By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 39 of 41

• CVE-2026-56334MEDIUM 4.3

  Capgo versions before 12.128.2 are missing a critical access control rule in their database that allows build status updates to be saved. Without this rule, when API keys or anonymous users attempt to update the status of build requests, those updates don't get persisted to the database. This leaves build jobs stuck in a 'pending' state indefinitely, with no error details recorded, making it impossible to know why builds are failing or what went wrong.

• CVE-2026-56384MEDIUM 4.3

  Craft CMS versions 4.x and 5.x contain a permissions bypass flaw in the asset preview feature. A Control Panel user who lacks permission to view private assets can circumvent that restriction by directly calling the preview endpoint and supplying an asset ID they shouldn't access. The system will return a preview containing a signed link to the private asset, effectively revealing content the user was never authorized to see. Exploitation requires valid Control Panel access but no special privileges beyond that.

• CVE-2026-56385MEDIUM 4.3

  Craft CMS contains a flaw that allows authenticated users with limited permissions to view preview data for assets they shouldn't have access to. An attacker with a low-privilege account can request a preview of restricted assets by manipulating the assetId parameter, receiving both preview HTML and a private image route that exposes the target asset. The vulnerability affects Craft CMS 5.0.0-RC1 through 5.9.13 and 4.0.0-RC1 through 4.17.7. Patch versions 5.9.14 and 4.17.8 resolve the issue.

• CVE-2026-56457MEDIUM 4.3

  HCL DevOps Deploy and HCL Launch contain a vulnerability where sensitive information can be exposed in output logs. An attacker who gains access to these logs could potentially retrieve sensitive values associated with deployment steps. This is a low-privilege vulnerability requiring network access and authenticated access to the system.

• CVE-2026-56761MEDIUM 4.3

  Hono, a popular TypeScript web framework, contains a vulnerability in its server-side JSX rendering engine that allows attackers to inject malicious HTML into web pages. By crafting specially malformed attribute names—using characters like quotes and angle brackets—attackers can break out of HTML tag contexts and insert unintended HTML elements or attributes. This vulnerability affects Hono versions before 4.12.14. The attack requires user interaction (such as visiting a malicious link or form submission) and has limited impact on confidentiality, but can compromise the integrity of rendered content.

• CVE-2026-56772MEDIUM 4.3

  NewsBlur, a self-hosted RSS reader and social platform, has a flaw in how it checks permissions on its social interaction endpoint. An authenticated user can request another user's notification feed—containing follows, replies, and activity—simply by guessing or enumerating user ID numbers. The application fails to verify that the requester owns or has permission to view that data. While an attacker needs a valid NewsBlur account, the barrier to accessing private social information is minimal once authenticated.

• CVE-2026-57283MEDIUM 4.3

  A CSRF vulnerability in Jenkins Pipeline: Groovy Plugin allows authenticated attackers to manipulate job or system configuration through the Pipeline Snippet Generator without requiring user interaction. An attacker with valid Jenkins credentials can craft malicious requests that, when processed by a targeted Jenkins administrator or user, result in unintended configuration changes. This is a cross-site request forgery issue, meaning the attack leverages the trust relationship between a user and Jenkins to perform unauthorized actions.

• CVE-2026-57284MEDIUM 4.3

  Jenkins Pipeline: Groovy Plugin versions 4331.v9d06ed4658ff and earlier contain a vulnerability in the Pipeline Snippet Generator that allows authenticated attackers to instantiate arbitrary types beyond the intended Pipeline step components. This could enable attackers to instantiate types related to job or system configuration, potentially leading to unauthorized modification of pipeline definitions or system settings. The vulnerability requires authentication and does not involve user interaction, making it a concern for organizations where Jenkins access is broadly distributed among developers.

• CVE-2026-57285MEDIUM 4.3

  Jenkins GitHub Branch Source Plugin versions 1967.1969.v205fd594c821 and earlier contain a security gap that allows any user with basic read permissions to discover the URLs of GitHub Enterprise servers connected to the Jenkins instance. This is an information disclosure issue—attackers cannot modify systems or take actions, but they can learn infrastructure details that may inform further attacks. The vulnerability requires authentication and is not currently exploited in the wild.

• CVE-2026-57286MEDIUM 4.3

  The Jenkins Git Parameter Plugin has a permission enforcement gap that lets users with basic read access to jobs extract sensitive information about the repositories those jobs use. Specifically, attackers can discover branch names, tag names, and revision metadata without needing higher-level permissions. While exploitation requires already having some level of access to Jenkins, this still represents a meaningful information disclosure risk in environments where job visibility is meant to be restricted.

• CVE-2026-57287MEDIUM 4.3

  The Jenkins Job Configuration History Plugin fails to hide encrypted secrets when showing past versions of job and agent configurations. An attacker with Extended Read permissions can view these encrypted secret values in the configuration history, bypassing the normal redaction that would hide them elsewhere in the interface. This is a credentials exposure issue that affects Jenkins administrators and users who rely on the plugin to maintain secure configuration records.

• CVE-2026-57290MEDIUM 4.3

  A cross-site request forgery (CSRF) flaw in the Jenkins Priority Sorter Plugin versions 936.v2c01c6b_84449 and earlier allows attackers to trick administrators into unknowingly changing the plugin's job priority settings. An attacker can craft a malicious link or webpage that, when visited by a logged-in Jenkins administrator, silently modifies how jobs are prioritized in the queue—potentially disrupting workflow fairness or enabling job manipulation for malicious purposes.

• CVE-2026-57293MEDIUM 4.3

  The Jenkins Gitee Plugin contains a flaw in how it checks permissions when users attempt to view credential information. An attacker with global Item/Configure permission—but who hasn't been granted access to any specific job—can exploit this inconsistency to discover the names or IDs of credentials stored elsewhere in the Jenkins system. This is an information disclosure issue: the attacker learns what credentials exist, but cannot read their actual values or use them directly.

