2026 · High

High-severity vulnerabilities disclosed in 2026

High-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4140 published vulnerabilities · page 25 of 42

← All 2026 Known exploited (KEV)Critical High Medium All recent

CVE-2026-55208HIGH 7.7
Pimcore Studio Backend Bundle versions before 2025.4.6 and 2026.1.6 contain a SQL injection vulnerability in their website settings and listing endpoints. An authenticated user can exploit a flaw in how the DateFilter column key parameter is processed to extract sensitive database content, including administrator password hashes. The vulnerability exists because user input is directly inserted into SQL queries without proper escaping, allowing an attacker to break out of the intended query structure and run arbitrary SQL commands.
CVE-2026-55431HIGH 7.7
Coder's `coder open app` command, which helps developers quickly access workspace applications, has a credential exposure vulnerability. When a user runs this command on a workspace with a malicious app definition, the CLI can be tricked into opening a URL that contains their session token—the authentication credential that proves they're logged in. An attacker who controls a workspace's app template can craft a URL that captures this token, potentially gaining unauthorized access to the user's Coder account and resources. The vulnerability affects Coder versions before 2.29.7, 2.32.7, 2.33.8, and 2.34.2.
CVE-2026-55874HIGH 7.7
SeaweedFS, a distributed storage system, contains a path traversal vulnerability in its S3 API gateway that allows authenticated users to bypass bucket isolation. An attacker with valid credentials scoped to one bucket can use manipulated copy-source headers to read objects stored in other buckets. The flaw stems from insufficient validation of dot-dot (..) path segments in the X-Amz-Copy-Source header during CopyObject and UploadPartCopy operations. This breaks a fundamental security boundary in multi-tenant storage systems. The vulnerability affects all versions prior to 4.34.
CVE-2026-56268HIGH 7.7
Flowise, a popular open-source platform for building conversational AI applications, has an information disclosure flaw in versions before 3.1.2. An attacker with a valid API key to one workspace can query an unprotected endpoint and retrieve sensitive configuration details—including system prompts, node settings, and credential IDs—from chatflows across other workspaces that lack API key protection. This occurs because the API endpoint fails to enforce workspace boundaries when returning chatflow data.
CVE-2026-56689HIGH 7.7
Dell PowerFlex Manager versions before 5.1.0.1 contain an SQL injection vulnerability that allows a low-privileged attacker with network access to run unauthorized database queries. The flaw could lead to exposure of sensitive data stored within PowerFlex Manager. This is a remote vulnerability that does not require special access conditions to trigger, making it a meaningful risk for organizations managing Dell storage infrastructure.
CVE-2026-57920HIGH 7.7
Peplink InControl 2 is vulnerable to an access-control bypass affecting REST API endpoints. An authenticated attacker can inject a semicolon character into requests to certain `/rest/o/{orgId}` endpoints to circumvent access-control rules and read sensitive organizational data. The vulnerability exists in versions through 2.14.2 and was patched on June 3, 2026. Because exploitation requires a valid login and does not enable data modification or system disruption, the risk is containable but significant for organizations managing multi-tenant deployments.
CVE-2026-58207HIGH 7.7
NATS Server, the popular messaging platform used in cloud and edge deployments, contains a denial-of-service vulnerability in its connection monitoring feature. An authenticated client can crash the server by sending specially crafted pagination parameters (Offset and Limit values) that cause integer overflow in the server's internal calculations. The crash disrupts all connected clients and messaging until the server restarts. The vulnerability affects NATS Server versions before 2.14.3 and 2.12.12.
CVE-2026-58423HIGH 7.7
A flaw in how LFS (Large File Storage) systems validate SSH authentication allows an authenticated user to bypass normal access controls and read files from private repositories they shouldn't be able to access. The vulnerability requires an attacker to already have valid credentials, but they can then craft a malformed SSH command to circumvent permission checks. This is a confidentiality risk—an attacker gains unauthorized visibility into sensitive code and data—but doesn't allow modification or deletion.
CVE-2026-58460HIGH 7.7
A vulnerability in react-native-receive-sharing-intent, a library that handles file sharing on Android, allows a malicious app installed on the same device to overwrite files in another app's private storage. An attacker can craft a specially formatted file name containing path traversal sequences (like "../") and use Android's file sharing mechanism to trick the vulnerable app into writing files outside its intended cache directory. This could result in corrupted databases, modified configuration files, or poisoned cached data that alters the app's behavior.
CVE-2026-59092HIGH 7.7
JuiceFS versions up to 1.3.1 contain a critical flaw that leaves debug and metrics endpoints exposed without authentication. An attacker can access these endpoints to retrieve sensitive information—including database credentials embedded in process command lines—that grants them full control over the filesystem's metadata layer. This vulnerability also enables information disclosure about internal system state and can be exploited to disrupt service availability.
CVE-2026-59095HIGH 7.7
LobeChat versions before 2.2.10-canary.18 contain a server-side request forgery (SSRF) vulnerability that allows authenticated attackers to make the LobeChat server initiate HTTP requests to attacker-specified URLs. Two endpoints—the skill import service and topic cover image fetcher—bypass the application's protective SSRF filtering, enabling attackers to target internal network addresses including cloud metadata endpoints. This exposes internal service responses and potentially cloud credentials to unauthorized disclosure.
CVE-2026-59216HIGH 7.7
Open WebUI versions before 0.10.0 contain a session hijacking vulnerability that allows authenticated users to execute Python code or invoke tools within another user's session. An attacker who discovers another user's Socket.IO session identifier through the ydoc:document:join event can leverage the get_event_call handler to run arbitrary code interpreter commands or tool invocations in that victim's context, bypassing the intended session isolation. The vulnerability requires authentication and user interaction, but succeeds because the server validates only that a session is connected, not that the requesting user owns it.
