By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 40 of 41

• CVE-2026-9722MEDIUM 4.3

  The Laiser Tag plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting all versions through 1.2.5. An attacker can craft a malicious link or webpage that, when clicked by a site administrator, silently modifies critical plugin settings without the administrator's knowledge or consent. This includes changes to API keys, tag filtering rules, and tagging behavior—settings that directly control how the plugin functions across the site.

• CVE-2026-9723MEDIUM 4.3

  The Google Plus One Bottom plugin for WordPress contains a cross-site request forgery (CSRF) flaw that allows attackers to manipulate plugin settings without proper authorization. An attacker can craft a malicious link or web page that, when clicked by a site administrator, will change critical plugin configuration options—such as language preferences, callback functions, and URLs—without the administrator's knowledge or consent. This attack requires social engineering to trick an admin into clicking the malicious link, but requires no authentication or technical exploit code to execute.

• CVE-2026-9724MEDIUM 4.3

  The MotorDesk plugin for WordPress has a cross-site request forgery (CSRF) vulnerability that allows an attacker to trick a site administrator into unwittingly changing the plugin's settings. By crafting a malicious link or webpage, an unauthenticated attacker can alter critical configuration like the search page URI and custom template directory path if they can convince an admin to click a link while logged in. The vulnerability affects all versions up to and including 1.1.2 and requires social engineering but poses a real risk to site integrity and functionality.

• CVE-2026-9730MEDIUM 4.3

  The Remove NoFollow Commenter URL plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows unauthenticated attackers to change how the plugin displays comments. An attacker can craft a malicious link or webpage that, when clicked by a WordPress site administrator, silently modifies the plugin's comment settings without the administrator's knowledge or consent. This requires social engineering to trick an admin into visiting the attacker's content, but requires no special technical skills to exploit once that condition is met.

• CVE-2026-9731MEDIUM 4.3

  The Wp Js Detect plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows attackers to manipulate plugin settings without proper authorization. By tricking a site administrator into clicking a malicious link, an attacker can change the plugin's notification text and CSS settings, then inject harmful content that appears on the website to visitors. The vulnerability affects all versions up to 1.0.9 and requires no special privileges or technical sophistication to exploit.

• CVE-2026-9732MEDIUM 4.3

  The EmergencyWP plugin for WordPress has a security flaw that allows attackers to change important plugin settings without authorization. An attacker would need to trick a WordPress site administrator into clicking a malicious link, but if successful, they could alter access controls, email addresses, and other critical configurations. This is a cross-site request forgery (CSRF) vulnerability caused by the plugin failing to properly validate requests before processing them.

• CVE-2026-9791MEDIUM 4.3

  An authenticated user who belongs to a Keycloak organization can request tokens or access APIs in ways that expose organization metadata, even after an administrator has turned off the Organizations feature. This metadata leakage could cause downstream applications (resource servers) to make incorrect access control decisions based on stale or unintended organization information.

• CVE-2026-9798MEDIUM 4.3

  Keycloak's account lockout feature, which temporarily disables accounts after repeated failed login attempts, can be bypassed when an attacker possesses valid client credentials. By using the Client-Initiated Backchannel Authentication (CIBA) flow—a legitimate OAuth 2.0 feature—attackers can circumvent the lockout and continue attempting to authenticate or obtain tokens. This undermines brute-force protection and creates a secondary path for unauthorized access once the attacker has obtained initial client credentials.

• CVE-2026-9807MEDIUM 4.3

  GitLab has patched a flaw in its Community and Enterprise editions where a Project Access Token that was supposed to be blocked could still access private project resources. This happened because the authorization checks weren't applied correctly when a token was revoked or blocked. An authenticated user with permissions to create or manage tokens could potentially exploit this before the fix was released, though the vulnerability requires prior login access and the attacker would need knowledge of or ability to create a blocked token.

• CVE-2026-9857MEDIUM 4.3

  The Invoice123 WordPress plugin contains a flaw that allows users with basic subscriber accounts to make unauthorized changes to critical invoice and payment settings. Specifically, attackers can replace the plugin's API key, reconfigure invoice settings, and modify tax rate information in WooCommerce—actions they should not be able to perform. This vulnerability affects all versions up to and including 1.7.0 and requires no special technical knowledge to exploit, only valid WordPress login credentials at the subscriber level or higher.

• CVE-2026-9907MEDIUM 4.3

  A memory read vulnerability in Google Chrome's Dawn graphics component allows attackers to access sensitive data from different website origins. An attacker can craft a malicious web page that, when visited by a user, tricks Chrome into reading memory beyond intended boundaries and leaking information from other websites the user may have open. This affects Windows systems running Chrome versions prior to 148.0.7778.216.

• CVE-2026-9911MEDIUM 4.3

  CVE-2026-9911 is a memory safety issue in the ANGLE graphics library used by Google Chrome. When a user visits a specially crafted webpage, an attacker can read small amounts of sensitive data from the browser's memory. The vulnerability requires user interaction—visiting the malicious page—but needs no special permissions or browser configuration to exploit. While the data exposure is limited in scope, it could leak sensitive information like passwords, tokens, or cached credentials stored in memory.

• CVE-2026-9913MEDIUM 4.3

  A flaw in the ANGLE graphics library component of Google Chrome prior to version 148.0.7778.216 could allow an attacker to access memory outside intended bounds when a user visits a malicious website. The vulnerability requires user interaction (visiting a crafted page) but does not require special privileges. Potential impacts include disclosure of sensitive information, though the attacker cannot modify data or crash the browser directly through this flaw.

• CVE-2026-9919MEDIUM 4.3

  A WebGL processing flaw in Google Chrome for Android allows attackers to read data they shouldn't have access to by tricking users into visiting a malicious webpage. The vulnerability exists in how Chrome handles certain graphics operations and can leak information across website boundaries, but only affects the Android version of Chrome and requires user interaction to exploit.