• CVE-2026-57297MEDIUM 4.3

  A permission flaw in the Jenkins Contrast Continuous Application Security Plugin version 3.11 and earlier allows low-privileged users who have been granted basic read access to Jenkins to make unauthorized connections to external systems on behalf of the plugin. By exploiting this gap, attackers can specify which URL to connect to along with credentials (username, API key, and service key) to use—potentially allowing lateral movement, credential harvesting, or interaction with attacker-controlled infrastructure while appearing to originate from the Jenkins instance.

• CVE-2026-57299MEDIUM 4.3

  The Jenkins Contrast Continuous Application Security Plugin versions 3.11 and earlier contain a permission-check vulnerability that allows users with basic read access to discover the names of Contrast security configurations stored in Jenkins. While an attacker cannot modify or delete these configurations with this flaw alone, the ability to enumerate configuration names could support reconnaissance for follow-up attacks or reveal sensitive architectural details about an organization's security scanning setup.

• CVE-2026-57300MEDIUM 4.3

  Jenkins MCP Server Plugin versions 0.177.v629fdb_2557fe and earlier contain a missing permission check that allows attackers with basic Item/Read access to read Pipeline replay scripts from jobs they can browse. While the attacker cannot modify or disrupt those scripts, they can view their contents—potentially exposing sensitive logic, credentials, or other secrets embedded in replay configurations. This is a controlled-access vulnerability: the attacker must already have some permission within Jenkins to exploit it.

• CVE-2026-57302MEDIUM 4.3

  Jenkins FitNesse Plugin versions 1.36 and earlier fail to encrypt passwords before storing them in job configuration files on the Jenkins controller. This means any Jenkins user granted Extended Read permission—or anyone with direct file system access to the controller—can read these plaintext credentials. The vulnerability is localized to the Jenkins instance itself and does not enable remote code execution or wider system compromise, but it does create an unauthorized information disclosure risk for sensitive authentication data.

• CVE-2026-57521MEDIUM 4.3

  Bitwarden Server versions before 2026.5.0 contain a flaw in how they control access to billing information. Any user with a valid login can retrieve billing and invoice details from any organization in the system—not just ones they belong to—by simply providing a different organization's ID to the preview invoice feature. This allows unauthorized access to sensitive financial data including Stripe tax calculations, subscription status, and customer information.

• CVE-2026-57637MEDIUM 4.3

  The Abandoned Cart Lite for WooCommerce plugin up to version 6.8.0 contains a Cross Site Request Forgery (CSRF) vulnerability that does not require authentication. This means an attacker can craft a malicious webpage or email that, when visited by a logged-in WordPress administrator or user with relevant permissions, triggers unintended actions within the plugin without the user's knowledge or consent. The attacker cannot steal data directly, but can manipulate the plugin's behavior—such as modifying cart recovery settings or email configurations—by leveraging the user's existing session.

• CVE-2026-57657MEDIUM 4.3

  Gmail SMTP versions 1.2.3.19 and earlier contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated user without their knowledge or consent. An attacker can craft a malicious webpage or email that, when visited by a Gmail SMTP user, silently executes unwanted commands in their email session. This attack requires user interaction (visiting a malicious link or page) but does not require the attacker to authenticate.

• CVE-2026-57664MEDIUM 4.3

  Bopo, a WooCommerce plugin for building product bundles, contains a flaw in versions 1.1.6 and earlier that allows authenticated users to view sensitive information they shouldn't normally access. The vulnerability requires a valid WordPress login but does not require elevated privileges, and attackers cannot modify or delete data—only read it. This is a moderate-severity issue that primarily affects e-commerce sites using this plugin.

• CVE-2026-57676MEDIUM 4.3

  CVE-2026-57676 is an authorization bypass vulnerability in the Matteo Manna Simple User Avatar plugin affecting versions 4.9 and earlier. An authenticated attacker can manipulate user-controlled keys to circumvent access control checks and view sensitive information they should not have access to. The vulnerability requires login credentials but poses a real risk to any deployment where user privacy or data segregation is important.

• CVE-2026-57685MEDIUM 4.3

  A broken access control vulnerability exists in Martfury, a WooCommerce marketplace WordPress theme, affecting versions 3.2.8 and earlier. The flaw allows authenticated subscribers to modify data or perform actions they shouldn't be able to access, though the impact is limited to integrity rather than confidentiality or availability. This is a privilege escalation issue requiring a valid user account to exploit.

• CVE-2026-57720MEDIUM 4.3

  ThumbPress versions up to 6.3.2 contain a missing authorization flaw that allows authenticated users to perform actions they shouldn't be permitted to execute. An attacker with valid credentials can exploit incorrectly configured access controls to cause service disruption or data unavailability, though the vulnerability does not expose sensitive information or enable unauthorized modifications to data.

• CVE-2026-57921MEDIUM 4.3

  JetBrains YouTrack had a flaw that allowed authenticated users to read other users' private data through the comment templates endpoint. The vulnerability affects YouTrack versions before 2026.2.16593 and requires a valid login to exploit. While the exposure is limited to information disclosure with no ability to modify data or crash the system, it poses a privacy risk in multi-tenant or shared YouTrack deployments where sensitive project or user information may be exposed.

• CVE-2026-57924MEDIUM 4.3

  JetBrains YouTrack versions before 2026.2.16593 contain a configuration vulnerability where default role settings inadvertently expose sensitive user profile information to authenticated users. An attacker with valid credentials can view personal details they shouldn't normally access, but cannot modify data or disrupt service. This is a localized information disclosure issue stemming from overly permissive default access controls.

