By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 7 of 41

• CVE-2026-45696MEDIUM 6.5

  OpenEXR, the industry-standard image format for motion pictures, contains a flaw in its HTJ2K decoder that allows a maliciously crafted EXR file to crash any application that opens it. When processing the file, the decoder incorrectly trusts the declared image dimensions without validating them against the actual data buffer, causing it to read beyond allocated memory. Any tool that previews, validates, or processes EXR files—including thumbnail generators, asset management systems, and the exrcheck utility—is at risk. This affects versions 3.4.0 through 3.4.11.

• CVE-2026-45796MEDIUM 6.5

  Coder, a platform for provisioning remote development environments, contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in its Azure instance identity endpoint. An attacker can trick the Coder server into making HTTP requests to arbitrary internal or external hosts by submitting a specially crafted digital signature. While the attacker doesn't receive the full response from the target, error messages leaked in the API response allow reconnaissance—revealing whether a host is reachable and what type of failure occurred. This enables attackers to probe internal networks, cloud metadata endpoints, and other infrastructure without authentication.

• CVE-2026-4629MEDIUM 6.5

  Keycloak contains a privilege escalation vulnerability that allows administrators with client management permissions to grant themselves unauthorized access. A user with the `manage-clients` permission can inject a role mapper that artificially adds the `realm-admin` role to authentication tokens, bypassing normal access controls and gaining full administrative privileges over the Keycloak realm. This attack requires existing elevated privileges but results in complete administrative compromise.

• CVE-2026-46357MEDIUM 6.5

  CVE-2026-46357 is a denial-of-service vulnerability in HAX CMS (NodeJS version) that allows an authenticated user to crash the entire application with a single malformed request to the site creation endpoint. The impact is severe from an availability perspective: the application goes completely offline and requires manual server restart to recover. This affects only the NodeJS backend; PHP deployments are not impacted.

• CVE-2026-46397MEDIUM 6.5

  HAX CMS, a content management system for building microsite networks, contains a flaw that lets authenticated users read files they shouldn't have access to. An attacker with a valid login (even a low-privilege account) can manipulate how the system saves site configuration data, causing it to expose sensitive files like system passwords, API keys, or database credentials stored on the web server. This is a classic file inclusion attack that works over the network without requiring special browser interaction. The vendor has patched this in version 26.0.0.

• CVE-2026-46411MEDIUM 6.5

  FlashMQ, an MQTT broker used in multi-CPU environments, contains a flaw that allows authenticated users to deliberately overwhelm the server's write buffer beyond its intended limits. When this happens, the server triggers a safety mechanism that crashes the entire broker rather than gracefully handling the condition. An attacker with valid credentials can exploit this to cause a denial of service, taking the messaging broker offline.

• CVE-2026-46413MEDIUM 6.5

  Discourse, a widely-used open-source discussion platform, contains a vulnerability that allows regular (non-admin) users to upload files to sensitive backup storage areas that should be restricted to administrators only. An authenticated user can exploit S3 multipart upload functionality to bypass access controls and write files into the admin backup store. This is a privilege-escalation issue affecting data integrity rather than confidentiality; the vulnerability requires an existing user account but does not require special permissions to trigger.

• CVE-2026-46433MEDIUM 6.5

  lldpd, a Linux daemon that implements LLDP (Link Layer Discovery Protocol), contains a heap buffer over-read flaw in its VLAN tag handling code. When processing certain network frames that match the network interface's maximum transmission unit (MTU) size, the daemon reads 4 bytes beyond an allocated memory buffer. This can disrupt the daemon's operation, though it does not directly enable code execution or data theft. The vulnerability affects versions before 1.0.22 and requires network access to trigger.

• CVE-2026-46443MEDIUM 6.5

  Flowise, a no-code platform for building custom language model workflows, contains a credential exposure flaw in versions before 3.1.2. When users or applications retrieve stored credentials using a filter parameter, the system fails to remove encrypted credential data from the response—information that should never leave the server. An attacker with legitimate access to the Flowise instance could exploit this to extract encrypted credentials, potentially compromising downstream services or enabling lateral movement. The vulnerability does not affect credential retrieval when no filter is applied, indicating incomplete input-handling logic.

• CVE-2026-46463MEDIUM 6.5

  Dell PowerProtect Data Domain, a data protection and deduplication appliance widely deployed in enterprise backup environments, contains a flaw that allows an unauthenticated remote attacker to cause the system to stop responding. The vulnerability stems from improper handling of numeric calculations, which can overflow and trigger unexpected behavior. An attacker does not need valid credentials to attempt exploitation, making this a network-reachable concern for organizations running affected versions.

• CVE-2026-46540MEDIUM 6.5

  Nimiq's light client implementation contains a state synchronization bug where certain blockchain reorganizations (forks) fail to properly update critical consensus state. When a light client switches to a fork chain that ends in a macro block—a special checkpoint or validator election block—it updates its main chain pointer but forgets to update related state variables that track the most recent macro block and active validators. This causes the light client to verify subsequent blocks against outdated information, either rejecting valid blocks or stalling entirely if an election block triggered the fork. The bug only affects light clients (thin clients), not full nodes, and is fixed in version 1.4.0.

• CVE-2026-46551MEDIUM 6.5

  NocoDB, a spreadsheet-like database builder, contains a flaw in how it handles file uploads from remote URLs. Authenticated editors and above can trick the server into downloading extremely large files without respecting size limits, which can fill up the disk and crash the service. The vulnerability exists in versions prior to 2026.04.4 and stems from the attachment API not validating remote file sizes before initiating downloads.

• CVE-2026-46718MEDIUM 6.5

  Apache Calcite versions 1.5.0 through 1.41 contain a vulnerability that allows attackers to supply malicious input which the application then uses to dynamically load arbitrary Java classes. This unsafe reflection flaw requires only network access and no authentication, enabling remote attackers to potentially execute unintended code or access sensitive data. The vulnerability has been resolved in version 1.42.

