2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

422 published vulnerabilities · page 1 of 5

• CVE-2025-15653MEDIUM 6.8

  Dräger's Zeus Infinity Empowered and Zeus RS C500 anesthesia workstations have a security flaw that allows someone with physical access to a device to compromise its software through USB ports. An attacker could interfere with anesthesia delivery, alter medical data, or use the device as a stepping stone to attack a hospital network if the workstation is networked or connected to Dräger's service platform.

• CVE-2026-0048MEDIUM 6.8

  A vulnerability exists in Android's WindowState component that allows an attacker to overlay malicious UI on top of legitimate system dialogs, tricking users into granting permissions they did not intend to approve. The attack exploits a tapjacking technique where touch inputs are intercepted and misdirected. No special privileges or user awareness is required for the attack to succeed, making it a local but potentially high-impact privilege escalation vector.

• CVE-2026-0086MEDIUM 6.8

  A vulnerability in Android's DisableSupervisionActivity allows an attacker to delete supervision data on a device by exploiting a missing null check in the onCreate method. This flaw enables local privilege escalation without requiring any special permissions or user interaction, meaning the exploit could trigger automatically during normal device operation. The vulnerability affects multiple Android versions and has a medium severity rating.

• CVE-2026-36175MEDIUM 6.8

  CVE-2026-36175 is a physical authentication bypass vulnerability affecting GNCC GP5 v7.1.76. An attacker with direct physical access to a device can interrupt the boot process and inject malicious kernel boot arguments, circumventing security controls to obtain root-level access. The vulnerability requires the attacker to be present at the device during startup, making it a targeted risk rather than a remote threat.

• CVE-2025-59613MEDIUM 6.7

  CVE-2025-59613 is a memory corruption vulnerability affecting Qualcomm wireless, compute, and AR/XR platforms. The flaw occurs when the system attempts to copy data into a buffer that is smaller than the source data being transferred, causing memory to be overwritten beyond the intended boundaries. An attacker with elevated privileges on the device could exploit this to corrupt memory and potentially compromise system integrity, confidentiality, or availability. The vulnerability requires local access and administrative-level permissions to trigger.

• CVE-2025-59614MEDIUM 6.7

  A memory corruption flaw exists in multiple Qualcomm components when processing random number generator commands with an undersized output buffer. An attacker with high-level privileges on the local system can trigger this condition to corrupt memory, potentially achieving confidentiality, integrity, and availability compromise. The vulnerability requires administrator or equivalent access and cannot be exploited remotely.

• CVE-2026-10805MEDIUM 6.7

  NetworkManager, a widely used Linux network configuration utility, contains a local privilege escalation vulnerability in its dhclient backend. When processing specially crafted Manufacturer Usage Description (MUD) URLs, an authenticated local user can trigger malicious script execution to gain elevated system privileges. The vulnerability requires specific administrative configuration (non-default use of dhclient backend) and user interaction, limiting its scope but making it a meaningful risk for organizations using that backend.

• CVE-2026-20453MEDIUM 6.7

  CVE-2026-20453 is a local privilege escalation vulnerability in MediaTek's geniezone component affecting multiple SoC (System-on-Chip) firmware and chipsets. The flaw stems from missing bounds validation during a write operation, allowing an attacker who already has system-level privileges to escalate further or corrupt memory. Because the attack requires prior system access and involves no user interaction, this is a post-compromise risk rather than an initial attack vector. The vulnerability carries a CVSS 3.1 score of 6.7 (Medium severity).

• CVE-2018-25393MEDIUM 6.5

  Navigate CMS version 2.8.5 contains a flaw that allows authenticated users to download files they shouldn't have access to by manipulating the download request. An attacker with valid login credentials can craft specially-formed requests to the navigate_download.php component using directory traversal patterns (such as ../../../) to sidestep folder boundaries and retrieve sensitive system files like configuration files outside the application's normal download directory.

• CVE-2018-25421MEDIUM 6.5

  Open STA Manager version 2.3 has a security flaw that allows authenticated users to download files they shouldn't have access to. An attacker with valid login credentials can manipulate web requests to trick the application into retrieving sensitive system files, such as configuration files or data stored outside the intended application directory. The vulnerability exists in the backup module and exploits how the application handles file path requests.