CVE-2026-59221HIGH 7.7
Open WebUI, a self-hosted AI platform, contains a path traversal vulnerability in its terminal routing that allows authenticated users to access files and directories outside the intended sandbox. The vulnerability exists because the application only decodes percent-encoded URL paths eight times during normalization, but an attacker can craft a payload with nine levels of encoding to bypass this check and reach sensitive files on the server.
CVE-2026-59832HIGH 7.7
SiYuan is an open-source note-taking and knowledge management application. Before version 3.7.1, an authenticated user could exploit improper path handling in the snippets feature to read sensitive files from the application's configuration and database directories. The vulnerability allows an attacker who has valid SiYuan credentials to bypass directory containment checks and access workspace secrets and the document database by crafting specially-formed requests with path traversal sequences.
CVE-2026-60002HIGH 7.7
OpenSSH clients before version 10.4 are vulnerable to a use-after-free memory error that occurs when a server changes its host key during the key re-exchange phase of an SSH connection. This defect allows an attacker to potentially read sensitive data or crash the client application. The vulnerability is triggered only on the client side and requires specific conditions during the key exchange negotiation to exploit.
CVE-2026-6901HIGH 7.7
A vulnerability in B&R Industrial Automation's APROL platform allows an attacker with local access to manipulate the application's search path and load malicious files. Because APROL searches for libraries in directories controlled by an attacker before checking trusted system locations, an adversary can place a compromised library in a predictable location and trick the application into executing it. This compromises both the confidentiality and integrity of systems running the vulnerable software.
CVE-2026-8592HIGH 7.7
A critical flaw in Rapid7's InsightConnect AWK Plugin allows attackers to run arbitrary commands on Linux systems. The vulnerability exists in how the plugin processes text and expressions, failing to properly sanitize user input before passing it to shell commands. An attacker without credentials can exploit this remotely to gain full command execution on affected systems.
CVE-2026-8660HIGH 7.7
A command injection vulnerability exists in Rapid7's InsightConnect Ping Plugin on Linux systems. The vulnerability stems from improper handling of user-supplied input in the ping action's host parameter. An unauthenticated attacker can craft malicious input that breaks out of the intended ping command and executes arbitrary operating system commands with the privileges of the InsightConnect process. This is a network-accessible vulnerability that requires no user interaction or authentication to exploit.
CVE-2026-8665HIGH 7.7
A command injection vulnerability exists in Rapid7 InsightConnect's Translate Plugin on Linux systems. An attacker can send specially crafted requests containing malicious input in the text or expression parameters of the TR action, which the plugin fails to properly sanitize before using in shell commands. This allows remote execution of arbitrary operating system commands with the privileges of the InsightConnect process. No authentication is required to exploit this vulnerability.
CVE-2026-8666HIGH 7.7
A flaw in Rapid7's InsightConnect Traceroute Plugin allows attackers to inject and execute arbitrary operating system commands on Linux systems. The vulnerability exists because the plugin fails to properly validate user-supplied input—specifically the host, port, max_ttl, count, or time_out parameters—before using them to construct shell commands. An attacker with network access can exploit this to run malicious commands with the privileges of the plugin process, potentially compromising the affected system.
CVE-2026-9099HIGH 7.7
Keycloak contains an authorization bypass in its Admin REST API that allows an authenticated administrator with limited permissions to rearrange group hierarchies in an unexpected way. Specifically, an admin managing a low-privilege group can move a high-privilege group (like one with realm-admin access) to be a child of their own group. Because Keycloak's group permissions cascade hierarchically, this manipulation grants the attacker unintended management authority over the members of the elevated group—including the ability to reset passwords. An attacker exploiting this could reset an administrator's password, take over their account, and ultimately compromise the entire Keycloak realm.
CVE-2026-9165HIGH 7.7
Red Hat Advanced Cluster Security for Kubernetes (RHACS) has a vulnerability in its Central management component that fails to restrict the complexity of GraphQL queries. An attacker with valid API credentials can craft extremely nested queries that consume excessive system resources, effectively freezing the management plane and preventing legitimate administrative operations. This is a denial-of-service issue that targets authenticated users—meaning someone with legitimate access, insider threats, or compromised credentials can exploit it.
CVE-2026-9709HIGH 7.7
Cornerstone, a premium WordPress page builder bundled with the X theme, contains a flaw in its REST API that fails to properly check user permissions. This allows any logged-in WordPress user to retrieve sensitive metadata about other users—including their roles, session tokens, and stored payment information—without authorization. The vulnerability affects versions before 7.8.9. This is a serious information disclosure issue because it bridges the gap between authentication (someone has a WordPress login) and authorization (whether they should see that specific data).
CVE-2026-9710HIGH 7.7
The Cornerstone premium page builder plugin for WordPress (versions before 7.8.8, bundled with the X theme) has a critical authentication flaw. A legitimate WordPress user with login access can exploit a missing permission check to retrieve sensitive user metadata—including password hashes in plaintext—for any other user on the site. This requires only standard login access; the attacker does not need administrator privileges. The vulnerability stems from improper validation on a CSS-preview handler that should have been restricted but is instead exposed to all logged-in users.
CVE-2026-9804HIGH 7.7
KubeVirt's virt-exportserver contains a path traversal flaw that allows authenticated attackers with namespace-level access to read arbitrary files from the exporter pod. An attacker can exploit this by placing a symbolic link in an exported filesystem that points outside its intended boundary, effectively bypassing file access restrictions and exposing sensitive data stored on the pod.