• CVE-2026-46810MEDIUM 6.5

  Oracle Identity Manager contains a flaw in its End User Self Service component that allows an attacker to modify, add, or delete certain data and read sensitive information without needing to log in first. The vulnerability affects two specific versions of the software and can be exploited remotely via network access through the IIOP protocol. No user interaction or special circumstances are required to trigger the attack.

• CVE-2026-46869MEDIUM 6.5

  CVE-2026-46869 is a medium-severity vulnerability in Oracle MySQL Shell (versions 8.4.0–8.4.9 and 9.0.0–9.7.0) that allows an unauthenticated attacker on the network to access sensitive data stored within MySQL Shell. The attack requires a person to interact with a malicious input or link, but once triggered, an attacker can read confidential information without needing to authenticate. No integrity or availability impact occurs—this is purely a data exposure risk.

• CVE-2026-46871MEDIUM 6.5

  MySQL Shell, Oracle's command-line interface and IDE extension for MySQL databases, contains a flaw that allows an authenticated attacker to read sensitive data without authorization. The vulnerability exists in the VS Code extension component and affects version 2026.2.0+9.6.1. An attacker who already has valid credentials can exploit this over the network to access confidential information stored within MySQL Shell's scope, but cannot modify or delete data.

• CVE-2026-46979MEDIUM 6.5

  Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38 contains a vulnerability in its integration and interfaces component that allows high-privileged attackers to access the system over HTTPS and read or modify sensitive institutional data. The vulnerability requires the attacker to already hold elevated administrative credentials, but once authenticated, they can view or alter critical campus and community information without additional obstacles. This represents a data confidentiality and integrity risk rather than a system availability threat.

• CVE-2026-47110MEDIUM 6.5

  Tiptap for PHP versions before 2.1.1 have a flaw that allows logged-in users to deliberately crash the server's ability to render HTML content. An attacker submits a specially crafted Tiptap JSON document where a link URL field is set to an array of values instead of a single text string. When the server tries to validate this field using a string-matching function, it crashes with an unhandled error. Once this malformed data is saved to the database, every user who tries to view that record will trigger the same crash, disrupting service until a database administrator manually fixes the entry.

• CVE-2026-47124MEDIUM 6.5

  Nezha Monitoring, a self-hosted server monitoring tool, contains an authorization bypass flaw affecting versions 1.4.0 through 2.0.8. The vulnerability allows any logged-in user without admin privileges to access real-time telemetry data for all servers in the system, regardless of their assigned permissions. While the main API properly restricts server visibility based on user roles, the WebSocket endpoint that streams live server status incorrectly grants access to any authenticated user, exposing sensitive monitoring data across the entire infrastructure. This was fixed in version 2.0.9.

• CVE-2026-47145MEDIUM 6.5

  EmberZNet versions 9.0.2 and earlier contain a vulnerability where specially crafted Color Control messages can crash the application. The attack requires the attacker to already be a joined member of the network, limiting exposure to internal threats. Only devices that support the Color Control cluster are vulnerable. The impact is denial of service—the application terminates unexpectedly—rather than data theft or system compromise.

• CVE-2026-47146MEDIUM 6.5

  CVE-2026-47146 is a denial-of-service vulnerability in Silicon Labs EmberZNet versions 9.0.2 and earlier. An attacker who has already joined a Zigbee network can send specially crafted Color Control cluster messages that cause the EmberZNet process to crash. The vulnerability is limited to devices that implement the Color Control cluster, and requires the attacker to be an authenticated network member—not an external threat.

• CVE-2026-47148MEDIUM 6.5

  EmberZNet versions 9.0.2 and earlier contain a denial-of-service vulnerability triggered by malformed GetGroupMembership commands. An attacker with network access and prior device enrollment can send a specially crafted message that causes the receiving device to read past the end of its message buffer, crashing the process. The vulnerability does not leak data and only affects devices that support the Groups cluster—a subset of EmberZNet deployments.

• CVE-2026-47149MEDIUM 6.5

  EmberZNet v9.0.2 and earlier contains a flaw where specially crafted Door Lock cluster messages with invalid user identifiers can crash the affected device. An attacker must already be part of the network and send the malformed message from an authenticated device to trigger the issue. No data is leaked in the attack, but the device becomes unavailable until restarted.

• CVE-2026-47152MEDIUM 6.5

  EmberZNet v9.0.2 and earlier contain a denial-of-service vulnerability triggered by a specially crafted Level Control Move command. An attacker with network access and credentials to join the network can send this malformed command to crash the EmberZNet process, disrupting device functionality. The vulnerability only affects devices that implement the Level Control cluster, a component used for controlling brightness, speed, or similar dimming/ramping functions in Zigbee networks.

• CVE-2026-47153MEDIUM 6.5

  A flaw in Silicon Labs EmberZNet v9.0.2 and earlier allows a network-joined device to crash the software through a specially crafted Level Control Step command. The vulnerability stems from a divide-by-zero error that terminates the process. Because the attacker must already be part of the network and the target device must support Level Control (a lighting/dimming feature in Zigbee), the exposure is narrower than an unauthenticated internet attack, but still represents a denial-of-service risk in IoT and smart-home deployments.

• CVE-2026-47154MEDIUM 6.5

  EmberZNet versions up to 9.0.2 contain a vulnerability where specially crafted meter response messages can crash devices that support the Simple Metering cluster. The vulnerability only affects devices already connected to the network, and an attacker would need network access and authentication to send the malicious message. No data is stolen or leaked in the attack.