• CVE-2026-57925MEDIUM 4.3

  JetBrains YouTrack versions before 2026.2.16593 contain an access control flaw that allows authenticated users to read saved queries and tags they should not have permission to access. An attacker with valid login credentials can view sensitive search configurations and organizational metadata without proper authorization checks. This is not a pre-authentication or unauthenticated attack; it requires an existing account on the YouTrack instance.

• CVE-2026-57945MEDIUM 4.3

  PhotoPrism, a photo management application, has a flaw in how it validates user permissions when allowing authenticated users to modify profile information. An attacker who has logged-in access can change another user's profile details—such as their name, email, or other settings—by directly manipulating API requests. The vulnerability exists because the system doesn't properly verify that a user can only edit their own profile; it instead accepts modification requests for any user ID. This is not a critical flaw because it requires an attacker to already have legitimate account credentials, but it does allow unauthorized data tampering.

• CVE-2026-57954MEDIUM 4.3

  Elide, a Java framework for building APIs, contains a flaw in how it validates sorting requests. When users ask an API to sort data by a specific field, Elide is supposed to check whether they have permission to see that field. In versions up to 7.1.17, this permission check is skipped for sort expressions, meaning an attacker with basic API access can sort results by fields they shouldn't be able to access. By observing how the rows reorder when sorting by different fields, an attacker can infer the relative values of hidden fields—essentially reading data they have no permission to see. This vulnerability affects both JSON:API and GraphQL endpoints.

• CVE-2026-5796MEDIUM 4.3

  GitLab has patched a flaw affecting multiple versions of its Community Edition (CE) and Enterprise Edition (EE) where an authenticated user with Reporter-level permissions in a group could view package metadata even when the Package Registry feature was disabled at the project level. The issue stems from incomplete authorization logic that failed to properly enforce registry access controls, allowing information disclosure without requiring higher privileges or user interaction.

• CVE-2026-58209MEDIUM 4.3

  NATS Server has a flaw in how it enforces message access controls when delivering retained messages and replaying durable messages over MQTT. Specifically, the server fails to consistently verify that a subscriber's deny rules should block a message before delivering it. An authenticated attacker with subscriber access could receive messages they should not have access to because the server bypasses access checks during certain message delivery scenarios. This affects versions before 2.14.3 and 2.12.12.

• CVE-2026-58214MEDIUM 4.3

  A flaw in NATS Server versions before 2.14.3 and 2.12.12 allows an authenticated MQTT client to bypass configured access controls and subscribe to internal system topics that handle MQTT quality-of-service acknowledgments. This exposes sensitive protocol metadata about other MQTT sessions in the account, but does not allow modification or disruption of services.

• CVE-2026-58315MEDIUM 4.3

  A cross-site request forgery (CSRF) vulnerability in SEIKO EPSON Web Config allows an attacker to trick a logged-in user into unknowingly performing unintended operations. An attacker could craft a malicious webpage that, when viewed by someone authenticated to the Web Config interface, silently executes administrative commands on their behalf. The vulnerability requires user interaction—the victim must actively visit the attacker's page while already logged in—but does not require the attacker to know or steal credentials.

• CVE-2026-58373MEDIUM 4.3

  CVAT, a computer vision annotation tool, has an authorization flaw that lets authenticated users discover which quality reports exist in other organizations. An attacker with valid login credentials can probe the quality reports API by trying different report IDs and observing whether the system returns a 'not found' or 'server error' response—leaking the fact that a report exists without revealing its contents. This affects CVAT versions before 2.69.0.

• CVE-2026-58450MEDIUM 4.3

  Invoice Ninja versions up to 5.13.26 contain a flaw in the client login portal that allows attackers to craft a deceptive login link. When a user logs in through this malicious link, they are automatically redirected to an attacker's website rather than the legitimate Invoice Ninja dashboard. The vulnerability doesn't require any special access or authentication from the attacker—they simply construct a fake login URL and trick users into clicking it via phishing or social engineering. After successful authentication, victims are silently redirected away from Invoice Ninja to a site the attacker controls, making this an effective stepping stone for credential theft or malware distribution.

• CVE-2026-58517MEDIUM 4.3

  A flaw in MediaWiki's WikiLambda extension allows authenticated users to bypass intended access controls by improperly handling input terminators. An attacker with login credentials could potentially manipulate their permissions or perform actions beyond their assigned role, though the vulnerability requires authentication and does not lead to data disclosure or system unavailability.

• CVE-2026-58597MEDIUM 4.3

  Microsoft Edge (Chromium-based) contains a UI design flaw that fails to adequately warn users before dangerous operations, creating an opening for attackers to conduct spoofing attacks over the network. An attacker cannot exploit this directly without user interaction—the vulnerability requires a person to be tricked into performing an action they would normally avoid if properly warned. The risk stems from insufficient UI clarity rather than a code execution flaw.

• CVE-2026-58653MEDIUM 4.3

  PraisonAI versions prior to 0.1.7 contain a cross-tenant data isolation flaw that allows authenticated users to create or modify issues within one workspace while secretly assigning them to projects in other workspaces. The vulnerability bypasses validation on the project_id parameter, enabling attackers to pollute project statistics and metrics across tenant boundaries without authorization. This is a privilege escalation and data integrity issue rather than a confidentiality breach, as the attacker cannot read data outside their workspace, only corrupt it.

• CVE-2026-58654MEDIUM 4.3

  The Grav API plugin version 1.0.0 has a flaw in how it handles avatar uploads. When a user uploads an avatar image, the system only checks the label that the browser sends (saying 'this is an image') but doesn't actually verify what the file really is. This means someone could upload malicious code — like a PHP script or a JavaScript-laden SVG file — disguised as an image. While the web server blocks direct access to these files via HTTP, they still exist on disk and could potentially be exploited if there are other weaknesses in the server setup or if attackers find creative ways to access them. The vulnerability was fixed in version 1.0.1.