CVE-2019-25722HIGH 7.6
Dräger's patient monitoring devices contain hard-coded login credentials embedded in their source code and are vulnerable to denial-of-service attacks via malformed network packets. An attacker with physical access can use these credentials to gain unauthorized entry and reconfigure clinical settings. A remote attacker can crash the devices repeatedly, severing network connectivity and interrupting patient monitoring—a particularly serious concern in hospital environments where continuous surveillance is critical to patient care.
CVE-2025-15655HIGH 7.6
Mojoomla School Management contains a SQL injection vulnerability that allows authenticated administrators to execute arbitrary SQL commands against the underlying database. An attacker with high-level privileges can exploit this flaw to read sensitive data, modify school records, or cause service disruptions. The vulnerability affects all versions up to and including 93.2.0.
CVE-2026-11774HIGH 7.6
389 Directory Server contains an integer overflow vulnerability in its SASL authentication layer that allows authenticated attackers to bypass size restrictions and overflow heap memory. An attacker with valid domain credentials (such as any user in a FreeIPA or Red Hat Identity Management environment) can send a specially crafted authentication packet that causes an integer wraparound, enabling them to write up to 2MB of malicious data into memory. This can crash the directory service or, in some cases, lead to remote code execution. The vulnerability requires prior authentication but is easily triggerable over the network.
CVE-2026-11998HIGH 7.6
AngularJS versions 1.2.0-rc.3 and later contain a flaw in their Strict Contextual Escaping (SCE) security mechanism that allows attackers to bypass protections designed to prevent malicious scripts from executing. By crafting specially-formed URLs, an attacker can trick the escaping logic into accepting unsafe resource URLs—such as those pointing to malicious JavaScript files or iframes—that should have been blocked. When a victim visits a web application vulnerable to this flaw, the attacker's script runs in the victim's browser with full access to that application's data and functionality. The attack requires user interaction (visiting a malicious page or link) but no special privileges.
CVE-2026-13449HIGH 7.6
IBM Business Automation Manager Open Editions versions 9.0.0 through 9.4.2 contain an XML external entity injection (XXE) vulnerability. An authenticated attacker can submit specially crafted XML to the application, allowing them to extract sensitive data from the system or trigger resource exhaustion attacks that degrade availability. The vulnerability requires valid credentials but poses meaningful risk in environments where internal users or compromised accounts could be leveraged.
CVE-2026-13707HIGH 7.6
A session fixation vulnerability has been identified in Wikimedia Foundation's OAuth implementation that allows an attacker to hijack user sessions under specific conditions. Session fixation occurs when an attacker forces a user to use a known session identifier, then exploits that identifier to gain unauthorized access to the user's account. This vulnerability requires the attacker to have some level of access and the user to interact with a malicious link, but once successful, grants the attacker full access to the compromised account's permissions and data.
CVE-2026-20252HIGH 7.6
A vulnerability in Splunk Enterprise and Splunk Cloud Platform allows low-privileged users to make unauthorized server-side requests to internal systems through the PDF export feature in Dashboard Studio. The flaw stems from weak validation of trusted domains—attackers can bypass the allowlist by registering subdomains (e.g., docs.splunk.com.evil.com) and leveraging automatic HTTP redirect following to reach unintended targets. An authenticated user without admin or power roles can exploit this to probe or attack internal infrastructure.
CVE-2026-24782HIGH 7.6
Kiteworks, a platform designed to securely manage private data networks, contains multiple SQL injection flaws in its Secure Data Forms feature. Prior to version 9.3.0, an authenticated user with FormBuilder role permissions can exploit these vulnerabilities to access or alter form definitions belonging to other users and potentially modify some system-wide settings. This is a privilege escalation and data exposure risk that requires prompt patching.
CVE-2026-35327HIGH 7.6
Oracle WebCenter Content contains a flaw that allows an authenticated user with low-level permissions to gain unauthorized access to sensitive data or make unauthorized changes to documents and records through the web interface. The vulnerability requires the attacker to trick another user into performing an action (such as clicking a link or opening a file), but once successful, can expose critical business information or allow data manipulation. The issue affects two specific versions of the software and could also impact other Oracle systems that depend on WebCenter Content.
CVE-2026-39951HIGH 7.6
Cacti, a widely-used open-source tool for monitoring system performance and managing infrastructure faults, contains a stored SQL injection flaw in its Reports feature. An authenticated attacker can inject malicious SQL code through the graph_name_regexp parameter, which gets stored in the database and executed when accessed later. The vulnerability affects Cacti version 1.2.30 and earlier; it has been patched in version 1.2.31. The threat requires an existing user account to exploit, but once compromised, the attacker can read sensitive data, modify records, or degrade system availability.
CVE-2026-41003HIGH 7.6
A vulnerability in Spring Security allows attackers who can control certain configuration values to inject and execute arbitrary code within HTML forms generated by the framework's security filters. The attack requires that an attacker first gain the ability to modify RelyingPartyRegistration settings—typically through compromised credentials, misconfigured access controls, or supply-chain interference—and then trick a user into interacting with a malicious form. Once the malicious code executes in the user's browser, the attacker can steal session tokens, harvest credentials, or perform actions on behalf of the victim.
CVE-2026-41234HIGH 7.6
Froxlor, an open-source server administration platform, contains a vulnerability in its DNS management API that allows authenticated users to break out of TXT record fields and inject malicious DNS directives. An attacker with customer-level DNS editing permissions can inject newline characters into TXT record values, causing them to span multiple lines in the generated BIND zone file. This allows injection of arbitrary BIND directives like `$INCLUDE` or `$GENERATE`, as well as unauthorized DNS records (A, MX, CNAME entries). The vulnerability affects all versions prior to 2.3.7 and is notable because it bypassed an earlier attempted fix for similar issues in other record types.