• CVE-2026-9921MEDIUM 4.3

  Google Chrome on Android contains a flaw in its WebGL graphics processing where memory buffers may not be properly initialized before use. An attacker can exploit this by crafting a malicious HTML page that, when visited, allows them to read sensitive information from other websites—a cross-origin data leak. The vulnerability requires user interaction (clicking a link or viewing a page) but does not require special privileges or complex attack setup.

• CVE-2026-9929MEDIUM 4.3

  A flaw in how Google Chrome on Android handles WebGL—a technology that enables 3D graphics in web browsers—could allow an attacker to trick a user into visiting a malicious webpage and expose data from other websites the user has open. The attacker cannot force this to happen; the user must interact with the page, such as by clicking or scrolling. This is a cross-origin data leak, meaning sensitive information from one domain could become visible to JavaScript code running on an attacker's domain.

• CVE-2026-9930MEDIUM 4.3

  An out-of-bounds write vulnerability exists in the Dawn graphics component of Google Chrome on macOS. An attacker can craft a malicious HTML page that, when viewed by a user, writes data to memory locations outside the intended bounds of a buffer. This memory corruption could allow an attacker to modify sensitive data or potentially achieve code execution, though the CVSS assessment indicates the integrity impact is limited. The vulnerability requires user interaction—the victim must visit or be directed to the malicious page—and affects Chrome versions prior to 148.0.7778.216 on macOS.

• CVE-2026-9935MEDIUM 4.3

  CVE-2026-9935 is a memory safety issue in Google Chrome's ANGLE graphics library that allows attackers to steal sensitive data from other websites. When you visit a malicious webpage, an attacker can craft it to leak information that should be isolated to other sites you have open. The vulnerability requires user interaction—you must visit the attack page—but the bar for exploitation is otherwise low. Google has classified this as High severity internally, though the CVSS score reflects a more limited scope.

• CVE-2026-9943MEDIUM 4.3

  A memory access flaw in Google Chrome's WebGL implementation on Android allows attackers to read data from other websites through a specially crafted web page. When a user visits the malicious page, the attacker can extract information (such as authentication tokens, session cookies, or sensitive content) from sites the user is logged into. This is a cross-origin data leak—meaning the attacker can access information meant to be isolated to other domains.

• CVE-2026-9955MEDIUM 4.3

  A vulnerability in Google Chrome on iOS versions before 148.0.7778.216 allows attackers to extract sensitive information from websites the user visits. An attacker would craft a malicious webpage and trick a user into visiting it; the page can then read data intended to be private to other websites. This is a cross-origin data leak—a violation of the browser's same-origin policy that normally prevents websites from accessing each other's information.

• CVE-2026-10640MEDIUM 4.2

  Zephyr RTOS contains a use-after-free vulnerability in its IPv6 Neighbor Discovery implementation. When a Zephyr device sends IPv6 neighbor advertisement or solicitation messages, the code attempts to update traffic statistics after the network packet has already been freed by the underlying driver. An attacker on the same network segment can trigger this flaw by sending crafted ICMPv6 packets, potentially causing the device to crash or corrupt memory. The vulnerability affects Zephyr versions 3.3.0 through 4.4.0 and requires no authentication—any adjacent device can trigger it.

• CVE-2026-10644MEDIUM 4.2

  A flaw in Microchip's SERCOM-G1 UART driver for PIC32CM-JH microcontrollers causes a one-byte memory write immediately after a receive buffer when asynchronous DMA reception is enabled with a minimal buffer size. An attacker with access to the serial interface can supply data that overwrites one byte in adjacent memory, potentially crashing the device or causing localized corruption. The vulnerability requires specific configuration (async UART mode and single-byte buffer usage) that is not enabled by default, limiting its immediate risk in most deployments.

• CVE-2026-11479MEDIUM 4.2

  A weakness in the grepai hash implementation allows authenticated users to manipulate how files are indexed and chunked in the Qdrant backend, potentially corrupting data integrity or availability. The vulnerability requires login credentials and involves complex exploitation techniques, making opportunistic attacks unlikely. A fix has been proposed but not yet merged into the main codebase.

• CVE-2026-11570MEDIUM 4.2

  A WordPress plugin called User Submitted Posts has a security flaw where user-supplied content isn't properly cleaned before being displayed on the website. This allows attackers to inject malicious code that gets stored and executed in the browsers of site visitors—but only if the site administrator has enabled a non-default display option. The attack requires user interaction (like clicking a link) and cannot affect the site's availability or steal passwords, but it can compromise user sessions or steal sensitive information visible to those users.

• CVE-2026-12453MEDIUM 4.2

  Google Chrome versions before 149.0.7827.155 contain a flaw where insufficient input validation allows an attacker who has already compromised the browser's renderer process to circumvent the same-origin policy through a specially crafted webpage. This means a sandboxed renderer could potentially access or modify data from websites it should not be able to reach, though the attacker must first gain control of the renderer itself—a significant prerequisite.

• CVE-2026-12456MEDIUM 4.2

  A vulnerability in how Google Chrome handles extensions before version 149.0.7827.155 allows a malicious extension to bypass the same-origin policy, which normally prevents web pages from accessing data belonging to other websites. An attacker would need to trick a user into installing a specially crafted malicious extension. If successful, the extension could read or modify sensitive information from other websites the user visits. This is a user-consent attack—the user must be socially engineered into installing the extension first.

• CVE-2026-12457MEDIUM 4.2

  Google Chrome versions prior to 149.0.7827.155 contain a flaw in how extensions are implemented that allows an attacker who has already compromised Chrome's renderer process to escape the site isolation sandbox and access content from different websites. Site isolation is Chrome's core defense that prevents malicious code running on one site from stealing data from another. This vulnerability requires the attacker to have already gained code execution in the renderer—a significant prerequisite—but if achieved, it undermines that critical isolation boundary.