• CVE-2026-47155MEDIUM 6.5

  vLLM, a popular inference engine for large language models, has a supply-chain integrity vulnerability in versions before 0.22.0. When operators pin a specific model revision using deployment flags like --revision or --code-revision, vLLM may still load supporting files—such as dynamic code, GGUF model weights, image processors, or configuration files—from unpinned or default revisions instead of respecting the pinned revision. This means an operator could believe they are running a reviewed and approved version of a model, while vLLM silently loads unreviewed artifacts from elsewhere in the repository. An attacker with access to the model repository could inject malicious code or weights into these sibling artifacts, which would then be loaded even when the main model revision is pinned.

• CVE-2026-47157MEDIUM 6.5

  aiograpi, a Python library for interacting with Instagram via asynchronous API calls, had a flaw in how it handled security challenges issued by Instagram's servers. When Instagram sent a signup challenge (like a captcha or phone verification), the library blindly trusted the path provided by the server to determine where to send the user's response. An attacker positioned between the client and Instagram—such as through compromised local network, DNS spoofing, or proxy interception—could trick the library into sending sensitive requests (including the user's session credentials) to an attacker-controlled server instead of Instagram. The vulnerability was fixed in version 0.9.10 by validating challenge paths before using them.

• CVE-2026-47204MEDIUM 6.5

  Envoy, a widely-used cloud-native proxy, has a critical stability bug affecting versions 1.26.0 through 1.38.2. When the gRPC statistics filter is enabled and receives a Connect protocol request routed to a direct response, the Envoy process crashes immediately. An attacker with network access can trigger this crash with a single unauthenticated HTTP request, effectively causing a denial of service. This does not require authentication or special privileges—anyone who can send an HTTP request to the proxy can exploit it.

• CVE-2026-47207MEDIUM 6.5

  Envoy, a widely-used proxy for cloud-native applications, has a vulnerability that causes it to crash when an external processing (ext_proc) server sends a specially crafted message. The issue stems from how Envoy handles multiple responses bundled into a single network message—the first response can trigger cleanup of internal structures, but Envoy then tries to access those structures again when reading subsequent responses, leading to a crash. This affects versions 1.34.0 through 1.38.2, and is resolved in patched releases across multiple version lines.

• CVE-2026-47213MEDIUM 6.5

  Boxlite is a service that runs untrusted code safely by executing it inside lightweight virtual machines (called Boxes) with OCI containers. To prevent code from consuming resources indefinitely, administrators can set timeouts. When the timeout expires, Boxlite should forcefully terminate the process. However, in versions 0.8.2 and earlier, Boxlite uses a catchable signal (SIGALRM) instead of an uncatchable one (SIGKILL). This means malicious code can ignore the shutdown command and keep running, exhausting the virtual machine's resources and potentially disrupting the service for all users.

• CVE-2026-47238MEDIUM 6.5

  ClipBucket v5, an open-source video sharing platform, contains an authorization flaw that allows any authenticated user to modify, upload, or delete subtitles belonging to other users' videos. The vulnerability stems from missing permission checks when handling subtitle operations. An attacker with valid credentials—even a low-privilege account—can target subtitles from any video in the system, potentially corrupting content or denying legitimate users access to their own captions. The issue is fixed in version 5.5.3 - #133 and later.

• CVE-2026-47277MEDIUM 6.5

  Runtipi, a personal homeserver orchestrator, contains a vulnerability that allows unauthenticated users to read arbitrary files from the host system through its app marketplace logo endpoint. When Runtipi clones third-party app repositories, an attacker can craft a malicious app store that includes a symbolic link disguised as a logo file. Since the logo endpoint doesn't properly validate symlink targets, requesting this logo causes Runtipi to follow the symlink and return sensitive files like environment variables, JWT secrets, or application logs to the requester. This affects Runtipi versions 4.9.1 through 4.9.3 and has been patched in version 4.10.0.

• CVE-2026-47284MEDIUM 6.5

  Visual Studio Code contains a flaw that can expose sensitive information to attackers over the network. An attacker can trick a user into performing an action that leads to the disclosure of confidential data, though the attacker cannot modify systems or interrupt services. This is a moderate-severity issue requiring user interaction to exploit.

• CVE-2026-47287MEDIUM 6.5

  Visual Studio Code contains a path traversal vulnerability that could allow an attacker to modify files on your system through a malicious link or network request. The vulnerability requires user interaction—such as clicking a link or opening a file—but does not require authentication. An attacker cannot read sensitive data through this vulnerability, but they can alter or corrupt files if they successfully exploit it.

• CVE-2026-47340MEDIUM 6.5

  CVE-2026-47340 is a privilege escalation flaw in Apache DolphinScheduler that allows authenticated users to view alert instances they should not have access to. An attacker with valid credentials can bypass permission controls to see alerts associated with alert groups outside their authorization scope. This is a post-authentication issue—the attacker must already have a user account—but it enables unauthorized information disclosure within the system.

• CVE-2026-47341MEDIUM 6.5

  Apache APISIX versions 3.11.0 through 3.16.0 contain an authentication bypass vulnerability in the hmac-auth plugin. Under certain configurations, an attacker can capture and replay authentication tokens indefinitely, circumventing the token expiry mechanism designed to limit credential lifetime. This allows an attacker to maintain unauthorized access to protected APIs without re-authenticating, as long as they possess a valid token.

• CVE-2026-47644MEDIUM 6.5

  A flaw in Microsoft Edge's Copilot Chat feature allows attackers to inject specially crafted code into the application, potentially exposing sensitive information. The vulnerability requires user interaction (such as clicking a malicious link) but does not require authentication. Once triggered, it could disclose data over the network without the user's knowledge.

• CVE-2026-47655MEDIUM 6.5

  Microsoft Graph contains a flaw that allows an authorized attacker to access sensitive information they should not be able to see. The vulnerability requires the attacker to already have valid credentials, but once authenticated, they can retrieve confidential data over the network without performing additional interactions. This is classified as a medium-severity issue because exploitation requires prior authentication, limiting the attack surface to insiders or compromised accounts.

