HD Quiz plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting versions 2.2.0 and 2.2.1. The flaw exists in the hdq_validate_nonce function, which fails to properly validate security tokens. An attacker can craft a malicious link or webpage that, if clicked by a site administrator, allows the attacker to perform unauthorized actions without the administrator's knowledge—including deleting or modifying quizzes, creating new quizzes, and altering plugin settings. No special privileges or prior access are required on the attacker's side.

• CVE-2026-13455MEDIUM 4.3

  PostgreSQL Anonymizer has a weakness that lets regular database users attack the hashing function used to protect sensitive data. By making repeated calls to the anon.hash() function and collecting the results, an attacker can work offline to figure out the salt value—a secret ingredient that makes hashes harder to crack. This undermines the whole point of using masked data for testing or development. The vendor has released version 3.1.2 to fix this issue.

• CVE-2026-13499MEDIUM 4.3

  A reflected cross-site scripting (XSS) vulnerability exists in the yashpokharna2555 restaurant-management-system, specifically in the registration handler component. An attacker can inject malicious code through the Username field in login_register.php. When a user visits a crafted link, the injected script executes in their browser, allowing the attacker to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability requires user interaction (clicking a malicious link) but can be exploited remotely without authentication.

• CVE-2026-13522MEDIUM 4.3

  Investintech SlimPDFReader versions up to 2.0.14 contain a memory access vulnerability in its PDF file handling component. An attacker can craft a malicious PDF that, when opened by a user, causes the application to read memory outside its intended boundaries. This out-of-bounds read can crash the application or potentially leak sensitive information. The vulnerability requires user interaction (opening a file) and can be delivered remotely via email or a compromised website. Notably, SlimPDFReader is no longer maintained by the vendor, meaning no official patches will be released.

• CVE-2026-13536MEDIUM 4.3

  GotoHTTP versions up to 10.2 contain a cross-site scripting (XSS) vulnerability in the /reg.12x file endpoint. An attacker can inject malicious code through the 'sn' parameter, which the application echoes back without proper sanitization. The vulnerability requires user interaction—a victim must click a crafted link—but can be exploited remotely without authentication. The vendor has acknowledged the issue and removed the unnecessary parameter echo from the codebase, though they have not released a patched version, deferring the fix to a future release.

• CVE-2026-13537MEDIUM 4.3

  CodeAstro Human Resource Management System version 1.0 contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to trick users into performing unwanted actions within the HR system. An attacker can craft a malicious link or webpage that, when visited by a logged-in HR employee, silently executes administrative or data-modifying operations on their behalf. The vulnerability affects any network-accessible deployment and exploits have already been disclosed publicly.

• CVE-2026-13554MEDIUM 4.3

  A stored cross-site scripting (XSS) vulnerability exists in itsourcecode Online Hotel Management System version 1.0. An attacker can inject malicious JavaScript code through the amenities management interface that executes in the browsers of other users—specifically administrators—when they view the poisoned data. The vulnerability requires user interaction (clicking a link or viewing a page with the payload) but no authentication to create the malicious input.

• CVE-2026-13556MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in itsourcecode Online Hotel Management System version 1.0. An attacker can inject malicious code through the Name parameter in the user editing interface (/admin/mod_users/controller.php?action=edit), which is then executed in the context of another user's browser. The vulnerability requires user interaction—such as a victim clicking a malicious link—but can cause session hijacking, credential theft, or unauthorized administrative actions. The vulnerability has been publicly disclosed.

• CVE-2026-13557MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in itsourcecode Online Hotel Management System version 1.0. An attacker can inject malicious scripts through the 'Name' parameter in the room management admin interface, which are then reflected back to users who interact with the affected page. This requires user interaction (such as clicking a malicious link) to trigger, but once executed, the injected code runs in the victim's browser with the same privileges as their session.

• CVE-2026-13567MEDIUM 4.3

  A reflected cross-site scripting (XSS) vulnerability has been identified in code-projects Online Music Site version 1.0. The flaw exists in the feedback form handler (/Frontend/Feedback.php) and can be exploited by injecting malicious code into form fields (name, email, address, or message). When a victim visits a malicious link crafted by an attacker, the injected code executes in their browser, potentially allowing credential theft, session hijacking, or malware distribution. Public exploit code is already available, raising the attack likelihood.

• CVE-2026-13837MEDIUM 4.3

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in CSS handling that allows attackers to deceive users through visual spoofing. By crafting a malicious HTML page, an attacker can trick the browser into displaying fake UI elements—such as bogus address bars, dialogs, or buttons—that appear legitimate but are actually part of the webpage content. This could enable phishing attacks or social engineering by making malicious content look like trusted browser or website elements.