• CVE-2026-12460MEDIUM 4.2

  Google Chrome versions prior to 149.0.7827.155 contain a weakness in how the browser enforces file system access policies. An attacker who has already compromised Chrome's renderer process (the part that executes web content) can exploit this flaw by serving a specially crafted PDF file to bypass Site Isolation—Chrome's security feature that isolates web content from different sites. The vulnerability requires both an existing renderer compromise and user interaction, limiting its standalone exploitability but reflecting a real protection gap once a renderer is already under attacker control.

• CVE-2026-13024MEDIUM 4.2

  Google Chrome versions prior to 149.0.7827.197 contain a flaw in how it validates user input during navigation operations. An attacker who has already compromised Chrome's renderer process—the component that interprets and displays web content—can exploit this weakness to bypass Chrome's site isolation security feature. Site isolation is a critical defense that prevents malicious websites from accessing data belonging to other sites. This vulnerability requires an attacker to have already gained control of the renderer process, making it a secondary attack that follows initial compromise.

• CVE-2026-13218MEDIUM 4.2

  KubeVirt's virt-handler component contains a symlink-following vulnerability in its network cache handling. When virt-handler writes cached network configuration files, it does not validate whether the target path is a symlink. An attacker with access to a virt-launcher container can plant a symlink at the expected cache file location, tricking virt-handler into overwriting an arbitrary file on the host system and changing its ownership. This is a local privilege escalation vector that requires container-level access to exploit but can impact the integrity of host system files.

• CVE-2026-13857MEDIUM 4.2

  A flaw in Google Chrome's geometry rendering engine allows an attacker to trick users into performing specific on-screen gestures—such as clicking or dragging in particular areas—which enables UI spoofing. By hosting a malicious HTML page, an attacker can make the browser display fake interface elements that appear legitimate, potentially deceiving users into taking unintended actions. The vulnerability requires user interaction and affects Chrome versions before 150.0.7871.47.

• CVE-2026-13860MEDIUM 4.2

  Google Chrome on Windows contains a flaw in its Autofill security user interface that allows an attacker to trick users into performing specific gestures on a malicious webpage, resulting in UI spoofing. The vulnerability requires user interaction and does not lead to information disclosure, but can allow an attacker to manipulate what appears on screen or degrade application availability. Chrome versions prior to 150.0.7871.47 on Windows are affected.

• CVE-2026-13895MEDIUM 4.2

  Google Chrome's autofill feature contained a flaw that could allow an attacker to trick users into performing specific actions on a malicious webpage, creating a false appearance of legitimate browser or website content. The vulnerability requires user interaction and is considered moderately severe. Google Chrome versions prior to 150.0.7871.47 are affected.

• CVE-2026-13905MEDIUM 4.2

  Google Chrome for iOS contains a race condition that could allow an attacker with physical access to an iOS device to read sensitive information from the browser's process memory. The vulnerability requires the attacker to be present at the device and involves timing-sensitive manipulation, making opportunistic exploitation difficult. This affects Chrome versions before 150.0.7871.47 on iOS.

• CVE-2026-13907MEDIUM 4.2

  Google Chrome on iOS contains a user interface spoofing vulnerability that could allow an attacker to deceive users into believing they are interacting with legitimate content when they are not. The vulnerability requires the attacker to convince a user to perform specific gestures on a crafted webpage, but does not require the user to have special privileges or for the attacker to have prior network access. Patches are available in Chrome 150.0.7871.47 and later.

• CVE-2026-13956MEDIUM 4.2

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the PageInfo security UI displays information to users. An attacker can craft a malicious HTML page that, when shown to a user alongside specific browser interactions, tricks the user into believing they're interacting with legitimate security information. The attacker must convince the user to perform certain UI gestures to make the spoofing work. The impact is limited to tampering with what the user sees on screen, not to stealing data or causing system crashes.

• CVE-2026-13957MEDIUM 4.2

  Google Chrome versions before 150.0.7871.47 contain a security UI flaw in its Extensions feature that allows attackers to execute unauthorized scripts or inject HTML content into web pages—a technique called Unsafe Cross-Site Scripting (UXSS). The attack requires two conditions: first, an attacker must trick a user into installing a malicious browser extension, and second, the user must visit a specially crafted webpage. Once those conditions are met, the attacker gains the ability to run arbitrary code within the browser's rendering context.

• CVE-2026-13973MEDIUM 4.2

  Google Chrome versions before 150.0.7871.47 contain a UI implementation flaw that allows attackers to display fake interface elements—like fake login prompts or warning dialogs—if they can trick users into specific mouse or keyboard interactions on a malicious website. The attacker cannot steal data directly, but can confuse users into revealing passwords or credentials by making the fake UI look legitimate.

• CVE-2026-13983MEDIUM 4.2

  A vulnerability in Chrome on iOS allows attackers to trick users into believing they are visiting a legitimate website by spoofing the Omnibox (the URL bar that displays the website address). An attacker would need to convince a user to perform specific UI gestures—such as particular taps or swipes—on a crafted webpage to trigger the spoofing. The attack does not grant access to sensitive data but can mislead users about which site they are actually visiting, potentially leading to credential theft or other social engineering attacks. This affects Chrome for iOS versions prior to 150.0.7871.47.

• CVE-2026-13986MEDIUM 4.2

  A flaw in Google Chrome's Media UI on ChromeOS allows an attacker to deceive users through visual spoofing. By crafting a malicious webpage and convincing a user to perform specific gestures (such as clicks or interactions with media controls), an attacker can make the browser display fake UI elements that trick the user into taking unintended actions. This is a user-interaction dependent vulnerability with limited scope—it doesn't enable direct system compromise but can facilitate phishing, credential theft, or social engineering attacks.