• CVE-2026-47742MEDIUM 6.5

  Shopper is a headless e-commerce admin platform that manages product catalogs and inventory. A flaw in versions prior to 2.8.0 allowed any logged-in panel user to modify product information—including prices, stock levels, SEO details, shipping dimensions, and media attachments—even if they lacked explicit permission to edit products. The vulnerability stems from missing authorization checks on specific sub-form components and the ability for attackers to manipulate product IDs client-side to target arbitrary products. An authenticated attacker with minimal privileges could cause significant data integrity issues without detection.

• CVE-2026-47745MEDIUM 6.5

  Shopper, a headless e-commerce admin panel used to manage online stores, contains a permission-checking flaw in versions before 2.8.0. Admin users with low-level access can manipulate critical payment and fulfillment settings—such as disabling all payment methods, changing the default currency, or removing shipping carriers—even though they shouldn't have permission to do so. Any employee or contractor with admin panel access, regardless of their intended role, can trigger a complete checkout blockade or corrupt pricing data. The vendor has resolved this in version 2.8.0.

• CVE-2026-48028MEDIUM 6.5

  Mastodon, the popular open-source social network platform, has a vulnerability in how it validates incoming messages signed with digital signatures. An attacker can manipulate these signed messages by removing certain data fields while keeping the signature valid, effectively impersonating another user or system. This could allow spoofing of activities—like posts or follows—that appear to come from legitimate sources but have been altered by an attacker. The vulnerability affects multiple versions of Mastodon and has been patched in versions 4.5.10, 4.4.17, and 4.3.23.

• CVE-2026-48067MEDIUM 6.5

  Filament, a popular Laravel development framework, contains a vulnerability in how it validates user selections in certain action components. When developers use AttachAction or AssociateAction with a recordSelectOptionsQuery() method to limit which records users can select, the validation step doesn't respect those same limits. This means an authenticated attacker could manipulate the Livewire component state to submit choices that should have been blocked, potentially associating or attaching records they shouldn't have access to. The vulnerability affects Filament versions released between early 4.0.0 and the 4.11.4 / 5.6.4 fixes, as well as tables versions 3.0.0 through 3.3.51.

• CVE-2026-48101MEDIUM 6.5

  7-Zip versions 9.21 through 26.00 contain a memory disclosure flaw in their UEFI capsule parser. When processing truncated or specially crafted .scap files, the application allocates a large heap buffer without clearing it first, then fails to verify that the file contents completely filled that buffer. Any unread portion of the buffer retains leftover data from previous memory allocations—potentially sensitive information—which then leaks to the user when the archive is extracted. This affects any organization or individual using affected 7-Zip versions to handle capsule files, and is fixed in version 26.0.1.

• CVE-2026-48107MEDIUM 6.5

  Russh is a Rust-based SSH client and server library used by developers to add SSH functionality to Rust applications. A vulnerability exists in versions 0.37.0 through 0.60.x that allows a malicious SSH server to crash or hang a connecting client. When a client attempts keyboard-interactive authentication (a common multi-factor authentication method), an attacker controlling the server can send a specially crafted response with a false count of authentication prompts. The client code trusts this count without verification, causing it to pre-allocate memory based on that untrusted value before actually reading the prompt data. This mismatch leads to a denial-of-service condition. The issue requires user interaction in the sense that a client must attempt to connect to the attacker's server, but does not require special privileges.

• CVE-2026-48112MEDIUM 6.5

  7-Zip versions 9.18 through 26.00 contain a memory safety defect in their handler for Unix ar archives—specifically when parsing BSD-style symbol tables. The flaw allows an attacker to craft a malicious ar archive that, when opened by 7-Zip, causes the parser to read 4 bytes of uninitialized heap memory beyond the intended buffer boundary. This disclosure of uninitialized data could leak sensitive information from the process memory. The vulnerability requires user interaction: a victim must open the malicious archive file. Version 26.01 resolves the issue.

• CVE-2026-48129MEDIUM 6.5

  Kestra, an open-source workflow orchestration tool, contains a path traversal vulnerability in its task file handling. When flows process untrusted data (from webhooks or external sources) as file names in the `inputFiles` feature, attackers can inject directory-traversal sequences like `../` to write or overwrite files outside the intended task directory on worker systems. This could allow an attacker to place malicious files in sensitive locations or corrupt existing files, depending on worker permissions and file system layout.

• CVE-2026-48140MEDIUM 6.5

  CVE-2026-48140 is a denial-of-service vulnerability in National Instruments' grpc-device component, specifically in the BeginSidebandStream function. An authenticated attacker can craft a malicious message containing an invalid enumeration value to trigger undefined behavior in the service, causing it to crash or become unavailable. The vulnerability affects NI grpc-device version 2.17.0 and earlier. Exploitation requires valid credentials but no special privileges or user interaction.

• CVE-2026-48208MEDIUM 6.5

  OTRS and OTRS Community Edition contain a vulnerability that allows attackers to embed malicious SVG (Scalable Vector Graphics) code within email messages sent to the ticketing system. When an agent or customer opens an affected ticket, the crafted SVG content can consume excessive browser resources, rendering the application unresponsive or forcing a browser crash. This is a denial-of-service attack that requires no special privileges and occurs automatically when viewing a compromised ticket—the attacker simply needs to send an email to the OTRS system.

• CVE-2026-48314MEDIUM 6.5

  Adobe ColdFusion contains a path traversal vulnerability that allows an attacker to read and write files outside intended directory boundaries. Versions 2025.9, 2023.20 and earlier are affected. No user interaction is required for exploitation—an attacker can trigger the flaw remotely and directly access or modify sensitive files. The impact is classified as medium severity because while file access is limited, both confidentiality and integrity can be compromised.