• CVE-2026-13842MEDIUM 4.3

  Google Chrome for iOS versions prior to 150.0.7871.47 contain a flaw that allows attackers to trick users by forging what appears in the browser's address bar (Omnibox). An attacker can craft a deceptive HTML page that makes it look like you're visiting a legitimate website when you're actually on a malicious one. This is a spoofing vulnerability—the attacker doesn't gain access to your data or crash your device, but can deceive you about where you actually are on the web.

• CVE-2026-13865MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw that allows attackers to trick users with fake interface elements. An attacker could craft a malicious website that makes parts of the browser or page look different from what they actually are—for example, spoofing a login prompt or security warning. The vulnerability requires user interaction (visiting a crafted page) but doesn't require special privileges or browser extensions to exploit.

• CVE-2026-13867MEDIUM 4.3

  Google Chrome versions prior to 150.0.7871.47 contain a vulnerability in the Geolocation feature that allows attackers to deceive users through fake UI elements. By crafting a malicious HTML page, a remote attacker can manipulate what users see on screen—a technique known as UI spoofing—without requiring any special system access or authentication. The attack requires user interaction, such as visiting a compromised website, but does not result in data theft or system compromise.

• CVE-2026-13902MEDIUM 4.3

  A flaw in Google Chrome for iOS allows an attacker to trick users by making fake content appear in the browser UI. An attacker would need to craft a malicious webpage and convince a user to visit it; the browser would then display misleading interface elements that could be mistaken for genuine browser controls or trusted content. This is a medium-severity issue that affects user trust and could enable phishing or social engineering attacks.

• CVE-2026-13912MEDIUM 4.3

  Google Chrome on iOS versions before 150.0.7871.47 contain a flaw in how the Safe Browsing feature validates and displays security information. An attacker can craft a malicious web page that tricks users by spoofing the browser's user interface—making it appear as though Chrome is displaying legitimate security warnings or information when it is not. This deceives users into taking actions they would not normally take, such as entering credentials or downloading files. The vulnerability requires user interaction (visiting the malicious page) to be exploited.

• CVE-2026-13916MEDIUM 4.3

  A vulnerability in Chrome for iOS allows an attacker to trick users into believing they are seeing legitimate content or UI elements when they are actually viewing a forged interface. An attacker would craft a specially designed web page and serve it to a user; if the user visits the page, the attacker could spoof the browser's user interface—for example, making a phishing page look like a legitimate login screen. This affects Chrome versions prior to 150.0.7871.47 on iOS devices. The attack requires user interaction (visiting the malicious page) but no special permissions or system access.

• CVE-2026-13941MEDIUM 4.3

  Google Chrome on Android contains a flaw in how it handles SiteSettings that allows attackers to deceive users visually through a specially crafted web page. An attacker can craft HTML that tricks Chrome's interface into displaying misleading information to the user—for example, making it appear that a dangerous permission has been denied when it was actually granted, or vice versa. This is a social engineering vector that relies on user interaction (visiting the malicious page) but does not require special browser permissions or system privileges to execute.

• CVE-2026-13946MEDIUM 4.3

  A security flaw in Google Chrome on iOS allows attackers to steal data from different websites by tricking users into viewing a specially crafted webpage. The vulnerability stems from improper handling of script injections, which can expose information that should remain hidden between websites. An attacker needs user interaction—typically clicking a link or visiting a malicious site—to exploit this, making it a moderate rather than critical risk.

• CVE-2026-13952MEDIUM 4.3

  A flaw in Google Chrome's PerformanceAPIs allows attackers to steal data from different websites without proper authorization. An attacker can craft a malicious webpage that, when visited by a user, reads sensitive information from other sites the user has open. The vulnerability requires user interaction—the victim must visit the attacker's page—but no special browser settings or advanced technical knowledge are needed to exploit it. Google has patched this issue in Chrome version 150.0.7871.47 and later.

• CVE-2026-13959MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in Blink (Chrome's rendering engine) that fails to properly validate user input in HTML pages. An attacker can exploit this by crafting a malicious HTML page that, when visited, bypasses the same-origin policy—a critical browser security boundary that prevents websites from accessing data or performing actions on behalf of other sites. The vulnerability requires user interaction (visiting a malicious page) but poses a moderate integrity risk.

• CVE-2026-13960MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in the password management system that allows attackers to deceive users through visual trickery. By crafting a malicious web page, an attacker can make Chrome's interface appear to show something it isn't—for example, a legitimate password prompt or security warning—fooling users into taking actions they wouldn't normally take. This is a UI spoofing attack: the attacker doesn't break into systems directly, but manipulates what users see on screen to trick them into compromising their own credentials or security.