• CVE-2026-13992MEDIUM 4.2

  Google Chrome on macOS contains a UI implementation flaw that allows attackers to create convincing fake interface elements—a technique known as UI spoofing. An attacker would need to host a malicious webpage and convince a user to interact with specific interface elements in a particular way to trigger the vulnerability. The flaw affects Chrome versions prior to 150.0.7871.47 on macOS. While the attack requires user interaction and deliberate UI manipulation, it can lead to confusion about application state or permissions, potentially tricking users into unintended actions.

• CVE-2026-13993MEDIUM 4.2

  Google Chrome versions before 150.0.7871.47 contain a flaw in how it displays security warnings during Web App installation. An attacker can craft a malicious webpage that, when a user performs specific interactions (like clicking or gesturing in a particular way), tricks the browser into displaying a misleading security UI. This allows the attacker to spoof a domain—making it appear that a trusted site is actually the attacker's site—potentially deceiving users into entering credentials or trusting malicious content. The attack requires deliberate user interaction and doesn't directly compromise data or system availability, but it can deceive users about what website they're interacting with.

• CVE-2026-13997MEDIUM 4.2

  Google Chrome on Android contains a flaw in how it displays security warnings for browser extensions. An attacker can craft a malicious webpage that tricks users into performing certain taps or swipes, making the extension security UI appear different than it actually is. This deception (called UI spoofing) could lead users to install or interact with harmful extensions without realizing the danger. The vulnerability requires the attacker to convince a user to perform specific gestures, which makes it moderately difficult to exploit in the wild.

• CVE-2026-13998MEDIUM 4.2

  Google Chrome on macOS contains a flaw in how it displays security warnings when users interact with file input controls. An attacker could craft a deceptive web page that, when a user performs certain mouse or keyboard actions, disguises malicious activity as a legitimate system dialog. This allows the attacker to trick users into believing they are interacting with Chrome's genuine security interface rather than attacker-controlled content. The vulnerability requires user interaction and specific gestures to exploit, limiting its immediate risk but still representing a meaningful social engineering vector.

• CVE-2026-14026MEDIUM 4.2

  Google Chrome versions before 150.0.7871.47 contain a UI security flaw in the SplitView feature that allows an attacker to trick users into performing certain click or gesture actions on a specially crafted webpage. When exploited, the vulnerability enables UI spoofing—displaying false security indicators or interface elements that mislead the user about what is actually happening in the browser. This could be used in social engineering attacks where an attacker makes the browser appear to show something it isn't, such as a fake security warning or address bar state.

• CVE-2026-14028MEDIUM 4.2

  A flaw in Chrome for iOS versions before 150.0.7871.47 can be exploited to show users fake security or interface elements. An attacker would need to craft a malicious webpage and convince the user to perform specific touch gestures—such as tapping in particular ways—to trigger the spoofing. The vulnerability doesn't directly steal data or crash the browser, but it could deceive users into thinking they're interacting with legitimate Chrome UI when they're actually viewing attacker-controlled content.

• CVE-2026-14030MEDIUM 4.2

  A vulnerability in Google Chrome's SplitView feature on Linux allows an attacker to trick users into believing they are visiting a legitimate website by spoofing the address bar. This happens when a user performs certain UI interactions with a malicious webpage. The flaw affects Chrome versions before 150.0.7871.47 and requires user interaction to exploit, making it a limited but real risk to users who fall for social engineering.

• CVE-2026-14129MEDIUM 4.2

  Google Chrome on Android contains a flaw in how it displays the preview tab interface that allows an attacker to trick users into thinking they're interacting with legitimate content when they're actually looking at a spoofed version. An attacker would need to craft a malicious webpage and convince a user to perform specific touch gestures (like swiping or tapping in particular ways) to trigger the vulnerability. The impact is limited but real: users could be misled about what content they're viewing or interacting with.

• CVE-2026-14133MEDIUM 4.2

  A race condition in Google Chrome's history embeddings feature could allow an attacker to trick users into seeing fake browser UI elements through a specially crafted webpage. The vulnerability requires user interaction and is difficult to exploit reliably, but successful exploitation could lead to minor information disclosure or allow the attacker to manipulate what the user sees on screen. Chrome versions before 150.0.7871.47 are affected.

• CVE-2026-14137MEDIUM 4.2

  A vulnerability in Chrome for iOS allows attackers to trick users into performing specific gestures on a crafted webpage, resulting in fake UI elements appearing to come from Chrome itself. This 'UI spoofing' attack could mislead users about the source or nature of content they're interacting with, though the underlying browser functionality and user data remain protected. The attack requires user interaction and is rated Medium severity.

• CVE-2026-14138MEDIUM 4.2

  Google Chrome on Windows contains a UI spoofing vulnerability in its WebAppInstalls feature that could allow an attacker to deceive users through a specially crafted webpage. The vulnerability requires user interaction—specifically, deliberate UI gestures—to be exploited. While the underlying implementation flaw is considered low severity by Google, the CVSS scoring reflects the potential for integrity and availability impacts when successfully exploited.

• CVE-2026-14139MEDIUM 4.2

  Google Chrome versions prior to 150.0.7871.47 contain a UI spoofing vulnerability in the TabStrip component that could allow an attacker to deceive users through a malicious webpage. The attack requires the victim to perform specific user interface gestures—such as particular mouse or keyboard interactions—making it less likely to succeed in practice than attacks that trigger automatically. The vulnerability affects Chrome across Windows, macOS, and Linux systems.