• CVE-2026-48492MEDIUM 6.5

  Snipe-IT versions before 8.6.1 have an authorization bypass in the user list API endpoint. Any employee logged into Snipe-IT can retrieve a complete list of all user accounts in the system without needing special permissions or an API token. This leaks usernames, display names, employee numbers, and user IDs—sensitive directory information that could be useful for social engineering, phishing, or reconnaissance. The vulnerability requires an active user session to exploit, but does not require admin rights or knowledge of credentials beyond what any valid employee already has.

• CVE-2026-48500MEDIUM 6.5

  Filament, a Laravel development framework, has a vulnerability in how it handles file uploads on authentication-required components. The framework automatically enables file upload capability on all schema-based forms, including pages that shouldn't allow uploads—like the login form. This means an attacker without credentials could upload files to your server's temporary storage without any restrictions, potentially filling up disk space or running up storage costs. The issue affects versions 3.0.0 through 3.3.51, 4.0.0 through 4.11.4, and 5.0.0 through 5.6.4.

• CVE-2026-48618MEDIUM 6.5

  Node.js versions 22, 24, and 26 contain a TLS hostname validation flaw that exploits a mismatch in how Unicode dot separators are handled during certificate verification. An attacker with valid credentials can craft a certificate with a specially-formatted hostname that passes wildcard validation checks on the resolver side but fails on the verifier side, potentially allowing them to intercept encrypted traffic or bypass intended security boundaries. The vulnerability requires authenticated access to exploit, but the impact on confidentiality is significant.

• CVE-2026-48726MEDIUM 6.5

  Apache Airflow has a logout bypass vulnerability where JWT tokens remain valid after users log out through the web UI. When users click logout, the system fails to properly revoke their authentication tokens in deployments using FAB (Flask-AppBuilder) or Keycloak authentication. An attacker with a stolen or previously-issued JWT can continue making authenticated API calls as that logged-out user until the token naturally expires. This is a follow-up to an earlier fix that patched cookies but missed the JWT revocation paths in these two authentication modules.

• CVE-2026-4881MEDIUM 6.5

  Octopus Server contains a missing permission check in one of its API endpoints. Any authenticated user—even with minimal privileges—can exploit this flaw to make server-level changes, such as modifying configuration or access controls. The vulnerability is deceptive: the API returns an error message to the caller, but the requested changes are applied anyway. This allows a low-privileged insider or compromised account to escalate their impact significantly.

• CVE-2026-48828MEDIUM 6.5

  Apache Airflow's Bulk Variables API has a flaw where it bypasses the built-in redaction mechanism when retrieving JSON-formatted variables. Normally, Airflow hides the values of variables with secret-related key names (like `db_password`, `api_token`, or `service_secret`). However, this protection fails for JSON variables accessed through the bulk API because the redactor isn't given the variable's key name to evaluate. An authenticated user with read permissions to bulk variables can therefore extract sensitive data that should have been hidden, even though the variable name itself would normally trigger redaction. The exposure is limited to JSON-typed variables and requires existing access to Airflow's UI or API.

• CVE-2026-48855MEDIUM 6.5

  A vulnerability in Erlang OTP's SSH file transfer module allows authenticated SFTP users to discover the absolute filesystem path of the server's SFTP root directory. When a user creates a symbolic link pointing outside the intended chroot jail, the server incorrectly reveals the backend absolute path instead of the restricted path visible to the client. This leaks infrastructure information—specifically filesystem paths—but does not expose file contents, credentials, or permit access beyond the intended boundary.

• CVE-2026-48856MEDIUM 6.5

  Erlang's httpc HTTP client has a credential-leakage flaw in how it handles HTTP redirects. When a server sends a redirect response (3xx status), httpc automatically follows it to the new location while preserving the original Authorization and Proxy-Authorization headers—including any embedded credentials. An attacker controlling both the initial target server and the redirect destination can trick the client into sending credentials to an attacker-controlled domain. Since automatic redirects are enabled by default, this affects most applications using httpc unless they explicitly disable the feature.

• CVE-2026-48858MEDIUM 6.5

  An attacker who controls or compromises an FTP server can trick Erlang/OTP applications into connecting to arbitrary internal hosts and ports by injecting a malicious IP address into the FTP PASV response. When the client application tries to read or write files, traffic gets redirected to the attacker's chosen target—enabling probes against internal infrastructure, cloud metadata services, or attacks on third-party hosts. The flaw exists in how Erlang's FTP client parses the PASV response without checking that the redirected address actually belongs to the FTP server it connected to.

• CVE-2026-48860MEDIUM 6.5

  A flaw in Erlang/OTP's TLS-based distribution module allows an attacker with a valid certificate to bypass IP-address-based access controls on Erlang cluster nodes. The vulnerability stems from a logic error where the code checks the local socket address instead of the remote peer's address when validating whether a connecting node is on the allowed subnet. An attacker holding any CA-signed TLS certificate can exploit this to gain unauthorized access to Erlang RPC and code-loading functions on affected nodes.

• CVE-2026-48870MEDIUM 6.5

  King Addons for Elementor versions 51.1.62 and earlier contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. The vulnerability requires user interaction (such as a victim clicking a link) to execute, and can affect multiple security boundaries within a site. While the attack surface is somewhat constrained by authentication requirements, the ability to combine script injection with site-wide impact makes this a meaningful risk for organizations using this WordPress plugin.

• CVE-2026-48880MEDIUM 6.5

  A cross-site scripting (XSS) vulnerability has been discovered in WP Job Portal versions 2.5.2 and earlier. The flaw allows authenticated users to inject malicious scripts into the application, which are then executed in the browsers of other users viewing affected content. This can lead to session hijacking, credential theft, or defacement of the job portal interface. An attacker must have valid subscriber-level access to exploit this vulnerability, and victims must interact with the malicious payload.