• CVE-2026-58661MEDIUM 4.3

  n8n workflow automation platform versions before 2.28.0 (or 1.123.58 on the legacy 1.x branch) contain a disk space exhaustion vulnerability in file upload functionality. An authenticated attacker can repeatedly upload files through the data-table endpoint without triggering proper quota enforcement, causing files to accumulate in temporary storage until the system's periodic cleanup cycle runs. This can eventually consume all available disk space on the server, leading to service disruption. The vulnerability requires valid user credentials to exploit, limiting exposure to authenticated threat actors.

• CVE-2026-59217MEDIUM 4.3

  Open WebUI before version 0.10.0 contains an authorization bypass flaw that allows read-only users of a knowledge base to upload files and attach them to knowledge bases they shouldn't be able to modify. When users upload files, the application accepts a metadata parameter specifying which knowledge base to link the files to, but fails to check whether the uploading user actually has write access to that knowledge base. This lets lower-privilege users escalate their capabilities within the platform by injecting content into knowledge bases they can only read.

• CVE-2026-59223MEDIUM 4.3

  Open WebUI versions before 0.10.0 contain a flaw in how they validate domain blocklists used to control which external URLs can be fetched by the platform. An authenticated attacker can bypass these restrictions by manipulating the URL path or exploiting sibling-domain matching logic, potentially gaining access to internally restricted resources. The fix is available in version 0.10.0 and later.

• CVE-2026-59227MEDIUM 4.3

  Open WebUI, a self-hosted AI platform, contains an authorization bypass vulnerability in its image-editing API endpoint. Prior to version 0.10.0, any verified user could invoke server-side image editing operations without permission checks, even if administrators had disabled the feature globally or restricted it at the user level. This allowed non-admin users to consume server resources and leverage admin-configured AI provider credentials for image manipulation tasks they should not have access to.

• CVE-2026-5952MEDIUM 4.3

  GitLab has patched a privilege escalation weakness in its Community and Enterprise editions that allowed developers to bypass package protection rules and modify Maven package metadata they shouldn't have been able to access. The flaw required an authenticated account with developer permissions and affected versions 17.11 through 18.11.5, 19.0.0 through 19.0.2, and 19.1.0. Attackers couldn't steal data or crash systems, but they could alter package contents in repositories that should have been locked down.

• CVE-2026-59520MEDIUM 4.3

  CrawlWP SEO, a WordPress plugin for SEO crawling and analysis, contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. An attacker can craft a malicious webpage or email that, when visited by a logged-in administrator or user with relevant permissions, triggers unintended changes to the plugin's settings or configuration without the user's knowledge or consent. The vulnerability affects CrawlWP SEO versions up to and including 3.0.16.

• CVE-2026-59709MEDIUM 4.3

  Ghostfolio contains an authorization bypass vulnerability in its portfolio holding tag management feature. Users who are granted read-only access to a portfolio through share tokens can unexpectedly modify tags on holdings belonging to the portfolio owner. The vulnerability stems from improper permission validation when the system processes impersonation requests, allowing attackers to escalate their limited access rights to perform modification actions they should not be permitted to execute.

• CVE-2026-59930MEDIUM 4.3

  Mistune, a popular Python Markdown parser, contains a predictability flaw in how it generates anchor IDs for table-of-contents elements. Before version 3.3.0, the toc plugin and TableOfContents directive create heading IDs using a simple sequential pattern (toc_1, toc_2, etc.) without considering the actual heading text. An attacker who controls Markdown content can craft headings with matching IDs that collide with these predictable anchors, potentially redirecting users to unintended locations or interfering with page navigation and styling rules that depend on those IDs.

• CVE-2026-6277MEDIUM 4.3

  GitLab EE contains an authorization bypass that allows authenticated users with Security Manager role to modify project security settings even when that feature is supposed to be disabled. An attacker with this role can circumvent intended access controls to manage security configurations that should be locked down, potentially weakening project defenses.

• CVE-2026-6292MEDIUM 4.3

  The MP Customize Login Page WordPress plugin contains a CSRF vulnerability affecting all versions up to 1.0. An attacker can trick an administrator into visiting a malicious website that submits a forged request to change plugin settings—such as the login page background, logo, colors, and messages. The vulnerability exists because the plugin's nonce validation is inverted (it rejects valid requests instead of invalid ones) and missing a required parameter, making the security check completely ineffective. Unauthenticated attackers can exploit this without needing any special privileges.

• CVE-2026-6412MEDIUM 4.3

  CVE-2026-6412 is a medium-severity certificate handling issue in WolfSSL in which the library continues to accept SHA-1 and MD5 hashing algorithms when processing X.509 certificates, despite these algorithms being cryptographically obsolete and violating modern RFC 8446 (TLS 1.3) compliance requirements. An authenticated attacker could exploit this to bypass certificate validation controls, potentially enabling man-in-the-middle attacks or acceptance of fraudulent certificates within encrypted sessions. The vulnerability requires prior authentication and does not directly compromise confidentiality, but does introduce integrity risks through improper certificate chain validation.

• CVE-2026-6440MEDIUM 4.3

  The GoodMeet plugin for WordPress, which integrates Google Meet into sites, has a security flaw in versions 1.1.8 and earlier. An attacker can trick a site administrator into visiting a malicious link, which would silently delete the plugin's Google Meet API credentials. This doesn't directly expose sensitive data or let attackers log in, but it disables the Google Meet feature on the affected site and forces administrators to reconfigure it. The vulnerability exists because the plugin fails to use a security token (nonce) to verify that credential-reset requests are legitimate.