• CVE-2026-14144MEDIUM 4.2

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser renders security-related UI elements in the Views framework. An attacker could craft a malicious webpage that, when viewed by a user who performs certain mouse or keyboard interactions, tricks the user into believing they are interacting with legitimate browser UI (like permission dialogs or address bar elements) when they are actually interacting with attacker-controlled content. This is a UI spoofing vulnerability that relies on convincing users to take specific actions on a specially crafted page.

• CVE-2026-14612MEDIUM 4.2

  FreeIPA's ipa-otpd daemon contains two off-by-one errors in its OAuth2 device authorization handler that can cause it to read or write one byte beyond the bounds of a fixed-size buffer. This flaw is triggered when processing oversized responses from an external OAuth2 or OIDC identity provider. An attacker would need to either control the identity provider or position themselves in the network path between FreeIPA and that provider to exploit this vulnerability. The primary risk is denial of service to the ipa-otpd daemon, though limited data integrity issues are also possible. Exploitation requires an actual user to initiate the OAuth2 device authorization flow, which adds a layer of practical constraint.

• CVE-2026-14896MEDIUM 4.2

  HashiCorp Nomad has an authorization flaw in its dynamic host volumes feature that allows an operator with volume deletion rights in one namespace to delete volume claims belonging to jobs in a different namespace. This cross-namespace bypass undermines the multi-tenant isolation model that Nomad administrators rely on to prevent unauthorized access across organizational boundaries. The vulnerability affects both community and enterprise editions across multiple versions.

• CVE-2026-2299MEDIUM 4.2

  The Mattermost Google Drive plugin contains an authorization bypass flaw that allows authenticated users to share files to private channels they shouldn't have access to and expose confidential channel membership details. The vulnerability exists in versions before 1.1.0 and requires an attacker to have valid Mattermost credentials and a connected Google account. While the impact is limited to information disclosure and minor integrity issues, it creates a pathway for insider threats or compromised accounts to leak sensitive organizational structure and collaboration details.

• CVE-2026-24315MEDIUM 4.2

  SAP Fiori Launchpad contains a URL-crafting vulnerability that allows attackers to trigger unauthorized service calls within the Fiori application domain. When a user clicks a malicious link, the attacker can potentially steal credentials or compromise the user's account. The attack requires the attacker to have detailed knowledge of the system and depends on user interaction—the vulnerability cannot be exploited remotely without a victim opening the malicious URL.

• CVE-2026-41839MEDIUM 4.2

  Spring Framework versions 5.3, 6.1, 6.2, and 7.0 contain a session management flaw in WebFlux applications. If an attacker first compromises a subdomain (through XSS or similar attack), they can trade a known session ID for one belonging to an authenticated user, potentially gaining unauthorized access to that user's account or data. The flaw requires two conditions: initial subdomain compromise and user interaction, which limits its immediate exploitability but remains a meaningful risk in multi-tenant or loosely-segmented environments.

• CVE-2026-41844MEDIUM 4.2

  CVE-2026-41844 is a redirect vulnerability in Spring Framework that allows attackers to craft malicious links causing users' browsers to redirect to arbitrary external websites. The flaw exists in Spring MVC and Spring WebFlux applications configured with a catch-all URL mapping ("/**") where the view name is not explicitly set. An attacker can exploit the 'redirect:' prefix to bypass intended routing controls and send users to phishing sites or other malicious hosts. This requires user interaction—the victim must click a crafted link—and impacts four widely-used versions of Spring Framework spanning multiple release series.

• CVE-2026-41854MEDIUM 4.2

  CVE-2026-41854 is a server-side request forgery (SSRF) vulnerability in Spring Framework caused by incorrect parsing of host names in URLs. When an application uses Spring's UriComponentsBuilder to process a URL provided by an external user, an attacker could craft a malicious URL that causes the application to make unintended requests to internal systems or services. The vulnerability affects Spring Framework versions 7.0.0 through 7.0.7 and 6.2.0 through 6.2.18. Exploitation requires user interaction and presents moderate risk.

• CVE-2026-46730MEDIUM 4.2

  Dell PowerProtect Data Domain contains an authorization flaw that allows a high-privileged local attacker to execute commands they shouldn't be able to run. The vulnerability affects multiple release branches spanning versions 7.7.1.0 through 8.7, and while it requires someone with elevated access and physical/local connectivity to the system, it could lead to unauthorized actions within the backup infrastructure.

• CVE-2026-48104MEDIUM 4.2

  7-Zip versions 9.18 through 26.00 contain a memory safety bug in the SquashFS archive handler that can crash the application or leak heap information when processing a specially crafted archive file. The vulnerability stems from uninitialized memory left in an internal index structure; an attacker can craft a SquashFS archive that causes the handler to read from these uninitialized slots and potentially dereference invalid pointers during directory parsing. The issue is triggered automatically when you open the malicious file—no user interaction beyond that is required. The impact is limited to denial of service and potential information disclosure; the attacker cannot modify files or escalate privileges.

• CVE-2026-48522MEDIUM 4.2

  PyJWT, a widely-used Python library for JSON Web Token handling, has a vulnerability in versions before 2.13.0 where it blindly accepts any URL scheme when fetching public key sets (JWKS). An attacker who can influence the URL used to fetch these keys—through JWT headers, configuration, or OAuth parameters—can trick the application into reading local files, attempting unusual protocol connections (FTP, data URIs), or in certain chained scenarios, forging valid tokens. The vulnerability requires specific conditions: the attacker must control the URL source, and token forgery scenarios require additional application-layer flaws like writable filesystem access.

• CVE-2026-48776MEDIUM 4.2

  A path traversal vulnerability in LangGraph Python SDK versions 0.3.14 and earlier allows authenticated users to manipulate resource identifiers in HTTP requests, potentially accessing or modifying resources they shouldn't have permission to reach. The vulnerability stems from unsafe construction of URL paths using caller-supplied identifiers without proper sanitization. An attacker with valid credentials could craft specially formatted identifier values containing URL path characters to bypass authorization checks, particularly in deployments where access control relies on URL-prefix validation rather than application-level authorization.