• CVE-2019-25716MEDIUM 6.5

  Dräger's Infinity Delta, Delta XL, and Kappa patient monitors are vulnerable to a denial-of-service attack triggered by malformed network packets. An attacker on the same network segment can send specially crafted packets that force the monitor to reboot repeatedly, disrupting patient monitoring and causing the device to lose network connectivity and revert to default settings. This is a network-adjacent threat that degrades clinical visibility rather than exposing patient data directly.

• CVE-2019-25720MEDIUM 6.5

  Dräger patient monitoring systems (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) are vulnerable to denial-of-service attacks from attackers on the same network segment. An unauthenticated attacker can send specially crafted network packets to force the monitor to reboot repeatedly, disrupting continuous patient monitoring. The device may then revert to default settings and lose network connectivity, compounding the disruption to clinical workflows.

• CVE-2019-25721MEDIUM 6.5

  Dräger Infinity M300 wearable patient monitors running software version VG2.3.1 or earlier are vulnerable to network-based denial-of-service attacks. An attacker positioned on the same network can send specially crafted requests that force the device to reboot repeatedly, effectively taking the monitor offline and disrupting patient monitoring. This is a network-adjacent threat that requires no authentication or user interaction to trigger.

• CVE-2019-25724MEDIUM 6.5

  Dräger Infinity M300 wearable patient monitors running software version VG2.x and earlier are vulnerable to a network-based denial-of-service attack that forces repeated device reboots. An attacker positioned on the hospital network or Infinity Network can trigger these reboots until the monitor enters a failed state, requiring manual intervention to restore function. During this attack window, wireless connectivity drops, patient monitoring capability is interrupted, and alarm functions become unavailable—creating a gap in real-time clinical visibility that could delay detection of patient deterioration.

• CVE-2019-25740MEDIUM 6.5

  A vulnerability in Joomla's com_jsjobs extension version 1.2.6 allows authenticated users to delete files from the web server. An attacker who has valid login credentials can craft a malicious request that exploits how the extension handles file path parameters, bypassing intended restrictions and removing files the web server can access. This is a path traversal flaw that turns file upload/management functionality into an unauthorized deletion mechanism.

• CVE-2024-6858MEDIUM 6.5

  Arista EOS switches running in 802.1X authentication mode contain a logic flaw that can allow unauthorized devices to bypass port access controls. If an unauthenticated device is present on a port configured for multi-auth, and there is an EAPOL-capable (Extensible Authentication Protocol over LAN) device in the fallback VLAN, the unauthenticated device may be granted network access when it should remain blocked. This creates an authentication bypass condition specific to the multi-auth scenario and fallback VLAN configuration.

• CVE-2025-48977MEDIUM 6.5

  Apache Ignite REST API contains a path traversal vulnerability that allows authenticated users to read arbitrary files from the server by manipulating the log path parameter in API commands. An attacker with valid REST API credentials can escape the intended log directory and access sensitive files anywhere on the system. This affects Ignite versions 2.0.0 through 2.17.0, and the vendor has released version 2.18.0 to address it.

• CVE-2025-52766MEDIUM 6.5

  CVE-2025-52766 is a missing authorization flaw in Printeers Print & Ship that allows authenticated users to perform actions they shouldn't have permission to do. An attacker with valid login credentials can exploit improperly configured access controls to modify data or settings—for instance, altering print job configurations, shipping labels, or account information belonging to other users or tenants. The vulnerability requires an authenticated user; it cannot be exploited by unauthenticated attackers. The impact is elevation of privilege within the application, not confidentiality compromise or service disruption.

• CVE-2025-59601MEDIUM 6.5

  CVE-2025-59601 describes an information disclosure vulnerability in multiple Qualcomm wireless and audio components. When a device is factory reset through its powerline interface, sensitive configuration data may be exposed to an attacker with adjacent network access. This allows unauthorized parties to read device settings that should have been wiped during the reset process. The vulnerability does not allow modification of settings or denial of service, but the exposure of configuration details could enable further attacks or reveal sensitive operational parameters.