• CVE-2026-6689MEDIUM 4.3

  Mattermost has a permissions bypass vulnerability affecting multiple versions where authenticated users with team-creation rights can inappropriately configure invitation settings during team setup. Specifically, users lacking the PermissionInviteUser permission can set AllowOpenInvite (making a team publicly joinable) and AllowedDomains (restricting team membership to specific domains) during POST-based team creation—settings they would normally be blocked from configuring on existing teams. The vulnerability requires an authenticated account and results in unauthorized configuration of team access controls, not data disclosure or system failure.

• CVE-2026-7047MEDIUM 4.3

  The Frontend User Notes plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting all versions through 2.1.1. An attacker can craft a malicious webpage that, when visited by a logged-in WordPress user, silently overwrites that user's own notes without their knowledge or consent. The attack requires social engineering—tricking the victim into clicking a link or visiting a malicious site—but once successful, allows unauthorized modification of the victim's note content. Importantly, the vulnerability is self-contained: attackers cannot use it to tamper with other users' notes, only those belonging to the person they've tricked.

• CVE-2026-7492MEDIUM 4.3

  GitLab Community Edition and Enterprise Edition contain a flaw in how they control access to cross-project reference pages. An attacker with a valid GitLab login can query these pages to determine whether private projects exist—information that should remain hidden. The vulnerability affects many versions released over the past several years, though no unauthenticated exploitation path has been confirmed. GitLab has released patches for the most recent major versions.

• CVE-2026-7516MEDIUM 4.3

  A vulnerability in Lenovo's Android application for tablets sold in China allows websites visited through the device's built-in browser to manipulate the system clipboard. An attacker could craft a malicious website that, when visited, overwrites clipboard contents with arbitrary data—potentially redirecting a user's next paste action to unintended destinations or injecting malicious content into applications that rely on clipboard input.

• CVE-2026-7523MEDIUM 4.3

  The Alba Board plugin for WordPress contains a flaw that allows attackers to bypass access controls and view sensitive project information they shouldn't be able to see. An authenticated user with basic subscriber access can retrieve private card data—titles, descriptions, due dates, and comments—that should be restricted to administrators and editors only. More critically, the vulnerability can be exploited by unauthenticated site visitors if the Alba Board shortcode appears anywhere on the website, because the security token (nonce) is exposed in the page source. All versions up to and including 2.1.3 are affected.

• CVE-2026-7526MEDIUM 4.3

  The PDF Embedder plugin for WordPress contains a flaw that allows authenticated users with basic contributor permissions or higher to access sensitive configuration information. If the premium add-on is installed with a saved license key, that key can be exposed; on free installations, the exposure is limited to non-sensitive viewer settings like dimensions and toolbar options. An attacker would need valid WordPress login credentials at the contributor level or above to exploit this, but no user interaction or network complexity is required once authenticated.

• CVE-2026-7533MEDIUM 4.3

  The Easy Digital Downloads plugin for WordPress contains a security flaw that allows attackers to hijack a store's Square payment processing account. An attacker can send a malicious link to a WordPress administrator; if clicked while logged in, the link silently changes the store's Square payment credentials to attacker-controlled ones, redirecting future payments to the attacker. The vulnerability exists because the plugin does not verify that payment configuration requests come from legitimate, authorized actions—a standard web security practice called CSRF protection.

• CVE-2026-7621MEDIUM 4.3

  The SMTP2GO for WordPress plugin contains an authorization flaw that allows any logged-in user with subscriber-level permissions or higher to delete all SMTP email logs from the database or export sensitive email records to CSV format. This affects all versions up to 1.16.0 and exposes recipient addresses, sender information, message subjects, and API response data. An attacker with basic user access can perform these destructive and data-exfiltration actions without additional authentication checks.

• CVE-2026-7624MEDIUM 4.3

  The Squirrly SEO plugin for WordPress has an access control flaw that allows lower-privileged users to perform actions meant only for administrators. Specifically, a contributor-level user can disconnect the website from Google Search Console and Google Analytics by invoking backend API calls that should be blocked. This is a privilege escalation issue affecting all versions up to 12.4.16.

• CVE-2026-8422MEDIUM 4.3

  The Remove meta boxes per user role WordPress plugin contains a security flaw that allows attackers to change how meta boxes (content panels) are hidden or shown for different user roles on a WordPress site. An attacker can't do this directly, but by tricking a site administrator into clicking a malicious link, the attacker can force the admin's browser to make unauthorized changes to these visibility settings. The vulnerability affects all versions up to and including 1.01.

• CVE-2026-8472MEDIUM 4.3

  GitLab Enterprise Edition (EE) contains a flaw that allows authenticated users with minimal permissions to access sensitive work item metadata from private projects they shouldn't be able to view. The vulnerability stems from missing authorization checks in the application logic, meaning the system failed to properly verify whether a user had legitimate access before exposing this information. An attacker would need valid GitLab credentials and some level of access to the platform, but the actual permissions required are low, making this a concerning insider-risk scenario.

• CVE-2026-8480MEDIUM 4.3

  Stormshield Network Security contains a certificate validation flaw that allows attackers possessing revoked client certificates to bypass authentication controls and gain administrative access to the captive-admin portal. This affects multiple versions across the 4.3, 4.4–4.8, and early 5.0 release lines. An attacker on the local network with a previously valid but now-revoked certificate can authenticate as an administrator without current credentials or legitimate access rights.