• CVE-2026-50179MEDIUM 4.2

  Actual, a personal finance application, has a vulnerability in how it exports financial data to CSV files. When users export transaction information, certain special characters at the beginning of field values—such as equals signs, plus signs, or @ symbols—are not properly sanitized. If a recipient opens the exported CSV file in Excel, LibreOffice Calc, or Google Sheets, these characters cause the spreadsheet application to interpret the data as formulas rather than plain text. An attacker who can influence transaction data (for example, through a compromised account or social engineering) could craft malicious formulas that extract sensitive financial information or display misleading values when the file is opened. This issue has been resolved in version 26.6.0.

• CVE-2026-52846MEDIUM 4.2

  Caddy's stripHTML template function, designed to remove HTML tags from user input, has a flaw that allows certain malformed HTML patterns to bypass its filtering logic. Specifically, malformed tags like <<>img src=x onerror=alert()> can slip through, potentially leaving executable scripts in the output if that output is later rendered as HTML in a browser. This creates a client-side XSS vulnerability when applications use stripHTML to sanitize untrusted content but then display the result unsafely. The flaw affects Caddy versions prior to 2.11.4.

• CVE-2026-53860MEDIUM 4.2

  OpenClaw versions before 2026.5.7 contain a flaw in the BlueBubbles feature that allows authenticated users to bypass sender identity verification. Instead of confirming the actual sender, the system can be tricked into matching allowlist rules based on conversation metadata—data that attackers can influence. This means an attacker with legitimate access could manipulate conversation identifiers to receive responses that should only go to authorized senders, effectively circumventing access controls meant to restrict agent functionality.

• CVE-2026-53862MEDIUM 4.2

  OpenClaw versions before 2026.5.12 allow attackers to replay bootstrap tokens used during device pairing setup. An attacker who intercepts or obtains a pending bootstrap token can reuse it to request broader permissions than the token's original scope allowed, effectively escalating their access during the pairing process. This vulnerability requires the attacker to have network access and for a user to interact with the malicious request, but it can lead to unauthorized authority being granted to a paired device.

• CVE-2026-54298MEDIUM 4.2

  Astro, a popular web framework, contains a vulnerability in how it processes HTML attributes during server-side rendering. When developers use the spread syntax to pass object properties as HTML attributes—a common pattern for dynamic content—Astro fails to escape keys coming from untrusted sources like APIs or user input. An attacker can craft malicious property names that become unescaped HTML attributes, allowing them to inject event handlers (onclick, onmousemove) or break out of the attribute context entirely to inject new HTML elements. This affects Astro versions before 6.4.6.

• CVE-2026-54319MEDIUM 4.2

  Daytona, a runtime platform for executing AI-generated code and agent workflows, contains a path-traversal vulnerability in versions prior to 0.186. When users specify a volume identifier to mount storage, the system failed to properly validate the path, potentially allowing an authenticated user to reference storage locations outside the intended directories. An attacker with valid credentials could craft a specially formatted volume reference to access or modify files beyond the sandbox's intended scope.

• CVE-2026-55669MEDIUM 4.2

  ZITADEL, an open-source identity management platform, has a flaw in how it validates JSON Web Tokens (JWTs) from external identity providers. When a user logs in via a third-party provider, ZITADEL checks that the token is genuinely signed and comes from a trusted issuer—but it fails to verify that the token was actually intended for ZITADEL. This means a valid token issued for a different application by the same trusted provider could be wrongly accepted. An authenticated user could potentially exploit this to access resources or information they shouldn't have access to. The vulnerability affects versions before 3.4.12 and 4.15.2 and is resolved in those versions and later.

• CVE-2026-55945MEDIUM 4.2

  Microsoft Edge (Chromium-based) contains a race condition that allows an authorized attacker with local access to disclose sensitive information. The vulnerability arises from improper synchronization when multiple threads or processes access a shared resource concurrently. An attacker must already have local user privileges and knowledge of specific timing conditions to exploit this vulnerability successfully.

• CVE-2026-57306MEDIUM 4.2

  A CSRF vulnerability in the Jenkins Zowe zDevOps Plugin allows an attacker with login access to Jenkins to trick an authenticated user into performing actions that connect to attacker-controlled systems. By exploiting this flaw, an attacker can force Jenkins to use stored credentials to establish connections to malicious endpoints, potentially exposing those credentials to capture. The vulnerability requires an attacker to already know or obtain valid credential IDs from Jenkins, limiting the immediate exposure scope but creating a clear escalation path for authenticated threats.

• CVE-2026-57307MEDIUM 4.2

  Jenkins Zowe zDevOps Plugin versions 1.1.3.50.ve350c9b_450b_1 and earlier contain a permission check vulnerability that allows users with basic read access to Jenkins to exploit credential handling flaws. An attacker with Overall/Read permission can leverage known credential IDs to connect to arbitrary URLs using those stored credentials, potentially exposing sensitive authentication material. This is a moderate-severity issue that requires authenticated access but poses a real insider threat risk in shared Jenkins environments.

• CVE-2026-58171MEDIUM 4.2

  Vibe-Trading versions before 0.1.10 contain a path traversal vulnerability in how it constructs directories for storing run data. An authenticated user can supply a specially crafted run identifier through the MCP swarm tools that tricks the application into reading or overwriting JSON configuration files outside the intended runs directory. This allows an attacker to access or modify run.json files at arbitrary locations on the filesystem, potentially exposing or corrupting application state.

• CVE-2026-59882MEDIUM 4.2

  A flaw in guzzlehttp/psr7 (a widely-used PHP HTTP message library) allows attackers to craft URIs with specially-formatted host components that bypass validation. The library's host validation function fails to catch authority delimiters, embedded ports, or malformed IPv6 brackets, creating a disconnect between what the library reports as the host and what the URI actually specifies. This mismatch can confuse security checks or routing logic that rely on the reported host value.