• CVE-2025-70101MEDIUM 6.5

  CVE-2025-70101 is a memory safety flaw in the lwext4 library, a lightweight ext4 filesystem implementation. When processing a specially crafted ext4 disk image, the library can read past the end of allocated memory due to missing validation checks. An attacker who tricks a user into opening a malicious filesystem image can trigger this out-of-bounds read, causing the application to crash. This is primarily a denial-of-service risk rather than a gateway to data theft or system compromise.

• CVE-2026-0039MEDIUM 6.5

  CVE-2026-0039 is an integer overflow vulnerability in Android's ubsan_throwing_runtime.cpp that allows an authenticated attacker to remotely crash or disable affected devices. The flaw resides in multiple functions and can be exploited without user interaction, making it a straightforward denial-of-service vector for anyone with network access to a vulnerable Android system.

• CVE-2026-0040MEDIUM 6.5

  CVE-2026-0040 is an integer overflow vulnerability in Google Android's ubsan_throwing_runtime.cpp file that allows an authenticated attacker to remotely crash the system. No special privileges or user interaction are required for exploitation, making this a straightforward denial-of-service attack vector. The flaw resides in multiple functions within a core runtime component, meaning the exposure is likely widespread across affected Android versions.

• CVE-2026-0041MEDIUM 6.5

  An integer overflow vulnerability exists in Google Android's UBSan (Undefined Behavior Sanitizer) runtime code. When triggered, the overflow causes the sanitizer itself to fail rather than safely handling undefined behavior, resulting in application crashes or service disruption. An authenticated attacker can remotely exploit this without user interaction, making it a network-reachable denial-of-service vector.

• CVE-2026-0044MEDIUM 6.5

  CVE-2026-0044 is an integer overflow vulnerability in Android's ubsan_throwing_runtime.cpp that allows an authenticated attacker to crash the system remotely. The flaw requires valid credentials to exploit but no user interaction, making it a straightforward denial-of-service vector that can disrupt device availability without requiring the attacker to execute code or escalate privileges.

• CVE-2026-0051MEDIUM 6.5

  A vulnerability in Google Android's UBSan (Undefined Behavior Sanitizer) runtime component allows an authenticated attacker to crash the system by sending malformed input to multiple functions in ubsan_throwing_runtime.cpp. The vulnerability requires valid credentials to exploit but no special privileges, and the attacker doesn't need to interact with the device user. The impact is denial of service—the system becomes unavailable—but data confidentiality and integrity are not compromised.

• CVE-2026-0052MEDIUM 6.5

  CVE-2026-0052 is an integer overflow vulnerability in Android's UBSan runtime that can be triggered remotely by an authenticated attacker to crash the affected system. The flaw exists in multiple functions within ubsan_throwing_runtime.cpp and requires only network access and valid credentials—no special privileges or user interaction needed. Successful exploitation results in denial of service, making the device temporarily unavailable.

• CVE-2026-0080MEDIUM 6.5

  CVE-2026-0080 is an integer overflow vulnerability in Google Android's ubsan_throwing_runtime.cpp that allows authenticated attackers to crash affected devices remotely. The flaw requires a valid login but no special permissions, and can be triggered without user interaction—making it a practical denial-of-service vector for an attacker with baseline Android system access.

• CVE-2026-10004MEDIUM 6.5

  Google Chrome versions before 148.0.7778.216 contain a flaw in how they validate user input within the password-handling component. An attacker can craft a malicious HTML page that, when visited by a user, tricks the browser into displaying fake password prompts or other UI elements that appear legitimate. This is a spoofing attack—the attacker doesn't steal data directly, but deceives users into believing they're interacting with genuine Chrome interface elements, potentially leading them to enter credentials or take other unintended actions.

• CVE-2026-10008MEDIUM 6.5

  Google Chrome on Android contains an uninitialized memory flaw in the GPU rendering pipeline that could allow an attacker to extract sensitive data from the browser process. An attacker would craft a malicious HTML page that, when loaded by a user, exploits how the GPU handles uninitialized memory regions—leaking fragments of previously-used data that may contain sensitive information. This is a memory disclosure vulnerability, not a code execution flaw, but information leaks can enable follow-on attacks or expose credentials, tokens, and personal data.