CVE-2026-41518HIGH 7.6
Chartbrew, an open-source data visualization platform, contains a stored cross-site scripting (XSS) vulnerability affecting versions 4.9.0 through 5.0.0. A project editor can inject malicious HTML and JavaScript into chart legend fields, which is then executed in the browsers of anyone viewing the public dashboard—including unauthenticated users—without requiring any user interaction. This allows an attacker to steal sensitive data, hijack user sessions, or perform actions on behalf of viewers.
CVE-2026-42558HIGH 7.6
Xibo, an open-source digital signage platform, contains a vulnerability that allows privileged users to inject malicious code that breaks out of a security sandbox and executes in the browser. This is a chained vulnerability combining stored cross-site scripting (XSS) with an iframe sandbox escape. To exploit it, an attacker must already have administrative privileges to create datasets and configure data connectors—capabilities not available to standard users. The vulnerability affects Xibo versions before 4.4.2.
CVE-2026-45012HIGH 7.6
ApostropheCMS, a widely-used open-source Node.js content management platform, contains a vulnerability in how it handles rich-text widget imports. If you can log into an Apostrophe instance and edit rich-text content, you can trick the server into fetching files or data from URLs you control. If those URLs serve image data, Apostrophe will save and re-host the content, potentially exposing sensitive information that was returned by the targeted server. This requires authentication, so it's a threat from trusted users or compromised accounts—not an unauthenticated attack on the public internet.
CVE-2026-46699HIGH 7.6
conda-smithy, a widely-used tool for building conda packages through automated CI services, contains a vulnerability that could allow an attacker to gain unauthorized write access to feedstock repositories on GitHub. The flaw stems from the system using mutable GitHub usernames—which can be changed or reassigned—as the basis for routing repository access invitations, rather than using stable, permanent GitHub user identifiers. If someone changes their GitHub username or if GitHub reassigns a username after account deletion, an attacker could potentially intercept repository invitations intended for the original user and gain write access to critical package build repositories. This vulnerability affects conda-smithy versions prior to 3.61.0.
CVE-2026-49374HIGH 7.6
JetBrains TeamCity versions prior to 2026.1 suffer from insufficient permission checks that allow authenticated users to access sensitive build configuration parameters they should not be able to view. An attacker with valid login credentials but limited project access could extract confidential build settings, secrets, or other sensitive configuration data by exploiting this authorization flaw.
CVE-2026-49771HIGH 7.6
A SQL injection vulnerability exists in 10Web Photo Gallery up through version 1.8.41 that allows an attacker with administrative privileges to extract sensitive database information without triggering obvious application errors. The vulnerability is triggered through improper handling of user-supplied input in SQL queries, enabling blind SQL injection attacks where the attacker infers database contents through timing or boolean-based response analysis rather than direct error messages.
CVE-2026-5068HIGH 7.6
A vulnerability in Zephyr's Bluetooth host stack allows a nearby attacker to crash devices or corrupt memory by sending specially crafted Bluetooth Low Energy (BLE) packets. The flaw occurs when applications enable a feature called segmentation for handling large BLE messages, but configure their memory pools with insufficient space to track incoming data. An attacker within BLE range (typically 10–240 meters depending on device and antenna) can exploit this without any authentication, causing the device to crash or potentially enabling further compromise through heap corruption.
CVE-2026-53705HIGH 7.6
GStreamer's audio decoder has a critical flaw that can crash applications or allow attackers to run malicious code. When a user opens a specially crafted WavPack audio file, the decoder miscalculates how much memory to allocate for audio data due to an integer overflow. This causes the decoder to write data far beyond the allocated buffer, corrupting heap memory and potentially compromising the system. The vulnerability affects both 32-bit and 64-bit systems.
CVE-2026-53981HIGH 7.6
Cap-go versions before 12.128.2 have a critical account security flaw in how users change their email address. An attacker who gains temporary access to someone's logged-in session (through phishing, shared device, or session hijacking) can change the account's registered email without requiring a password or second authentication factor. Once the email is changed to an attacker-controlled address, the attacker can reset the password and take permanent control of the account, locking out the legitimate owner completely.
CVE-2026-54013HIGH 7.6
Open WebUI is an offline-capable AI platform that stores user and model metadata, including profile images. A security fix applied to user and webhook profile images in version 0.9.6 was incompletely implemented—model profile images were overlooked. Any authenticated user with default workspace permissions can upload a malicious SVG image disguised as a model's profile picture. When another user views that image, the embedded JavaScript executes in their browser with full account privileges, enabling complete account takeover. The vulnerability requires an authenticated attacker and user interaction, but the permissions involved are enabled by default.
CVE-2026-54056HIGH 7.6
Kitty, a GPU-accelerated terminal emulator used across multiple platforms, has a flaw in its drag-and-drop handling that can allow an attacker to write files to unintended locations on a user's system. When a user drags and drops files from a remote source into Kitty (versions 0.47.0 and 0.47.1), the application stages those files in a temporary directory. An attacker can exploit a race condition combined with symlink handling to cause Kitty to write to files outside the staging area—potentially overwriting or truncating important files that the Kitty user has access to. The vulnerability requires user interaction (the user must perform a drag-and-drop action) and works only on case-sensitive filesystems, which narrows but does not eliminate the risk.