• CVE-2026-8482MEDIUM 4.3

  StormShield Network Security contains a credential disclosure vulnerability affecting versions 4.3.0 through 4.3.41, 4.8.0 through 4.8.15, and 5.0.0 through 5.0.5. When administrative commands are executed via the CLI tool, sensitive authentication material—specifically the proxy Certificate Authority passphrase and TPM password—can be exposed to users with SSH access to the firewall. This risk materializes only when SSH multiuser mode is enabled, limiting the attack surface to environments where multiple administrative users share SSH credentials or access.

• CVE-2026-8611MEDIUM 4.3

  A WordPress plugin called Klamra Paycal for Aspaclaria contains a flaw that allows authenticated users with subscriber-level permissions to access and download invoices belonging to other customers. The vulnerability stems from insufficient access controls on invoice retrieval—an attacker can simply modify an invoice identifier in a request to view sensitive billing data from any customer, including names, email addresses, phone numbers, order amounts, and internal notes. No special privileges or user interaction are required beyond basic authenticated access.

• CVE-2026-8614MEDIUM 4.3

  The Assistio plugin for WordPress contains a vulnerability that allows authenticated users with basic Subscriber-level permissions to delete critical plugin settings, including OAuth configuration data. The vulnerability exists because the plugin fails to verify that a user has proper authorization and fails to include a security token (nonce) on the function that deletes settings. An attacker with even minimal WordPress account access can exploit this to break the plugin's connection to the Assistio bot service.

• CVE-2026-8682MEDIUM 4.3

  The 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On WordPress plugin contains a flaw that allows users with basic subscriber access to change critical plugin settings they should not be able to modify. An authenticated attacker can bypass authorization checks to write arbitrary data directly to the plugin's configuration stored in the database, potentially affecting how the 3D viewer and virtual try-on features function across the site.

• CVE-2026-8688MEDIUM 4.3

  The Advance Nav Menu Manager plugin for WordPress contains an authorization bypass flaw that allows low-privilege users—those with subscriber-level access or higher—to manipulate navigation menu items without proper permission checks. Attackers can duplicate, copy, move, or publish navigation items, potentially defacing site structure or injecting malicious navigation elements. The vulnerability stems from inadequate permission validation during menu item operations and affects all versions up to and including 1.3.

• CVE-2026-8689MEDIUM 4.3

  The Visualizer: Tables and Charts Manager WordPress plugin contains an authorization bypass flaw that allows logged-in users with minimal privileges (Subscriber level and above) to create chart posts without proper permission checks and to view or modify charts belonging to other users, including site administrators. The vulnerability affects all versions through 3.11.14 and stems from missing capability validation in two critical AJAX functions. While the flaw requires an authenticated account, the low barrier to entry and potential for unauthorized data access make it a meaningful risk for multi-user WordPress installations.

• CVE-2026-8902MEDIUM 4.3

  The AJAX Report Comments plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 2.0.4. An attacker can trick a WordPress site administrator into unknowingly changing critical plugin settings—such as notification email addresses, comment thresholds, success messages, and cookie durations—by crafting a malicious link or webpage. The attack requires social engineering to get an admin to click a link, but once successful, the attacker can alter how the plugin behaves without any authentication.

• CVE-2026-8904MEDIUM 4.3

  The FastPicker plugin for WordPress, which integrates order picking and management capabilities with WooCommerce, contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 1.0.2. An attacker cannot exploit this vulnerability directly; instead, they must trick a WordPress site administrator into clicking a malicious link while logged in. If successful, the attacker can alter critical plugin settings—including webhook toggles and API endpoint URLs for FastPicker and KDZ services—without the administrator's knowledge or consent. This is a configuration-tampering risk rather than a direct data breach vector.

• CVE-2026-8909MEDIUM 4.3

  The WpMobi WordPress plugin contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick administrators into modifying plugin settings and injecting malicious scripts. An unauthenticated attacker can craft a malicious link or webpage that, when clicked by a site admin, silently changes the plugin's General Settings without the admin's knowledge or consent. The vulnerability is particularly concerning because the injected script executes in the admin's browser even when the malicious input fails validation, meaning the attack works regardless of server-side data checks.

• CVE-2026-8940MEDIUM 4.3

  The WP Meta Sort Posts WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to 0.9. An attacker can craft a malicious link or webpage that, when clicked by an administrator, silently changes plugin settings without their knowledge or consent. Specifically, the vulnerability allows modification of the msp_loop_file and msp_nav_location settings. This is possible because the plugin fails to properly validate security tokens (nonces) on the options page. The attack requires social engineering to trick an admin into clicking a link, but once successful, can alter how the plugin sorts and displays posts on the website.

• CVE-2026-8944MEDIUM 4.3

  A WordPress plugin called 'Plugin for Google Analytics by IO technologies' (versions 1.1 and earlier) fails to properly validate requests made to its settings page. This allows an attacker to trick a site administrator into clicking a malicious link that would change the plugin's Google Analytics tracking ID without the admin's knowledge or consent. The attacker cannot see sensitive data or crash the site, but can redirect analytics to their own account, potentially allowing them to spy on site traffic.

• CVE-2026-8976MEDIUM 4.3

  The RSS Aggregator by Feedzy plugin for WordPress fails to properly verify user permissions, allowing contributors and higher-level users to perform administrative actions they shouldn't be able to access. An authenticated attacker with basic contributor rights can create RSS import jobs, delete all posts from any import, clear error logs, and view sensitive taxonomy and post metadata information. The vulnerability is particularly dangerous because the security token needed to perform these actions is automatically exposed to anyone who can edit posts through the block editor interface—no additional hacking or theft is required.

• CVE-2026-8995MEDIUM 4.3

  The Poll Maker – Versus Polls plugin for WordPress has a flaw that lets logged-in users see sensitive account information they shouldn't access, including password hashes. The vulnerability stems from an AJAX endpoint that returns the entire WordPress user object without proper security checks. Any subscriber or higher can call this endpoint and retrieve not just their own data, but potentially others' account details including email addresses, registration dates, roles, and capabilities. While the exposure doesn't immediately compromise an account, the password hash data could be targeted by offline cracking attempts.