• CVE-2026-48892MEDIUM 6.5

  Apache Airflow's configuration API unintentionally exposed secrets-backend credentials to authenticated users. When administrators configure Airflow to fetch secrets from external systems like HashiCorp Vault, they often use environment variables to specify authentication details (such as role IDs and secret IDs). Due to a masking oversight, these credentials were stored as visible configuration options in the Config API. Any user with permission to read Airflow's configuration through the UI or API could retrieve these plaintext credentials, bypassing the normal secret-redaction mechanism. The vulnerability requires valid Airflow authentication, so it poses an insider threat rather than a publicly exploitable attack vector.

• CVE-2026-48941MEDIUM 6.5

  CVE-2026-48941 is a medium-severity vulnerability in the K2 Joomla component that allows an attacker to delete gallery folders without authentication. The flaw exists in the `item.checkin` task, which accepts a user-supplied folder path parameter and passes it unsafely to a file deletion function. An attacker can craft a request specifying any gallery folder path to trigger unauthorized deletion of media files, potentially disrupting site content or causing data loss.

• CVE-2026-48943MEDIUM 6.5

  K2, a popular content component for Joomla, has a flaw in how it handles user profile updates. When a registered Joomla user submits a profile edit through the standard Joomla user management system, they can inject a special parameter that tricks K2 into letting them modify hidden database fields—specifically their notes, profile image, and plugin settings—that the normal K2 interface doesn't expose. This allows unauthorized modification of user profile data that should be restricted to administrators.

• CVE-2026-48944MEDIUM 6.5

  A flaw in the K2 component for Joomla allows authenticated users with Author privileges to read sensitive files from the server. By manipulating a form field during article uploads, an attacker can copy files like configuration.php or system files into a publicly accessible directory, then download them to extract credentials, database details, or other secrets. The vulnerability requires valid site credentials but poses a significant confidentiality risk.

• CVE-2026-48955MEDIUM 6.5

  CVE-2026-48955 is a medium-severity access control flaw in Joomla that allows authenticated users to view workflow stage and transition details they should not be able to see. An attacker with a valid login—even with limited permissions—can bypass authorization checks to inspect sensitive workflow configuration and state information. This is not a remote unauthenticated attack, but rather a privilege escalation within the platform.

• CVE-2026-49086MEDIUM 6.5

  Apache Camel's DAPR Pub/Sub component has a routing vulnerability that allows an attacker to redirect messages to unintended destinations. When a Camel route consumes messages from one DAPR topic and republishes them to another, a message publisher can craft CloudEvents with manipulated routing headers that override the route's intended destination. This causes messages to be delivered to arbitrary topics or Dapr components instead of where the route was configured to send them, potentially exposing sensitive data or bypassing access controls. The vulnerability requires only the ability to publish to the topic the route subscribes to—no special authentication is needed.

• CVE-2026-49087MEDIUM 6.5

  CVE-2026-49087 is a denial-of-service vulnerability in Kibana that allows an authenticated user to crash or freeze the service by submitting a specially crafted bulk deletion request. The attack exploits a lack of resource limits in Kibana's request handling, causing it to consume excessive memory or CPU until it becomes unresponsive. Because the attacker must already have valid credentials, the risk is primarily to organizations where insider threats or credential compromise are concerns.

• CVE-2026-49090MEDIUM 6.5

  An authenticated user in Elasticsearch can submit a specially crafted bulk request that causes a denial of service by forcing sustained high CPU consumption on the affected node. The node becomes unable to process legitimate requests, effectively taking it offline without requiring any special access privileges or user interaction. While this requires valid credentials to execute, it can disrupt availability across your infrastructure.

• CVE-2026-49094MEDIUM 6.5

  A vulnerability in Kibana allows authenticated users with basic viewer access to cause the service to become unavailable by submitting specially crafted requests to analytics collection endpoints. When Kibana processes these requests, it exhausts system CPU and memory resources, forcing administrators to manually restart the service to restore availability. The attacker does not need elevated permissions—standard viewer-level credentials are sufficient to trigger the denial of service.

• CVE-2026-49095MEDIUM 6.5

  CVE-2026-49095 is a privilege escalation vulnerability in Elastic Kibana's Fleet agent policy management. An authenticated user with Fleet management permissions can manipulate how agent policies are configured in a way that bypasses input validation. This manipulation tricks Elastic Agents into receiving API keys with permissions beyond what they should have, potentially allowing unauthorized access to Elasticsearch security indices. The vulnerability requires an authenticated attacker with existing Fleet management privileges, limiting the immediate blast radius but posing a significant insider risk to organizations managing large agent fleets.

• CVE-2026-49097MEDIUM 6.5

  Apache Camel's IRC component contains a flaw that allows attackers to redirect IRC messages to unintended recipients through HTTP requests. When a web application uses Camel to bridge HTTP traffic into IRC channels, an attacker can inject special HTTP headers that override the intended destination, causing messages to be diverted to attacker-controlled IRC channels or users. This leak can expose sensitive message content or make automated bots appear to send malicious messages on an attacker's behalf. The vulnerability requires an unauthenticated HTTP consumer to function but does not require credentials or specialized attack tools.

• CVE-2026-49133MEDIUM 6.5

  Typemill, a content management system, contains a path traversal flaw in versions prior to 2.24.0 that allows authenticated users with Author-level permissions to read files stored outside the intended content directory. An attacker can craft malicious file paths containing traversal sequences (like ../ patterns) to bypass safety checks and access sensitive files on the server. This requires valid credentials but does not require user interaction, making it a concern for organizations where Author accounts may be compromised or granted to untrusted users.

• CVE-2026-49144MEDIUM 6.5

  BrowserStack Runner versions up to 0.9.5 contain a path traversal flaw that allows attackers on the same network to read sensitive files from affected systems. The vulnerability exists in an unauthenticated HTTP server that runs by default, giving attackers a direct avenue to escape the intended project directory and access files elsewhere on the filesystem. No special privileges or user interaction are required to exploit this issue.