• CVE-2026-10018MEDIUM 6.5

  CVE-2026-10018 is a medium-severity integer overflow vulnerability in ANGLE (Almost Native Graphics Layer Engine), Google's graphics abstraction layer used in Chrome. An attacker can craft a malicious webpage that, when visited, causes Chrome to mishandle memory calculations in its graphics pipeline. This flaw allows the attacker to read sensitive data from the browser's process memory—potentially including cached credentials, session tokens, or other confidential information—without modifying or crashing the system. The vulnerability requires user interaction (visiting the malicious page) but does not require special privileges to exploit.

• CVE-2026-10190MEDIUM 6.5

  A remotely exploitable vulnerability exists in Tenda W12 version 3.0.0.7(4763) that allows authenticated users to crash the device's web management interface. By sending a specially crafted request to the web timeout configuration function, an attacker with valid credentials can trigger a denial-of-service condition, rendering the device's management portal unavailable until it is restarted. Public exploit code is available, increasing the practical risk.

• CVE-2026-10272MEDIUM 6.5

  A4M4's Student-Management-System contains an authorization flaw in its admin panel that allows unauthenticated attackers to manipulate a parameter called 'sid' in the deleteform.php file, potentially leading to unauthorized data modification or deletion. The vulnerability is network-accessible and does not require user interaction or special privileges to exploit. While the issue has been publicly disclosed and exploit code is available, the development team has not yet issued a patch or formal response.

• CVE-2026-10860MEDIUM 6.5

  CVE-2026-10860 is a logic error in MISP's delete handler that allows authenticated users to bypass validation checks and delete records they shouldn't be able to. The flaw stems from a missing parenthesis in the conditional logic that evaluates HTTP DELETE requests, causing the validator to be skipped when a DELETE method is used. While an attacker must already be authenticated, they can exploit this to circumvent application-level protections and remove protected data.

• CVE-2026-10912MEDIUM 6.5

  A flaw in Google Chrome's extension handling allows an attacker who has already compromised the renderer process to bypass the browser's same-origin policy—a core security boundary that prevents JavaScript from one website accessing data from another. An attacker would need to trick a user into visiting a specially crafted webpage to exploit this. The vulnerability affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-10937MEDIUM 6.5

  CVE-2026-10937 is a same-origin policy bypass vulnerability in Google Chrome's password handling logic. An attacker can craft a malicious HTML page that, when visited by a user, exploits an implementation flaw to circumvent Chrome's same-origin policy protections. This could allow unauthorized script execution or data access across domain boundaries, though the actual impact depends on how the flaw is chained with other browser capabilities. The vulnerability affects Chrome versions prior to 149.0.7827.53 and requires user interaction to trigger.

• CVE-2026-10938MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles certain HTML input that could allow an attacker to circumvent site isolation protections, but only if they have already compromised the renderer process. Site isolation is Chrome's core defense that prevents a compromised website from accessing data from other open websites. This vulnerability narrows that protection in specific scenarios.

• CVE-2026-10944MEDIUM 6.5

  A flaw in Google Chrome's autofill feature on iOS could allow an attacker to trick a user into visiting a malicious webpage that extracts sensitive information you've saved in your browser—such as payment details, addresses, or credentials—from other websites you use. The vulnerability requires user interaction (visiting the malicious page) but does not require special system permissions or unusual browser configurations to exploit.

• CVE-2026-10950MEDIUM 6.5

  Google Chrome on iOS has a flaw in how it enforces security policies for the autofill feature. An attacker can trick a user into visiting a specially crafted webpage that leaks sensitive data from other websites the user has visited or logged into. The vulnerability requires user interaction (clicking or visiting a malicious link) but doesn't require any special browser configuration or authentication bypass. It affects Chrome versions before 149.0.7827.53 on iOS devices.

• CVE-2026-10977MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in Skia (Chrome's graphics rendering engine) that could allow an attacker who has already compromised your browser's renderer process to steal data from websites you visit. The attacker would need to trick you into viewing a specially crafted webpage. This is a real but narrowly scoped risk—it requires the renderer to already be under attacker control, limiting the immediate threat from casual browsing.