• CVE-2026-13966MEDIUM 4.3

  Google Chrome contains a flaw in how it handles browser history that allows an attacker to trick users into believing they are viewing legitimate content when they are not. An attacker can craft a malicious webpage that, when visited, spoofs the appearance of the browser's UI—such as the address bar or other interface elements—to deceive users about what site they are actually on or what action they are performing. This requires user interaction (clicking or viewing the page) but does not require any special system privileges. The issue affects Chrome versions before 150.0.7871.47.

• CVE-2026-13972MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser's Paint component handles HTML rendering that allows attackers to trick users into thinking they're interacting with legitimate interface elements when they're actually viewing spoofed content. An attacker could craft a malicious webpage that, when visited, displays fake buttons, address bars, or other UI elements to deceive users into performing unintended actions. The attack requires user interaction—specifically visiting the malicious page—but no special privileges or difficult technical conditions.

• CVE-2026-13978MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a vulnerability in how the browser enforces policies within its PageInfo component, which displays website permission and security information to users. An attacker can craft a malicious HTML page that tricks users into believing they are interacting with legitimate Chrome UI elements—such as permission prompts or security warnings—when they are actually seeing attacker-controlled content. This UI spoofing attack requires user interaction to succeed but could lead to credential theft, social engineering, or other deceptive practices if the fake UI is convincing enough.

• CVE-2026-13979MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a UI spoofing vulnerability in the Paint feature. An attacker can craft a malicious HTML page that, when visited by a user, tricks the browser into displaying misleading visual elements—making it appear that legitimate security warnings or interface elements are present when they are not. This is a client-side attack requiring user interaction but poses a real risk of social engineering and credential theft.

• CVE-2026-13980MEDIUM 4.3

  Google Chrome for iOS versions before 150.0.7871.47 contain a flaw that allows attackers to trick users through misleading user interface elements. An attacker could craft a malicious webpage that, when visited, displays fake Chrome UI components—such as address bars or security indicators—to deceive users into believing they're interacting with legitimate browser elements. This is a spoofing vulnerability that relies on user interaction; attackers must convince someone to visit a crafted page, but no special user permissions or technical sophistication is required on the user's end.

• CVE-2026-13981MEDIUM 4.3

  Google Chrome on iOS contains a UI spoofing vulnerability that allows attackers to deceive users by manipulating how the browser interface appears. An attacker can craft a malicious HTML page that, when visited, tricks users into believing they're interacting with legitimate UI elements—such as address bars or security warnings—when they're actually viewing attacker-controlled content. This vulnerability requires user interaction (visiting the malicious page) but does not compromise data confidentiality or system availability.

• CVE-2026-13984MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in the TabStrip component's security interface that allows an attacker to deceive users through visual spoofing. By crafting a malicious web page, an attacker can manipulate what the browser displays to make it appear legitimate while performing unwanted actions. The attack requires user interaction—specifically, the user must visit the malicious page—but does not require any special privileges or complex browser configurations to execute.

• CVE-2026-13987MEDIUM 4.3

  A vulnerability in Google Chrome on Android allows attackers to deceive users through fake security warnings or misleading interface elements. By crafting a malicious HTML page, a remote attacker can make Chrome's security UI appear different from what it actually is—for example, displaying a fake warning dialog or masking the real address bar—to trick users into trusting untrustworthy content or performing unintended actions. The attack requires user interaction (clicking or viewing the page) but no special privileges. This affects Chrome versions prior to 150.0.7871.47 on Android devices.

• CVE-2026-13991MEDIUM 4.3

  A vulnerability in Chrome for iOS allows attackers to trick users through fake interface elements on specially crafted websites. When a user visits a malicious page, an attacker can make it appear as though legitimate interface elements (like buttons or address bars) are showing something they're not, potentially tricking the user into taking unintended actions. This requires user interaction—the user must visit the malicious site and interact with it—but the barrier to exploitation is low.

• CVE-2026-13994MEDIUM 4.3

  Google Chrome on Android contains a flaw in how it manages user credentials that allows attackers to trick users with fake authentication dialogs or credential prompts. An attacker hosting a specially crafted website could deceive users into believing they're interacting with legitimate Chrome security features, potentially leading to credential theft or other user manipulation. The vulnerability requires user interaction—specifically visiting a malicious webpage—but poses a real risk because users generally trust browser UI elements.

• CVE-2026-13995MEDIUM 4.3

  A flaw in Google Chrome's autofill feature on Android devices allows an attacker to trick users with a fake website. The vulnerability exists because the browser doesn't properly validate input when displaying autofill suggestions, giving attackers an opening to create deceptive pages that mimic legitimate interfaces. This is a relatively low-risk issue—it requires user interaction and only affects how information appears on screen, not data theft or system crashes—but it's worth patching because social engineering attacks that fool users into revealing credentials remain a persistent threat.