CVE-2026-54317HIGH 7.6
Home Assistant, a popular open-source home automation platform, contains an authentication bypass in its Konnected integration prior to version 2026.6.0. The integration exposes an HTTP endpoint that should verify API access tokens, but the verification logic only applies to write operations (POST, PUT). Read operations (GET) lack any authentication check entirely, allowing unauthenticated attackers on the local network to retrieve sensitive sensor data and configuration details.
CVE-2026-55409HIGH 7.6
Filament is a popular Laravel development framework that includes a RichEditor component for handling rich text input. Between versions 3.0.0 and 3.3.52, when a RichEditor field is disabled, the component displays its stored content without removing potentially dangerous HTML and JavaScript code. If an attacker can inject malicious code into that field's data—for example, through an API call or by tampering with form state—it will execute in the browsers of users viewing the form, compromising their sessions or stealing sensitive information. The fix arrives in version 3.3.53.
CVE-2026-55583HIGH 7.6
Twenty, an open-source CRM platform, contains a flaw that allows authenticated users to view and manipulate AI agent data belonging to other workspaces on the same server instance. A workspace owner or user with AI settings enabled can access another workspace's chat history, tool interactions, and AI turn evaluations by knowing the victim's AI agent ID or turn ID—both of which are exposed in the application's settings page URL. This affects versions prior to 2.9.0.
CVE-2026-55746HIGH 7.6
Cotonti 1.0.0 contains a stored cross-site scripting (XSS) vulnerability in its Personal File Storage module. An authenticated user can inject malicious JavaScript into a folder title, which is then stored and executed in the browsers of anyone who views that folder—including administrators and other users accessing shared or public folders. This is a particularly dangerous form of XSS because the payload persists in the application's data and affects multiple users, not just the attacker.
CVE-2026-56052HIGH 7.6
FunnelKit Funnel Builder contains a blind SQL injection vulnerability that allows an attacker with high-level privileges (such as an administrator) to execute arbitrary SQL queries against the underlying database without seeing the results directly. The vulnerability exists in versions up to and including 3.15.0.5. While the attacker needs administrative credentials to exploit this, successful exploitation could lead to unauthorized data access and potential system disruption.
CVE-2026-56208HIGH 7.6
A heap buffer overflow has been discovered in libaom, the reference implementation of the AV1 video codec. When the encoder's Look-Ahead Processing mode is enabled with certain frame lag settings, it incorrectly writes 232 bytes of data beyond the intended buffer boundary on every frame after the second. This corruption can crash the encoder process or, in worst-case scenarios, enable an attacker to execute arbitrary code. The vulnerability is reachable if an attacker can control encoder settings—a realistic threat in transcoding services, WebRTC applications, or any system that accepts untrusted AV1 encoding parameters.
CVE-2026-56231HIGH 7.6
Capgo versions before 12.128.2 contain a critical authorization flaw that allows authenticated users to hijack build jobs belonging to other customers. If you have permission to build apps in your own tenant, an attacker can use that legitimate access to start or cancel build jobs owned by completely different organizations by manipulating the job identifier. This could disrupt competitors' deployments, waste their compute resources, and potentially inflate their bills—all while appearing to come from the attacker's authorized account.
CVE-2026-56239HIGH 7.6
Capgo versions before 12.128.2 contain a billing privilege escalation flaw in a Supabase database function that handles usage overage charges. The function runs with elevated database owner privileges but fails to verify that the user initiating the request actually has authorization to modify billing for the target organization. An authenticated user could exploit this via remote API calls to tamper with billing records, deduct credits from other organizations' accounts, or inject fraudulent overage charges without proper authorization checks.
CVE-2026-56249HIGH 7.6
Capgo versions before 12.128.2 contain a flaw that allows authenticated users with channel creation permissions to hijack existing channels by reusing their names. An attacker can exploit a gap in how the system validates channel names versus how it creates or updates them, enabling unauthorized ownership changes and modification of production channel settings. This is not a remote unauthenticated attack—the attacker must already have valid credentials and the app.create_channel permission—but the risk is substantial because internal users or compromised accounts can cause significant operational damage.
CVE-2026-57985HIGH 7.6
Microsoft Edge (Chromium-based) contains a flaw in how it validates user input, enabling attackers to execute arbitrary code on a victim's machine via the network. The attack requires user interaction—such as visiting a malicious website or opening a crafted file—but does not require any special privileges or authentication to succeed. This is a high-severity vulnerability that affects confidentiality, integrity, and system availability.
CVE-2026-58056HIGH 7.6
RustDesk contains an authorization bypass vulnerability where a user granted only file-transfer permissions can exploit insufficient access controls to perform unauthorized actions including keyboard input, mouse control, and screen capture. The vulnerability exists because the application checks individual feature permissions rather than validating that the requester's session type authorizes the requested action. When a file-transfer session is established, the application fails to clear capability flags, leaving them accessible for abuse by an attacker with limited legitimate access.
CVE-2026-58376HIGH 7.6
Dolibarr, an open-source ERP and CRM platform, contains a SQL injection flaw in its REST API that permits authenticated users to extract sensitive database contents. The vulnerability exists in two API endpoints—setup and multicurrencies—where user-supplied filter parameters are insufficiently validated. An attacker with valid API credentials can bypass the weak parenthesis-checking validation and inject malicious SQL commands to read arbitrary data, including password hashes and API keys. This requires prior authentication but poses a significant confidentiality risk once an attacker gains API access.
CVE-2026-6428HIGH 7.6
Koha, an open-source library management system, contains a SQL injection flaw in its reporting module that allows authenticated staff users to extract sensitive data from the underlying database. An attacker with legitimate staff credentials and Reports module access can craft a malicious filter parameter to bypass SQL safeguards and read arbitrary records—including password hashes, two-factor authentication secrets, personal borrower information, API keys, and session tokens. The vulnerability exists because user input is directly concatenated into a database query without proper parameterization, a preventable mistake that was previously patched in related code but overlooked in this particular reports script.