• CVE-2026-59995MEDIUM 4.2

  OpenSSH's SFTP client has a path traversal vulnerability affecting versions before 10.4. When a user downloads files from a server using the command "sftp server:/path ." (downloading to the current directory), an attacker controlling the SFTP server can craft malicious responses that cause files to be written outside the intended download location. This requires user interaction—specifically, the user must initiate the download command—and relies on the attacker operating a malicious SFTP server. The vulnerability allows file overwrite or creation in unintended directories, potentially compromising system integrity if critical files are targeted.

• CVE-2026-59996MEDIUM 4.2

  OpenSSH's scp command has a path traversal vulnerability that can cause files to be written to an unintended location when copying between two remote systems. If an attacker controls the source or destination in a remote-to-remote copy operation, they may be able to place a file in the parent directory of where it was supposed to go, potentially overwriting legitimate files or introducing malicious content into unexpected locations. This affects OpenSSH versions before 10.4.

• CVE-2026-59997MEDIUM 4.2

  OpenSSH's internal SFTP server has a parsing limitation where only the first 9 command-line arguments are processed. Any security-relevant parameters supplied as the 10th argument or beyond are silently ignored. This can lead to SFTP connections operating with weaker security properties than an administrator intended, since critical flags meant to restrict access or enforce specific protections would be overlooked during connection setup.

• CVE-2026-9986MEDIUM 4.2

  CVE-2026-9986 is a UI spoofing vulnerability in Google Chrome's OptimizationGuide component that could let an attacker deceive users about what they're seeing on a webpage. The vulnerability requires the attacker to have already compromised Chrome's rendering process—the engine that draws web content. While this limits the immediate attack scope, it represents a meaningful escalation risk for adversaries who have achieved code execution in that sandboxed component. The flaw stems from inadequate validation of user-supplied input before it's used to generate on-screen elements.

• CVE-2024-45636MEDIUM 4.1

  IBM Security QRadar EDR versions 3.12 through 3.12.24 contain a credential storage flaw where user passwords and authentication tokens are stored in plain text on disk. A local attacker with elevated system privileges can read these credentials directly, potentially gaining unauthorized access to QRadar EDR or downstream systems that those credentials protect. This is a local-only attack requiring existing high-level access to the affected system.

• CVE-2024-47263MEDIUM 4.1

  A path traversal flaw in Synology Hyper Backup's web API allows administrators who already have legitimate access to write files outside their intended directory. The vulnerability is constrained to non-sensitive file types, limiting immediate damage, but represents a control-boundary weakness that could enable privilege misuse or lateral movement in environments where admin accounts are compromised or where insider threat is a concern.

• CVE-2026-10052MEDIUM 4.1

  Quay's configuration tool contains a weakness in how it validates LDAP and SMTP settings. When a configuration editor supplies endpoints for these services, the tool connects to them without restricting which IP addresses or hostnames are allowed. An attacker with config editor privileges can abuse this to make the Quay container reach internal network resources, allowing them to map and discover the organization's internal infrastructure from inside the cluster's network position.

• CVE-2026-13323MEDIUM 4.1

  Open VSX Registry, the extension marketplace used by VS Code and compatible editors, has a vulnerability in how it serves user-uploaded HTML files. An attacker with a publisher account can upload a malicious HTML file disguised as part of an extension package. When an authenticated user visits that file's link, the browser treats it as belonging to the open-vsx.org website rather than a separate, untrusted origin. This allows the attacker to steal the user's session tokens, create permanent access tokens for future unauthorized access, and publish fake or malicious extension updates that would reach all downstream users of that extension across VS Code, VSCodium, Cursor, Windsurf, and other compatible editors—a classic supply chain attack vector.

• CVE-2026-13751MEDIUM 4.1

  Snowflake CLI versions before 3.19 contain a vulnerability that allows server-side request forgery (SSRF) when processing SQL files. The issue stems from the !source and !load directives in SQL statements, which can reference remote URLs. When a user processes attacker-controlled SQL content, the CLI retrieves these URLs without adequate restrictions, potentially causing the victim's system to make unexpected outbound requests to internal networks or execute remote SQL code within the user's session. Exploitation requires the attacker to trick a user into processing a malicious SQL file, and impact is limited by the permissions available to that user.

• CVE-2026-37700MEDIUM 4.1

  MaxSite CMS version 109.2 contains a cross-site scripting (XSS) vulnerability in its backend file upload feature that allows authenticated attackers to inject malicious scripts. When an administrator performs a file upload through the admin page endpoint, an attacker with login credentials could craft a request that executes JavaScript in the victim's browser, potentially exposing sensitive information displayed during the upload process.

• CVE-2026-42401MEDIUM 4.1

  CVE-2026-42401 is a stored HTML injection vulnerability in Kibana that allows an attacker with write access to an Elasticsearch index to inject malicious markup. When other users view the affected Kibana dashboard or visualization, the injected code is not properly sanitized before rendering in their browser. This can enable unauthorized UI changes and cause the victim's browser to make unintended outbound network requests on their behalf.

• CVE-2026-46692MEDIUM 4.1

  ImageMagick, a widely-used image manipulation tool, contains a heap buffer overwrite vulnerability in its distributed cache service. An attacker with local access to the cache service can trigger the flaw to crash the service, causing a denial of service. The vulnerability affects ImageMagick versions before 6.9.13-48 (legacy branch) and 7.1.2-23 (current branch). While the attack requires local connectivity to the cache daemon and elevated privileges, the impact is confined to availability—not confidentiality or integrity.