• CVE-2026-9008MEDIUM 4.3

  The Page-list plugin for WordPress contains an authorization flaw in its shortcode feature that allows authenticated users with contributor-level or higher permissions to view sensitive content they shouldn't be able to access. By inserting a specially crafted shortcode into a draft post and previewing it, attackers can extract titles, body text, and metadata from private or draft pages across the entire site. The vulnerability exists because the plugin doesn't verify whether the current user is permitted to view the pages being queried.

• CVE-2026-9013MEDIUM 4.3

  The Bogo WordPress plugin contains a flaw that allows authenticated users with basic subscriber-level permissions or higher to read sensitive content from private, draft, and password-protected posts on a site. An attacker exploits this by requesting a translation of a post they shouldn't have access to, then extracting the raw text from the duplicated version that the translation feature creates. The vulnerability is most impactful when the attacker has contributor-level access, since that's when they can actually view the exposed content. Any WordPress site using Bogo version 3.9.1 or earlier is potentially at risk.

• CVE-2026-9015MEDIUM 4.3

  The Equalize Digital Accessibility Checker plugin for WordPress contains a flaw that allows users with basic subscriber access to modify accessibility audit findings they shouldn't be able to touch. An authenticated attacker can change whether issues are marked as ignored, alter the reason for ignoring them, and add comments to any accessibility finding on the site. In some cases, they can perform bulk modifications across multiple related findings at once. This means someone with minimal privileges could systematically hide or dismiss accessibility compliance problems, undermining the integrity of WCAG and ADA audit records without proper authorization.

• CVE-2026-9048MEDIUM 4.3

  Slider Revolution, a popular WordPress plugin, contains a vulnerability that allows authenticated users with basic contributor privileges to view sensitive social media API credentials through a specific AJAX action. An attacker with contributor-level access or higher can call the 'slider.get.full' AJAX action to retrieve raw API tokens and keys—including Instagram OAuth tokens, Flickr API keys, YouTube Data API credentials, and Facebook App IDs—that have been configured within slider settings. This exposure affects plugin versions 7.0.0 through 7.0.14.

• CVE-2026-9050MEDIUM 4.3

  Slider Revolution, a popular WordPress plugin, contains a flaw that allows contributors and higher-privileged users to disable any plugin on a WordPress site without proper authorization checks. An attacker with basic contributor access—a common account level in multi-author sites—can leverage this to shut down security plugins, backup solutions, or other critical extensions. The vulnerability affects versions 6.0.0 through 6.7.55 and 7.0.0 through 7.0.14.

• CVE-2026-9162MEDIUM 4.3

  Mattermost has a session management flaw affecting versions 11.7.0, 11.6.2 and earlier, 11.5.5 and earlier, and 10.11.17 and earlier. When an administrator revokes a user's global session—such as during offboarding or after detecting unauthorized access—the system fails to immediately disconnect active WebSocket connections used for real-time messaging and notifications. An attacker or departing employee with an existing connection can remain authenticated and continue receiving live team communications until their cached session naturally expires or they manually reconnect. This is a persistence risk in environments where rapid session termination is critical for security or compliance.

• CVE-2026-9183MEDIUM 4.3

  The 24liveblog WordPress plugin leaks sensitive API credentials to authenticated users with basic contributor access or higher. When these users open the WordPress block editor, the plugin inadvertently exposes authentication tokens and account identifiers as JavaScript data embedded in the page source. An attacker with even minimal WordPress account privileges can view this sensitive information by inspecting the browser's page source, gaining unauthorized access to the site's 24liveblog integration account.

• CVE-2026-9184MEDIUM 4.3

  The 24liveblog WordPress plugin fails to properly validate who is making certain administrative requests, allowing logged-in authors and higher-privilege users to hijack the plugin's connection to the 24liveblog service. An attacker with author-level access can inject false credentials that redirect the plugin to use the attacker's 24liveblog account instead of the legitimate site owner's, or alternatively overwrite administrator accounts' tokens to lock them out of the integration.

• CVE-2026-9199MEDIUM 4.3

  The Equalize Digital Accessibility Checker WordPress plugin contains a flaw that allows authors and higher-privileged users to manipulate accessibility audit records on the entire site, not just their own posts. An attacker with author-level access can use an accessibility issue from one of their posts as a 'skeleton key' to dismiss, ignore, or restore similar issues site-wide—including those attached to administrator posts. While this doesn't grant direct read access to sensitive data, it enables unauthorized modification of critical compliance records, undermining audit integrity.

• CVE-2026-9228MEDIUM 4.3

  A WordPress plugin called Timetable and Event Schedule by MotoPress has a flaw that allows users with contributor-level access or higher to see confidential information they shouldn't have access to. Specifically, they can view drafts, pending reviews, and private event posts created by other users, including the content, excerpts, and author information. The vulnerability stems from the plugin failing to properly validate user input when retrieving event data, making it possible to directly access posts by guessing or enumerating their IDs.

• CVE-2026-9230MEDIUM 4.3

  The Quiz and Survey Master plugin for WordPress contains a flaw that allows users with contributor-level permissions (or higher) to modify quizzes owned by other users, alter quiz result pages, and redirect notification emails to addresses they control. The vulnerability stems from incomplete permission checks when users attempt to modify quiz configurations. An attacker exploits this by first retrieving a valid authentication token from one quiz, then reusing it to gain unauthorized access to another user's quiz settings.