CVE-2026-6682HIGH 7.6
FatFS, a popular embedded file-system library, contains an integer overflow bug in its volume-mounting code that can be exploited to corrupt file-size metadata. When FatFS calculates the total size of the file allocation table during mount, a multiplication operation can wrap around due to insufficient bounds checking, allowing an attacker to supply a malicious disk image or FAT32 partition that causes the library to misinterpret file sizes. Downstream code that relies on these corrupted values can then read or write beyond intended boundaries, leading to memory corruption, information disclosure, or denial of service. The vulnerability affects FatFS version R0.16 and earlier.
CVE-2026-6687HIGH 7.6
FatFs R0.16 and earlier have a stack overflow vulnerability in the f_getlabel() function that can be triggered when processing exFAT filesystems. The bug occurs because the code trusts the exFAT label length field (XDIR_NumLabel) without validating it against specification limits. An attacker with physical access to a device can craft a malicious exFAT filesystem that, when mounted and processed by vulnerable FatFs code, causes a stack buffer overflow. This can lead to code execution or system compromise.
CVE-2026-6688HIGH 7.6
FatFs R0.16 and earlier has a buffer overflow vulnerability in how it handles long filenames. When long filename (LFN) support is enabled, the library can return filenames up to 255 characters, but application code that calls FatFs often copies these filenames into fixed-size buffers without checking the length first. This mismatch between what FatFs can return and what callers expect creates a classic overflow condition. An attacker with physical access to a storage device could craft a malicious filesystem with an exceptionally long filename to trigger the overflow and potentially execute code or crash the system.
CVE-2026-6961HIGH 7.6
Mattermost has a path traversal vulnerability in how it processes filenames from federated servers during shared channel file synchronization. An attacker controlling a federated Mattermost instance can craft malicious filenames with directory traversal sequences (e.g., ../../../) to write files to unintended locations on a target server's filesystem. This could allow an attacker to overwrite configuration files, inject malicious content, or degrade system availability.
CVE-2026-7831HIGH 7.6
UltraVNC viewer versions up to 1.8.2.2 contain a stack buffer overflow vulnerability triggered when connecting to a malicious VNC server. The flaw occurs in how the viewer processes the server's desktop name during the initial connection handshake. If a server advertises a desktop name exactly 2024 bytes long, the viewer's buffer handling code writes a null terminator one byte beyond its allocated stack buffer. On systems without stack protection, this single-byte overflow can corrupt adjacent data; on systems with stack canary protection enabled, the corrupted canary causes the viewer to crash. An attacker must trick a user into connecting to their malicious VNC server to trigger the vulnerability.
CVE-2026-9809HIGH 7.6
Mautic 7 contains a stored cross-site scripting (XSS) vulnerability in its Projects component. When project names are displayed as tags or in hover-over tooltips on admin pages—like campaign, email, or form management screens—the application fails to sanitize user input. An authenticated attacker with project creation or editing permissions can inject malicious JavaScript into a project name. When an administrator later views any entity tied to that compromised project and hovers over its tag, the attacker's script runs in the admin's browser with their full privileges. This could lead to unauthorized administrative actions, system configuration changes, or data theft.
CVE-2016-20076HIGH 7.5
The WordPress Simple-Backup plugin version 2.7.11 is vulnerable to unauthorized file access and deletion attacks. An attacker without any login credentials can manipulate specific parameters in the plugin's backup tool to either download sensitive files like database configurations and backups, or delete critical files such as .htaccess. The vulnerability stems from inadequate validation of user input, allowing attackers to navigate the server's directory structure and target files outside the intended backup folder.
CVE-2016-20081HIGH 7.5
HB Audio Gallery Lite version 1.0.0 contains a critical flaw that allows attackers to download any file from a website where the plugin is installed—including sensitive configuration files—without needing to log in or authenticate. The vulnerability exists in how the plugin handles file download requests, specifically in the audio-download.php endpoint. By manipulating the file path parameter with directory traversal sequences (e.g., '../'), attackers can escape the intended gallery directory and access files like wp-config.php, which contains database credentials and security keys.
CVE-2017-20248HIGH 7.5
Apptha Slider Gallery version 1.0 contains a path traversal flaw that lets attackers download any file from the server without needing to log in. By crafting requests with directory-traversal sequences (such as ../) in the imgname parameter sent to asgallDownload.php, an attacker can escape the intended image directory and retrieve sensitive files like configuration files, database backups, or source code. This is a remote attack that requires no authentication or user interaction.
CVE-2017-20250HIGH 7.5
Mac Photo Gallery version 3.0 has a path traversal vulnerability in its download functionality that allows anyone on the internet to retrieve arbitrary files from the affected server without authentication. By crafting specially formatted requests to the macdownload.php script and manipulating the albid parameter with directory traversal sequences (such as ../), an attacker can escape the intended plugin directory and download sensitive files like WordPress configuration files. This is a straightforward but serious flaw because it requires no special privileges, no user interaction, and no authentication to exploit.
CVE-2018-25391HIGH 7.5
HaPe PKH 1.1 contains a critical authorization bypass flaw that allows anyone on the internet to delete administrative records without logging in or proving identity. An attacker can craft simple requests to remove administrator accounts and system updates by directly specifying which records to delete. The application fails to verify whether the requester has permission to perform these destructive actions, making it trivial to sabotage the system's core administrative functions.