• CVE-2026-49204MEDIUM 6.5

  A firmware vulnerability in Acer Connect M6E 5G devices contains hardcoded credentials embedded in debug modules that should have been removed before release. These credentials provide access to internal AWS Cognito test environments, potentially allowing attackers to authenticate to backend services without legitimate credentials. The flaw affects both the device firmware and the product line itself.

• CVE-2026-49205MEDIUM 6.5

  phpMyFAQ versions before 4.1.4 contain an authorization bypass in four API endpoints that allow authenticated users to perform privileged actions (create and modify FAQ content) without proper permission checks. The vulnerability stems from reliance on a shared API key validation rather than checking individual user permissions. A user with valid API credentials but no administrative privileges can create categories, FAQs, questions, and modify FAQs—actions that should be restricted to authorized administrators.

• CVE-2026-49271MEDIUM 6.5

  libheif is a widely-used library for decoding and encoding HEIF and AVIF image formats. Versions before 1.22.1 contain a flaw in how they validate offsets within uncompressed HEIF files. An attacker can craft a malicious HEIF file that bypasses safety checks due to integer wraparound, then tricks the library into reading data from memory locations outside the intended buffer. This causes the application to crash and may leak information. The issue requires user interaction—someone must open the malicious file—but affects any application embedding libheif.

• CVE-2026-49296MEDIUM 6.5

  Apache Airflow versions before 3.3.0 contain an authorization bypass that exposes source code of DAGs (Directed Acyclic Graphs) that a user should not be able to see. When a user with permission to view one DAG's source code requests it via the API or web UI, the system returns the entire source file—including all other DAGs stored in that same file—without checking whether the user is authorized to view them. This affects only deployments that store multiple DAGs in a single source file and rely on per-DAG access controls. Organizations with one DAG per file are unaffected.

• CVE-2026-49319MEDIUM 6.5

  A 433 MHz remote keyless entry system (RKES) made by ALPS ALPINE CO., LTD. (FCC ID CWTR53R0) is vulnerable to replay attacks. An attacker within radio range can record two consecutive transmissions from a legitimate key fob, then replay that same pair repeatedly to unlock or lock a vehicle. Security researchers confirmed this vulnerability on a 2024 Suzuki Swift, demonstrating that the rolling-code authentication mechanism can be defeated through systematic replay of captured signals.

• CVE-2026-49359MEDIUM 6.5

  PhpWeasyPrint, a PHP library used to generate PDFs from URLs or HTML, has a vulnerability in versions before 2.6.0 that allows attackers with legitimate access to the application to request the PHP process itself fetch and embed arbitrary content into generated PDFs. An attacker can trick the library into fetching files from the local server, retrieving sensitive data from internal services, or accessing cloud metadata by manipulating the attachment option. The vulnerability stems from the library accepting any URL-like string without validating what type of resource it points to, including dangerous protocols like file:// and php:// that expose local files.

• CVE-2026-49376MEDIUM 6.5

  JetBrains TeamCity versions prior to 2026.1 contain a vulnerability in the SAML authentication plugin where usernames are not properly validated. This weakness allows an attacker to bypass normal username restrictions and potentially gain unauthorized access or manipulate user identity claims during the authentication process. The vulnerability requires network access but no special credentials or user interaction to exploit.

• CVE-2026-49379MEDIUM 6.5

  JetBrains TeamCity versions prior to 2026.1 contain a credential exposure vulnerability where sensitive authentication information could leak through thread names. An authenticated attacker with access to the TeamCity server could potentially extract credentials from system logs or monitoring output that display thread identities. This is a server-side information disclosure issue that does not require user interaction and affects the confidentiality of stored credentials.

• CVE-2026-49385MEDIUM 6.5

  JetBrains YouTrack contains an access control flaw that allows standard users to modify service accounts—privileged system identities that handle automated tasks and integrations. This is a privilege escalation risk because service accounts typically have elevated permissions, and unauthorized modification could allow an attacker to hijack critical workflows or lateral-move within the organization. The vulnerability affects YouTrack versions prior to 2026.1.13570.

• CVE-2026-49386MEDIUM 6.5

  JetBrains YouTrack versions prior to 2026.1.13570 contain an access control flaw that allows authenticated users to discover restricted issues and articles on the Planning Canvas feature. While attackers cannot modify or delete content, they can enumerate sensitive information that should be hidden from their permission level. This is a credential-based attack—an attacker must have valid YouTrack login credentials to exploit it, but once authenticated, the vulnerability requires no special interaction or additional privileges.

• CVE-2026-49411MEDIUM 6.5

  Deno, a JavaScript/TypeScript/WebAssembly runtime, had a permission-checking flaw in its Node.js compatibility layer for TCP connections. When code attempted to connect to a host that was supposed to be denied, Deno only checked permissions against the hostname as originally provided—not after that hostname resolved to an IP address. An attacker could bypass restrictions by using numeric representations of IP addresses (like decimal 2130706433 or hexadecimal 0x7f000001, both resolving to localhost) in node:net.connect() or node:http.request() calls, reaching destinations that should have been blocked. This was fixed in Deno 2.8.0.

• CVE-2026-49487MEDIUM 6.5

  Apache Airflow's REST API was exposing secrets in plain text when workers deferred task execution. If you run Airflow and use deferred operators (tasks that pause and resume later), any authenticated user who could view task details could see API keys, credentials, and other sensitive values that operators passed to their trigger functions. This is particularly risky in multi-tenant or team environments where different users manage different DAGs. The issue is fixed in Airflow 3.3.0 and later, which now masks these sensitive values before returning them via the API.

• CVE-2026-49773MEDIUM 6.5

  A cross-site scripting (XSS) vulnerability exists in FV Flowplayer Video Player versions below 7.5.51.7212. An authenticated user can inject malicious scripts that execute in the context of other subscribers' browsers, potentially allowing them to steal session data, redirect users, or perform actions on their behalf. The vulnerability requires user interaction (such as clicking a link) to trigger the attack.