• CVE-2026-10979MEDIUM 6.5

  A flaw in the ANGLE graphics library used by Google Chrome before version 149.0.7827.53 allows attackers to read memory outside intended bounds. An attacker can craft a malicious HTML page that, when visited by a user, extracts sensitive data from Chrome's process memory—such as authentication tokens, encryption keys, or other confidential information. Exploitation requires user interaction (clicking a link or visiting a site) but no special privileges.

• CVE-2026-10980MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in DevTools that allows an attacker who has already compromised the browser's rendering engine to bypass the same-origin policy—a core security boundary that prevents websites from accessing each other's data. An attacker could craft a malicious HTML page to exploit this, potentially gaining unauthorized access to sensitive information from other websites.

• CVE-2026-10981MEDIUM 6.5

  CVE-2026-10981 is a cross-origin data leak vulnerability in Google Chrome's video codec handling. An attacker who has already compromised Chrome's renderer process can craft a malicious video file to exfiltrate sensitive data from other websites the user is visiting. The vulnerability requires user interaction (opening or playing a video file) and relies on prior compromise of the rendering engine, limiting the attack surface but creating risk for users who already have malware or who visit compromised sites.

• CVE-2026-10985MEDIUM 6.5

  A flaw in Skia, the graphics rendering engine used by Google Chrome, allows attackers to read data they shouldn't have access to by crafting a malicious web page. When a user visits such a page, the browser's memory can leak information from other websites or origins, potentially exposing sensitive data. The attack requires user interaction—clicking a link or visiting a hostile site—but doesn't require any special browser permissions or configuration.

• CVE-2026-10992MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the Animation feature validates user-supplied data. An attacker can craft a malicious HTML page that, when opened in a vulnerable Chrome browser, leaks sensitive information stored in the browser's process memory. The attack requires user interaction (opening the page) but no authentication or special browser configuration.

• CVE-2026-10993MEDIUM 6.5

  A heap buffer overflow vulnerability exists in Skia, the graphics rendering engine used by Google Chrome. By visiting a specially crafted webpage, an attacker can read sensitive data from Chrome's memory without requiring any special user permissions beyond clicking the link. The vulnerability affects Chrome versions before 149.0.7827.53 and has a CVSS severity rating of Medium.

• CVE-2026-10994MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the ANGLE graphics library that can leak sensitive data from your browser's memory. An attacker can craft a malicious webpage that, when you visit it, reads uninitialized memory and potentially extracts information like passwords, tokens, or other private data. The vulnerability requires user interaction (clicking or viewing the page) but does not require special browser permissions.

• CVE-2026-10996MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how Web Workers are implemented that could allow an attacker to bypass the same-origin policy—a fundamental browser security boundary. An attacker could craft a malicious HTML page that, when visited by a user, potentially accesses or modifies content from other websites in the victim's browser session. This requires user interaction (visiting the crafted page) but does not require any special browser features to be enabled.

• CVE-2026-10997MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it enforces policies on extensions. An attacker could craft a malicious extension that, if installed by a user, would be able to bypass access controls that should normally restrict what the extension can do. This is a user-assisted attack—the victim must actively install the extension—but once installed, the extension gains unintended capabilities.

• CVE-2026-10999MEDIUM 6.5

  An integer overflow vulnerability exists in ANGLE (a graphics abstraction layer) within Google Chrome on Windows. Before version 149.0.7827.53, this flaw could allow an attacker who already controls the Chrome renderer process to read sensitive data from memory by tricking a user into viewing a specially crafted webpage. The vulnerability requires user interaction (clicking a link or visiting a malicious site) but does not allow the attacker to modify data or crash the browser.

• CVE-2026-11001MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the Payments feature that allows attackers to create a fake user interface through a specially crafted webpage. To exploit this, an attacker would need to trick a user into performing specific interactions—such as clicks or gestures—on the malicious page. The attack does not steal data or crash the browser, but instead deceives the user by making the browser display content that appears to come from a trusted source, when it actually originates from the attacker. This is a medium-severity issue that depends on user interaction to succeed.