CVE-2018-25396HIGH 7.5
Heatmiser Wifi Thermostat version 1.7 exposes administrator credentials in plaintext to anyone with network access. An attacker can visit a specific page (networkSetup.htm) without logging in and retrieve the admin username and password directly from the HTML. This is a serious problem because it bypasses all authentication and gives attackers full control of the device.
CVE-2018-25408HIGH 7.5
A vulnerability in Open ISES Project version 3.30A allows anyone on the internet to download files from an affected server without needing to log in. An attacker can craft a specially formatted request to the ajax/download.php endpoint that uses path traversal techniques (such as ../ sequences) to escape the intended download directory and retrieve sensitive files like configuration files, database backups, or system files. The vulnerability requires no authentication, no special user interaction, and can be exploited over the network.
CVE-2018-25426HIGH 7.5
WinMTR version 0.91 has a denial-of-service flaw that allows remote attackers to crash the application without authentication. By sending a specially crafted input file with approximately 238 bytes of repeated characters, an attacker can trigger a buffer overflow condition that terminates the application. This is a straightforward denial-of-service attack with no authentication requirement, making it accessible to any network-adjacent threat actor.
CVE-2018-25437HIGH 7.5
WordPress sites using CherryFramework Themes version 3.1.4 are exposed to an information disclosure vulnerability that allows anyone on the internet to download complete backup archives of the site's theme files without authentication. An attacker can directly request a file called download_backup.php from the theme's admin directory and receive a ZIP file containing the entire wp-content/themes directory, potentially exposing sensitive configuration, custom code, and theme logic.
CVE-2019-25762HIGH 7.5
Joomla! Component JoomProject version 1.1.3.2 contains a privacy vulnerability that exposes sensitive user information without requiring authentication. An attacker can craft a simple web request to retrieve user IDs, names, and email addresses in JSON format. This is a direct information disclosure—no data modification or service disruption occurs—but the exposure of user details poses significant privacy and social engineering risks.
CVE-2020-37255HIGH 7.5
WordPress Time Capsule Plugin version 1.21.16 contains a critical authentication bypass flaw. An attacker can send a specially crafted web request with a specific header to gain full administrator access to a WordPress site without knowing any password. This allows them to take complete control of the website and its contents.
CVE-2021-47986HIGH 7.5
Parse Server versions before 4.10.0 contain a supply chain vulnerability caused by incorrect version tags pushed to the official repository. These tags pointed to unreviewed code residing in a personal developer fork rather than the main codebase. An attacker could exploit this by tricking developers into declaring one of these malicious version tags as a dependency, causing their builds to pull and execute potentially harmful code. The vulnerability exploits the trust developers place in official version numbers and repository tags.
CVE-2021-47987HIGH 7.5
Parse Server experienced a supply chain incident where unauthorized version tags were pushed to its official repository, pointing to an unreviewed fork controlled by a contributor with write access. While no malicious code was confirmed, the unreviewed nature of these tags created significant risk. Organizations using git-based dependencies directly referencing affected tags (such as parse-server#4.9.3) faced exposure to potentially unvetted code. The incident highlights the importance of dependency pinning and repository access controls.
CVE-2023-43688HIGH 7.5
Malwarebytes versions 4.x and 5.x contain a heap buffer overflow vulnerability in buffer encryption utilities. An unauthenticated attacker on the network can trigger this condition to crash the Malwarebytes service, causing a denial of service. The vulnerability does not allow data theft or system compromise—it targets availability. While network-accessible, the technical bar to exploit is moderate rather than trivial.
CVE-2023-54350HIGH 7.5
The WordPress Augmented-Reality plugin contains a critical flaw in its elFinder file manager connector that allows anyone on the internet to upload and run malicious PHP code on affected servers without needing to log in. An attacker can craft special requests to the connector.minimal.php file, use commands to create files, and then execute those files—giving them the ability to take over the server.
CVE-2023-54357HIGH 7.5
The Joomla com_booking component version 2.4.9 has a flaw that lets anyone on the internet harvest user account information without logging in. By making simple web requests with different user ID numbers, an attacker can discover usernames, display names, and email addresses stored in the system. This is a classic enumeration attack—attackers don't need valid credentials or special access, just the ability to send HTTP requests and patience to try many ID values.
CVE-2023-54365HIGH 7.5
Traefik, a widely-used API gateway and reverse proxy, is vulnerable to a denial-of-service attack that allows remote attackers to disable the service without authentication. The vulnerability stems from how Traefik handles HTTP/2 connections—attackers can rapidly open and close streams to overwhelm server resources. This flaw was inherited from Go's standard HTTP/2 library and affects Traefik versions before 2.10.5 and 3.0.0-beta4. No special privileges or interaction is required; an attacker on the network can trigger the issue simply by sending crafted HTTP/2 requests.
CVE-2024-14036HIGH 7.5
Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 contain a denial of service flaw affecting hospital networks. An attacker on the same network can send specially crafted, unencrypted discovery messages that force the affected system to consume excessive CPU resources. Once the system is overloaded, it stops processing legitimate discovery messages, disrupting device communication. This requires network access but no authentication.
CVE-2024-32729HIGH 7.5
CVE-2024-32729 is a path traversal vulnerability in QuantumCloud Conversational Forms for ChatBot that allows attackers to access files and directories outside the intended restricted folder. An attacker with network access can exploit this flaw to read sensitive files from the application's host system without authentication. The vulnerability affects all versions of the product through version 1.1.8, and the attack requires only network connectivity—no special privileges or user interaction are needed.