• CVE-2026-13999MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw that allows malicious browser extensions to trick users visually by displaying fake UI elements. An attacker must first convince a user to install a malicious extension, but once installed, the extension can spoof Chrome's user interface to deceive the user. This is classified as a medium-severity issue because it requires user interaction to install the extension and doesn't directly compromise system data or functionality on its own.

• CVE-2026-14003MEDIUM 4.3

  A flaw in how Google Chrome enforces security policies for extensions allows a malicious extension to access and leak data from websites you visit across different origins—essentially reading information it shouldn't have access to. An attacker would need to trick you into installing a malicious extension first, but once installed, the extension can quietly exfiltrate sensitive cross-origin data without additional user interaction. This affects Chrome versions before 150.0.7871.47.

• CVE-2026-14013MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in how SVG (Scalable Vector Graphics) content is handled that allows attackers to trick users through misleading visual elements on a web page. An attacker would need to host a specially crafted HTML page and convince a user to visit it; once there, the vulnerability could be exploited to display fake UI elements—such as fake login prompts or warning dialogs—that appear to come from Chrome or a trusted application. This is primarily a user-trust issue rather than a direct system compromise.

• CVE-2026-14020MEDIUM 4.3

  A flaw in Google Chrome's WebXR implementation allows a remote attacker to trick users into thinking they're interacting with legitimate interface elements when they're actually engaging with spoofed content. The vulnerability requires the attacker to first compromise Chrome's renderer process—the component that draws web pages—and then serve a malicious webpage to execute the UI spoofing attack. While the initial compromise is a prerequisite, once achieved, users can be deceived without additional interaction beyond normal web browsing.

• CVE-2026-14031MEDIUM 4.3

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how the file input component handles user interactions, enabling attackers to deceive users through visual spoofing attacks. A malicious HTML page can trick users into believing they are interacting with legitimate browser UI elements when they are not, potentially leading to unintended actions or credential harvesting through deceptive interface overlays.

• CVE-2026-14034MEDIUM 4.3

  CVE-2026-14034 is a navigation-bypass vulnerability in Google Chrome's WebXR implementation on Android. An attacker can craft a malicious HTML page that, when visited by a user, circumvents browser navigation restrictions. While the underlying Chromium severity is rated Low, the CVSS score of 4.3 reflects the requirement for user interaction and limited direct impact. The vulnerability does not enable data theft or system crashes but does allow unauthorized page navigation, which could facilitate phishing or redirect attacks.

• CVE-2026-14039MEDIUM 4.3

  CVE-2026-14039 is a same-origin policy bypass vulnerability in Google Chrome's GetUserMedia implementation. An attacker could craft a malicious HTML page to trick users into visiting it, bypassing browser protections that normally prevent one website from accessing resources or data from another website. The vulnerability affects Chrome versions before 150.0.7871.47 and requires user interaction to exploit. While Google rates it as low severity internally, the CVSS score of 4.3 reflects the integrity impact and low attack complexity.

• CVE-2026-14042MEDIUM 4.3

  A vulnerability in Google Chrome's Isolated Web Apps feature allows attackers to deceive users through visual manipulation. By sending a specially crafted HTML page, an attacker can spoof the browser's user interface—for example, making a fake login prompt or warning appear legitimate. The attacker cannot steal data or crash the browser, but can trick users into performing actions they wouldn't normally take. This affects Chrome versions before 150.0.7871.47.

• CVE-2026-14045MEDIUM 4.3

  A flaw in Google Chrome's network handling allows attackers who have already compromised the browser's renderer process to steal sensitive data from websites the user visits. The attacker would craft a malicious webpage designed to leak information across security boundaries that normally keep data from different websites separate. This requires the attacker to have already gained control of Chrome's rendering engine, making this a post-compromise issue rather than a remote code execution vector.

• CVE-2026-14046MEDIUM 4.3

  A flaw in Google Chrome's CustomTabs implementation on Android allows an attacker to circumvent the same-origin policy—a fundamental browser security boundary—by crafting a malicious HTML page. While Chromium rated this as low severity, the CVSS assessment reflects a medium risk because user interaction is required to exploit it, but the integrity impact (unauthorized modification of content or state) is real. The vulnerability affects Chrome versions prior to 150.0.7871.47 on Android devices.

• CVE-2026-14047MEDIUM 4.3

  A vulnerability in Google Chrome's extension system allows a malicious extension to bypass the browser's content security policy (CSP), a critical security boundary designed to prevent injection attacks. An attacker would need to trick a user into installing the malicious extension first, but once installed, the extension could inject or modify content in ways that CSP normally blocks. This affects Chrome versions before 150.0.7871.47.

• CVE-2026-14052MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw that allows attackers to bypass file system access restrictions through a specially crafted web page. An attacker would need to trick a user into visiting a malicious site, but once there, the vulnerability could allow unauthorized file operations that would normally be blocked by the browser's security policies.