• CVE-2026-9233MEDIUM 4.3

  The Quiz and Survey Master plugin for WordPress has a flaw that allows users with basic contributor permissions (or higher) to manipulate quiz output templates in ways they shouldn't be able to. An authenticated attacker can create, modify, or delete templates and inject unfiltered HTML and scripts into them. While the vulnerability requires an existing WordPress account, it sidesteps proper permission checks that should prevent lower-privilege users from touching these administrative templates.

• CVE-2026-9234MEDIUM 4.3

  The JTL-Connector for WooCommerce plugin contains authorization flaws that allow low-privileged WordPress users (Subscriber level and above) to perform administrative actions without proper permission checks. Specifically, attackers can change plugin configuration, download sensitive log files containing developer information, and delete those logs. This bypasses WordPress's built-in permission model and could lead to configuration tampering or information disclosure.

• CVE-2026-9235MEDIUM 4.3

  The DHL eCommerce (Benelux) for WooCommerce plugin contains a flaw that allows low-privileged users to create or delete shipping labels for any order in a WooCommerce store. An attacker with even a basic Subscriber account can manipulate shipping operations belonging to other customers or administrators, disrupting order fulfillment and potentially causing financial or operational harm. The vulnerability exists because the plugin fails to verify user permissions and prevent cross-site request forgery attacks on these sensitive functions.

• CVE-2026-9237MEDIUM 4.3

  A flaw in the Crew HRM WordPress plugin (versions up to 1.2.2) allows any logged-in user with basic subscriber access to delete, modify, or duplicate job listings that belong to other users or the organization. The vulnerability exists because the plugin fails to verify whether a user actually has permission to perform these actions. Additionally, the security token the plugin relies on to prevent unauthorized requests is accidentally exposed to all logged-in visitors, making it trivial for attackers to bypass the intended safeguard.

• CVE-2026-9240MEDIUM 4.3

  The Colissimo Officiel shipping plugin for WooCommerce has a flaw that allows any authenticated user—even those with basic Subscriber access—to modify shipping details on orders that don't belong to them. An attacker can change the shipping method, pickup point, or delivery address for any order in the system without needing special permissions or providing a security token. This is a privilege escalation issue: an attacker with minimal account rights gains the ability to tamper with fulfillment data across the entire store.

• CVE-2026-9241MEDIUM 4.3

  The FOX – Currency Switcher Professional for WooCommerce plugin contains a flaw that lets authenticated users trick the system into thinking they have higher privileges than they actually do. By manipulating a request parameter, a subscriber-level user can impersonate a wholesale customer or administrator to access pricing they shouldn't be able to see. This only matters if your store uses the fixed user-role pricing feature and has set special prices for privileged customer types.

• CVE-2026-9599MEDIUM 4.3

  The Tectite Forms plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 1.3. An attacker can trick a site administrator into clicking a malicious link, which then allows the attacker to change the plugin's settings without the administrator's knowledge. This could include modifying the tectite_forms_button option or other plugin configurations. The vulnerability requires social engineering but poses a real risk to WordPress sites using this plugin.

• CVE-2026-9616MEDIUM 4.3

  The Generate Security.txt plugin for WordPress has an authorization flaw that allows any logged-in subscriber (or higher-privilege user) to delete the site's security.txt file or create a .well-known directory without proper permission checks. An attacker with even basic subscriber access can invoke these actions directly through the plugin's AJAX endpoints, bypassing intended access controls. This affects all versions up to and including 1.0.12.

• CVE-2026-9618MEDIUM 4.3

  The PeachPay plugin for WordPress, which integrates payment processing for Stripe, PayPal, Square, and other providers, contains a cross-site request forgery (CSRF) vulnerability in all versions up to 1.120.46. An attacker can craft a malicious link or webpage that, when clicked by a site administrator, silently deletes all stored Stripe credentials from the site's database without the administrator's knowledge or consent. This disables Stripe payments immediately and requires the administrator to reconfigure the integration. The attack requires social engineering to trick an admin into clicking the link, but requires no special authentication or technical sophistication once the admin takes the bait.

• CVE-2026-9619MEDIUM 4.3

  The Reviews and Rating – Docplanner plugin for WordPress contains a flaw that allows any logged-in user with subscriber-level permissions or higher to perform actions they shouldn't be able to do. Specifically, attackers can make the plugin fetch content from external websites without authorization, store that scraped data in the WordPress database, and send emails impersonating the site administrator. This requires an attacker to already have legitimate WordPress access, but the damage they can inflict goes well beyond what a normal subscriber should control.

• CVE-2026-9676MEDIUM 4.3

  A flaw in the F4 Post Tree WordPress plugin versions prior to 2.0.5 allows authenticated users with basic Subscriber privileges to restructure posts without proper authorization checks. The vulnerability stems from missing security verification (capability checks and CSRF tokens) on an AJAX endpoint, meaning any logged-in user can rearrange the parent post relationships and menu ordering of any post in the system—even content created by administrators or belonging to restricted sections.

• CVE-2026-9719MEDIUM 4.3

  The LatePoint WordPress plugin, which handles calendar booking and appointment scheduling, contains a security flaw that allows attackers to manipulate invoice statuses without proper authorization. An attacker can craft a malicious link or webpage and, if they trick a WordPress administrator into clicking it, change the status of any invoice—including fraudulently marking unpaid invoices as paid. This works because the plugin fails to properly validate requests before processing status changes.

• CVE-2026-9721MEDIUM 4.3

  The Book a Room Event Calendar WordPress plugin fails to protect its settings page against Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious webpage or email that, when clicked by a site administrator, silently changes critical plugin configuration—including database host, credentials, encryption keys, and registration URLs—without the administrator's knowledge or consent. All versions up to 1.9 are affected. The vulnerability requires social engineering (tricking an admin to click a link) but carries no additional barriers once that click happens.