CVE-2024-58352HIGH 7.5
Landray OA, a collaboration and office automation platform, contains a critical flaw that allows attackers to bypass authentication entirely and extract sensitive information directly from the database. The vulnerability exists in the login helper functionality, where user input is not properly validated before being used to construct database queries. An attacker can craft a specially-formatted request to retrieve administrator credentials, database records, or—in certain configurations—write arbitrary files to the server, leading to complete system compromise. This is a post-authentication-bypass, pre-RCE chain that significantly expands the attack surface.
CVE-2024-6228HIGH 7.5
A WordPress plugin called Notifications for Forms & WordPress Actions contains a serious flaw in versions before 2.6 that lets authenticated users with basic subscriber permissions execute arbitrary PHP code on the server. The vulnerability stems from insufficient validation of user input when constructing file paths, enabling a Local File Inclusion (LFI) attack that can lead to remote code execution. Any WordPress site running this plugin below version 2.6 with user registration enabled is at risk.
CVE-2025-3110HIGH 7.5
OpenVPN Access Server versions 2.7.2 through 3.1.0 contain a flaw in how they process HTTP headers, specifically permitting bare line-feed characters (without carriage returns) in header values. This weakness enables HTTP request smuggling attacks when the server sits behind a reverse proxy—a common deployment pattern. An attacker can craft malicious requests that appear valid to the proxy but are interpreted differently by OpenVPN, allowing them to bypass security controls, inject unauthorized commands, or manipulate session state without authentication.
CVE-2025-41271HIGH 7.5
A path traversal vulnerability exists in the Waterfall WF-500 Console WebUI that allows attackers to read sensitive files from affected devices without requiring authentication. The flaw stems from improper handling of relative file paths, enabling an attacker to navigate outside intended directories and access arbitrary files on the system. This is a remote attack requiring only network access—no user interaction or special privileges needed.
CVE-2025-46315HIGH 7.5
A permissions flaw in macOS Tahoe allows applications to bypass security controls and access sensitive user data they should not be able to reach. The issue stems from insufficient access restrictions that were in place before the fix. Apple has addressed this in macOS Tahoe 26.1 by implementing additional permission enforcement mechanisms.
CVE-2025-46638HIGH 7.5
Dell BSAFE SSL-J contains a resource exhaustion vulnerability that allows an unauthenticated attacker on the network to overwhelm the application by allocating unbounded resources without limits or throttling mechanisms. This causes a denial of service condition, rendering the service unavailable to legitimate users. No authentication is required to trigger the flaw, making it accessible to any remote attacker.
CVE-2025-49403HIGH 7.5
A critical flaw in the Premium Age Verification / Restriction plugin for WordPress (versions up to 3.0.2) allows attackers to download arbitrary files from an affected server without needing to log in or authenticate. An attacker can exploit this remotely to access sensitive files such as configuration files, database backups, or private documents stored on the web server, potentially exposing credentials and other confidential data.
CVE-2025-52292HIGH 7.5
GPAC MP4Box version 2.4 contains a stack buffer overflow vulnerability in its file input handling code. An attacker can exploit this by submitting a specially crafted MP4 file, causing the application to crash or become unresponsive. This is a denial-of-service issue with no data theft or system compromise risk, but it can disrupt services that depend on MP4Box for media processing.
CVE-2025-52293HIGH 7.5
CVE-2025-52293 is a crash vulnerability in GPAC MP4Box v2.4 that occurs when the HEVC video parser encounters malformed video stream headers. An attacker can craft a specially designed HEVC Sequence Parameter Set (SPS) and deliver it to a system running MP4Box to trigger a segmentation fault, causing the application to crash and become unavailable. This is a network-exploitable denial-of-service issue that requires no user interaction or special privileges to trigger.
CVE-2025-53114HIGH 7.5
CometD, a web messaging framework used for real-time server-to-client communication, contains a denial-of-service vulnerability in multiple versions. The issue occurs when the server has enabled the acknowledgement extension—a feature that tracks message delivery—and a misbehaving client repeatedly sends the same batch identifier. This causes the server to accumulate unacknowledged messages in memory without ever clearing them, eventually consuming all available heap space and crashing the server. The vulnerability affects versions 5.0.0–5.0.22, 6.0.0–6.0.18, 7.0.0–7.0.18, and 8.0.0–8.0.8. Patches are available for all affected branches.
CVE-2025-55657HIGH 7.5
GPAC MP4Box version 2.4 contains a defect that causes the application to crash when processing a specially crafted MP4 file. An attacker can exploit this by sending a malicious MP4 to any system running the vulnerable software, resulting in service unavailability. No data theft or system compromise occurs—the impact is limited to denial of service.
CVE-2025-58024HIGH 7.5
UnboundStudio's Accordion FAQ plugin contains a vulnerability that allows authenticated users to include and execute arbitrary local files on the server. An attacker with login credentials could potentially read sensitive files or execute malicious code by manipulating how the plugin handles file inclusion requests. This is a local file inclusion (LFI) issue, not a remote file inclusion despite the CWE classification, meaning attackers must have valid user access to exploit it.
CVE-2025-59133HIGH 7.5
Projectopia versions 5.1.25.2 and earlier contain a flaw that allows attackers to view information they shouldn't have access to by manipulating how the application identifies custom user roles. An unauthenticated attacker can exploit this over the network without user interaction, potentially exposing sensitive data by directly referencing resources assigned to other roles.
CVE-2025-60467HIGH 7.5
GPAC Project's MP4Box, a multimedia framework tool, contains a flaw where freed memory is inadvertently accessed during specific filter cleanup operations. An attacker can exploit this by providing a maliciously crafted media file, crashing the application and disrupting service availability. This vulnerability affects versions before 26.02.0.