• CVE-2026-49779MEDIUM 6.5

  Addify Tax Exempt for WooCommerce versions before 1.9.5 contain a path traversal vulnerability that allows authenticated users to access files and directories outside the intended scope on affected servers. An attacker with login credentials could potentially read sensitive configuration files, database backups, or other protected data by manipulating file paths with traversal sequences. The vulnerability requires valid user authentication, limiting exposure but still presenting meaningful risk for sites with user registration.

• CVE-2026-49818MEDIUM 6.5

  A path traversal flaw in Apache Airflow's Samba provider allows attackers to write files to unintended locations on Samba file shares. The vulnerability exists in the `GCSToSambaOperator`, which copies objects from Google Cloud Storage to Samba without validating that the destination path remains within the configured boundary. An attacker who can upload files to the source GCS bucket (a common scenario when external data producers have write access) could craft object names using directory traversal sequences like `../` to escape the intended destination and write files anywhere on the target Samba system. This is particularly dangerous in shared data pipelines where the GCS bucket is not exclusively controlled by the DAG author.

• CVE-2026-49938MEDIUM 6.5

  CVE-2026-49938 is an access control flaw affecting Fortinet FortiPortal that allows authenticated users to access data or functions they should not have permission to reach. The vulnerability exists in FortiPortal versions 7.0 (all versions), 7.2.0 through 7.2.8, and 7.4.0 through 7.4.7. An attacker with valid credentials can exploit this to gain unauthorized visibility into sensitive information. This is not a remote unauthenticated attack—the threat actor must first obtain legitimate login credentials.

• CVE-2026-49940MEDIUM 6.5

  Net::CIDR::Set, a Perl library for managing IP address ranges, has a parsing vulnerability in versions up to 0.20. The library incorrectly accepts non-ASCII Unicode digits (such as Arabic-Indic numerals) in IP addresses and network masks. Because these Unicode characters aren't properly converted to their numeric values, network masks may be parsed incorrectly, potentially causing the library to accept a broader range of IP addresses than intended. This could allow an attacker to bypass network access controls or firewall rules that rely on this library for IP validation.

• CVE-2026-49953MEDIUM 6.5

  Discuz! X5.0 contains a weakness in its CAPTCHA (the image-based puzzle that proves you're human) that allows attackers to bypass it entirely. The vulnerability affects builds released between March 20, 2026 and June 10, 2026. An attacker can collect samples of the challenge images, train a machine learning model to recognize the patterns, and then automatically solve them. This bypasses protections that should prevent automated attacks on login pages, registration forms, and other sensitive functions. Because the attack requires no authentication and no user interaction, any exposed Discuz! instance running the affected versions is at immediate risk.

• CVE-2026-49956MEDIUM 6.5

  Hermes WebUI versions before 0.51.269 have a profile isolation flaw that lets logged-in users view other users' conversations and session data. An attacker with valid credentials can query the sessions search endpoint in a way that bypasses profile restrictions, exposing session titles and message transcripts they shouldn't be able to access. The vulnerability requires authentication but doesn't need user interaction to exploit.

• CVE-2026-50017MEDIUM 6.5

  pnpm, a widely-used Node.js package manager, has a credential leakage vulnerability that can expose your authentication tokens to unintended registries. If you use pnpm and store authentication credentials in your user-level npm configuration, a malicious or compromised repository with a local .npmrc file can trick pnpm into sending your personal authentication token to a registry of the attacker's choosing during package installation or metadata fetches. This happens because pnpm applies user-level credentials to repository-specified registries without proper validation, creating a window for credential theft.

• CVE-2026-50034MEDIUM 6.5

  CVE-2026-50034 is a Bluetooth Low Energy (BLE) vulnerability that allows an attacker within wireless range to passively intercept health device communications and extract sensitive glucose measurement data. No special privileges or user interaction are required—an attacker need only be physically proximate to the affected device. This is a passive eavesdropping flaw, not an active exploitation vector, but the information disclosed is medically significant.

• CVE-2026-50082MEDIUM 6.5

  Aqara's Cloud Developer Portal contained a flaw that allowed attackers to obtain developer tokens for any email address without proper authentication. An attacker could request a token using any email (including one they don't control) and the system would issue valid credentials. While this vulnerability alone provides limited access (confidentiality and integrity impact), it becomes dangerous when chained with three related vulnerabilities (CVE-2026-50083, CVE-2026-50084, CVE-2026-50085), potentially enabling complete device takeover for affected Aqara IoT devices.

• CVE-2026-50201MEDIUM 6.5

  Steeltoe is a framework for building cloud-native applications. A permissions flaw in its management endpoints allows low-privilege users (like Space Auditors in Cloud Foundry) to access sensitive diagnostic information that should be restricted to higher-trust roles. Specifically, heap dumps, environment variables, and thread dumps are exposed when they shouldn't be, potentially revealing application secrets and configuration details. Fixed versions are available.

• CVE-2026-50212MEDIUM 6.5

  CVE-2026-50212 is a denial-of-service vulnerability in Acer Connect M6E 5G devices that allows an attacker on the same network segment to remotely disconnect other users' devices without authorization. The flaw stems from inadequate validation in the device dissociation API—the mechanism that normally unbinds user endpoints from the network. An attacker can exploit this to force legitimate users offline, disrupting service availability. No authentication is required, and the attack succeeds with minimal complexity.

• CVE-2026-50508MEDIUM 6.5

  A flaw in Windows NTLM authentication exposes sensitive information that attackers can exploit to impersonate users on a network. The vulnerability requires user interaction—such as clicking a link or accepting a connection—but once triggered, does not require any special privileges. An attacker cannot directly crash systems or alter data, but the exposure of authentication material creates a significant spoofing risk.