• CVE-2026-11006MEDIUM 6.5

  A memory safety flaw in Google Chrome's Dawn graphics component (used for GPU rendering) allows attackers to read sensitive data from a user's memory by tricking them into visiting a specially crafted webpage. The vulnerability does not enable code execution or system crashes, but confidentiality is at risk. Chrome versions prior to 149.0.7827.53 are affected.

• CVE-2026-11007MEDIUM 6.5

  A flaw in Google Chrome's WebView on Android allows an attacker who has already compromised Chrome's renderer process to steal sensitive data from other websites. The vulnerability stems from inadequate validation of user-supplied input, making it possible for an attacker to craft a malicious webpage that leaks cross-origin information—data that should remain isolated between websites. While the attacker must first gain control of the renderer process, the subsequent data leakage requires only that a user visit a crafted page, making this a meaningful risk in multi-stage attack chains.

• CVE-2026-11008MEDIUM 6.5

  A flaw in Google Chrome's web app installation feature fails to properly validate user input, allowing an attacker who has already compromised Chrome's renderer process to extract sensitive data from other websites through a malicious webpage. The attacker would need to trick a user into visiting a crafted HTML page, but once the renderer is compromised, the vulnerability creates a pathway to leak cross-origin information that should remain isolated.

• CVE-2026-11013MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser validates user-supplied input within its networking code. An attacker who has already compromised Chrome's renderer process—the sandboxed component that executes web content—can craft a malicious HTML page to leak sensitive data from the renderer's memory. This is a post-compromise attack vector; the attacker must first gain code execution in the renderer sandbox, but once there, they can extract information that should remain private.

• CVE-2026-11014MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a vulnerability where insufficient policy enforcement in the extension system allows a malicious extension to circumvent Site Isolation—Chrome's security boundary that prevents one website from accessing another's data. An attacker must first convince a user to install the malicious extension, but once installed, the extension can read or modify data across websites that the user visits, potentially exposing sensitive information.

• CVE-2026-11016MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw where insufficient validation of network input allows a remote attacker who has already compromised the browser's renderer process to bypass the same-origin policy. An attacker could craft a malicious HTML page to force the compromised renderer to access resources or data from a different origin, violating the security boundary that normally prevents cross-origin access. This requires initial renderer process compromise—the attacker cannot trigger the vulnerability from an unauthenticated network position alone.

• CVE-2026-11017MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Link Preview feature handles navigation restrictions. If an attacker first compromises Chrome's renderer process—the component that displays web content—they can craft a malicious HTML page to bypass restrictions that normally prevent unauthorized navigation. The vulnerability requires prior renderer compromise, limiting its immediate attack surface, but it does allow an attacker with that foothold to navigate to restricted locations without proper authorization.

• CVE-2026-11018MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser enforces navigation policies. An attacker can craft a malicious HTML page that, when visited, tricks Chrome into allowing navigation to restricted destinations that should normally be blocked. The vulnerability requires user interaction—a person must visit the hostile page—but no special privileges are needed on the attacker's side. The core risk is integrity: an attacker can redirect you to unwanted sites, potentially enabling phishing, malware distribution, or social engineering attacks.

• CVE-2026-11019MEDIUM 6.5

  A vulnerability in Google Chrome's payments implementation on Android allows an attacker who has already compromised the browser's rendering engine to trick users into believing they are interacting with a legitimate website when they are actually on a fraudulent one. The attacker would craft a deceptive HTML page that spoofs the domain name displayed to the user, potentially leading to credential theft, payment fraud, or other social engineering attacks. This requires an initial compromise of the renderer process, which limits the immediate exposure but represents a serious escalation risk once that initial foothold is established.

• CVE-2026-11020MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the browser handles extensions that process XML files. An attacker can craft a malicious XML file that, when processed by a vulnerable extension, leaks sensitive data from other websites the user has visited. The vulnerability requires user interaction—specifically, the user must open or interact with the malicious file—but does not require the attacker to have special privileges or bypass additional security controls. This is a cross-origin data leak, meaning information intended to be isolated between websites can be extracted by an attacker.