• CVE-2026-46693MEDIUM 4.1

  ImageMagick, a widely-used open-source image manipulation suite, contains a race condition vulnerability in its distributed cache service. An attacker with local access to a system running the magick -distribute-cache service can exploit a timing window to hijack a file descriptor belonging to the server process, potentially gaining unauthorized read access to sensitive data the server is handling. This is a local privilege escalation scenario requiring both network access to the cache service and precise timing to trigger.

• CVE-2026-46771MEDIUM 4.1

  CVE-2026-46771 is a localized privilege-escalation vulnerability in Oracle Application Development Framework (ADF) that allows a highly privileged attacker already logged into the infrastructure to access sensitive application data. The attacker must be an administrative user on the machine running ADF, and even then exploiting it requires specific conditions to be met. The primary risk is unauthorized disclosure of data within ADF systems—the vulnerability does not enable attackers to modify or delete data, nor does it allow takeover of the ADF service itself.

• CVE-2026-47165MEDIUM 4.1

  ImageMagick, a widely-used open-source image manipulation tool, contained a flaw in how its distributed pixel cache system authenticated connections. The distributed pixel cache feature, which allows ImageMagick instances to share pixel data across systems, did not require proper authentication before versions 6.9.13-48 and 7.1.2-23. An attacker with high privileges on the same system could potentially read sensitive pixel data—such as confidential images being processed—without authorization. This is a local-only issue affecting system administrators and environments where multiple users or services share the same ImageMagick installation.

• CVE-2026-4983MEDIUM 4.1

  Open VSX Registry, an extension marketplace used by developers, has a vulnerability where it fails to properly secure SVG image files that extensions upload as icons. When someone views the icon directly, malicious code embedded in the SVG can execute in their browser. The impact depends on how the registry is hosted: if it uses its own servers, an attacker can steal session tokens and impersonate users; if it relies on external cloud storage like Amazon S3, the risk is lower but attackers can still create convincing fake login pages to harvest credentials.

• CVE-2026-56272MEDIUM 4.1

  Flowise versions before 3.0.13 use weak password hashing configuration that makes user account credentials significantly easier to crack if a database is compromised. The application relies on bcrypt with only 5 salt rounds (32 iterations), whereas security best practices call for at least 10 rounds. This 30x speed advantage in cracking attempts means attackers with GPU hardware can recover plaintext passwords from stolen hashes much faster than intended.

• CVE-2026-56354MEDIUM 4.1

  n8n, a popular workflow automation platform, contains vulnerabilities in its Form Node that allow authenticated users to inject malicious content. Specifically, two issues exist: unsanitized HTML in description fields can enable stored cross-site scripting (XSS) attacks, and overly permissive iframe sandbox settings can be exploited for phishing redirects. An attacker with workflow creation permissions could craft a malicious form that, when viewed by end users, executes scripts in their browsers or redirects them to attacker-controlled sites. The vulnerability affects versions before 1.123.24 in the 1.x branch and before 2.10.4 and 2.12.0 in the 2.x branch.

• CVE-2019-25723MEDIUM 4.0

  Dräger Perseus A500 ventilators running software versions 2.00 through 2.02 are vulnerable to a denial-of-service attack. An attacker on the network can send malformed data through the Medibus medical interface to crash the device's processor, forcing a warm restart. During this restart—which lasts several seconds—ventilation pressure drops to ambient level, temporarily interrupting therapy delivery before the device recovers. This is a network-accessible vulnerability with no authentication required, making it a genuine concern for clinical environments.

• CVE-2019-25734MEDIUM 4.0

  Contact Form by WD version 1.13.1 has a security flaw that combines two weaknesses: a cross-site request forgery (CSRF) vulnerability and local file inclusion (LFI). An unauthenticated attacker can craft a malicious web form that, when visited by an admin, tricks the admin's browser into loading arbitrary files from the server using directory traversal sequences. This bypasses the normal authentication checks on certain WordPress AJAX actions, potentially exposing sensitive files.

• CVE-2021-4479MEDIUM 4.0

  Dräger Atlan A350 patient monitoring devices running firmware versions 1.00 through 1.01 are vulnerable to a denial-of-service attack delivered through the Medibus network interface. An attacker can send malformed data packets that the device fails to validate properly, causing the internal processor to become overloaded. Over several hours, this degradation manifests as loss of data transmission capability, delays in displaying vital sign curves, and discrepancies between measured airway pressure and displayed values—conditions that could compromise clinical decision-making in critical care settings.

• CVE-2026-10099MEDIUM 4.0

  XX-Net V5.16.6 has a flaw in how it processes WebSocket communications that causes data corruption. When a client sends WebSocket frames without proper masking, the server incorrectly interprets the first 4 bytes of the message as a mask key (even when masking wasn't used), then mangles the rest of the data by applying the wrong decryption. This results in corrupted data being processed by the application. The vulnerability affects local attack scenarios and has medium severity.

• CVE-2026-10998MEDIUM 4.0

  CVE-2026-10998 is a memory safety issue in Google Chrome's media handling code that allows an attacker positioned on the same local network to read data from memory locations they shouldn't have access to. The vulnerability exists in Chrome versions before 149.0.7827.53. An attacker would need to send specially crafted network traffic to trigger an out-of-bounds read, which could potentially expose sensitive information resident in the browser's memory. This is a local-network-only threat, meaning the attacker must be on your network segment to exploit it.

• CVE-2026-13199MEDIUM 4.0

  Raspberry Pi 5 and Compute Module 5 devices use firmware stored on an EEPROM chip that should generate random values to protect the Linux kernel's memory layout and seed the system's random number generator. However, this firmware is producing predictable values instead. This means the kernel loads at the same memory address every time a device boots, and across different devices—information an attacker could use to craft exploits more reliably. The weak random seed may also cause the system to take longer to boot while gathering entropy from other sources.