• CVE-2026-11022MEDIUM 6.5

  CVE-2026-11022 is a same-origin policy bypass vulnerability in Google Chrome's DevTools that requires an attacker to have already compromised the renderer process. An attacker could then use a specially crafted HTML page to escape origin restrictions, potentially accessing or modifying data from other websites in the same browser session. This is not a remote code execution vector but rather a privilege escalation within an already-compromised rendering context.

• CVE-2026-11023MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the browser handles web app installation that allows an attacker who has already compromised the browser's renderer process to bypass the same-origin policy. This means a specially crafted web page could be used to access or modify content from other websites in ways the browser is supposed to prevent. The attacker needs prior renderer compromise, limiting the immediate threat to users, but the bypass itself is reliable once that initial foothold exists.

• CVE-2026-11025MEDIUM 6.5

  Google Chrome on Android contains a flaw in how it enforces content security policies (CSP) during navigation. An attacker can craft a malicious HTML page that, when visited by a user, bypasses the browser's CSP protections. This allows the attacker to inject or execute unintended content within a page that should be restricted. The vulnerability requires user interaction (visiting a malicious site) and affects Chrome versions before 149.0.7827.53 on Android devices.

• CVE-2026-11026MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how extensions are handled that allows an attacker to bypass built-in navigation restrictions. The vulnerability requires social engineering—an attacker must trick a user into installing a malicious Chrome extension. Once installed, the extension can circumvent the browser's navigation safeguards, potentially redirecting users to unintended destinations or enabling other attack chains. This is classified as a Medium severity issue by Chromium's security team.

• CVE-2026-11027MEDIUM 6.5

  A vulnerability in Google Chrome's Glic component fails to properly validate untrusted input, allowing an attacker who has already compromised Chrome's renderer process to extract sensitive data across website boundaries using a specially crafted webpage. The attacker needs initial renderer process compromise but then gains the ability to read data from sites the user visits, bypassing normal browser security boundaries.

• CVE-2026-11032MEDIUM 6.5

  Google Chrome's Password Manager contained a flaw that could allow an attacker to trick users into visiting a malicious webpage and leak sensitive data from other websites the user visits. The vulnerability requires user interaction—visiting a crafted HTML page—but once triggered, could expose cross-origin information that should remain isolated between websites. This affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-11033MEDIUM 6.5

  A memory initialization flaw in Chrome's WebML component on macOS allows attackers to steal sensitive data. When a user visits a malicious webpage, the browser may leak uninitialized memory contents—potentially exposing passwords, tokens, or other private information—without requiring any special user interaction beyond loading the page. The issue affects Chrome versions before 149.0.7827.53 on Apple's macOS.

• CVE-2026-11322MEDIUM 6.5

  Hermes WebUI versions before 0.51.221 have a path traversal flaw that lets authenticated users read files outside the intended workspace directory. By crafting symlinks that point to sensitive data, attackers can access SSH keys, cloud credentials, and application tokens that the server process can reach. The vulnerability requires an existing user account but poses a meaningful risk to credential and secret exposure.

• CVE-2026-1871MEDIUM 6.5

  TP-Link Tapo C200 v5 camera firmware contains a flaw in how it validates incoming RTSP (Real Time Streaming Protocol) authentication requests. An attacker on the local network can send a specially crafted authentication message that overflows a memory buffer, crashing the camera's streaming service and forcing an automatic reboot. During this outage, users cannot view live video or manage the camera remotely. Once the camera restarts, service is restored, but the vulnerability remains exploitable, making repeated attacks feasible.

• CVE-2026-23638MEDIUM 6.5

  Kiteworks, a platform designed to secure and control data sharing across organizations, contains a flaw that allows authenticated users to modify form approval workflows that belong to other users. The vulnerability stems from inadequate checks on who actually owns or has permission to modify a particular form's configuration. An attacker with valid Kiteworks credentials could exploit this to alter how forms route for approval, potentially disrupting legitimate business processes or gaining unauthorized visibility into sensitive approvals.

• CVE-2026-24753MEDIUM 6.5

  Kiteworks Secure Data Forms contained an authorization flaw that allowed authenticated users to modify data forms and resources belonging to other users. The vulnerability stems from insufficient checks verifying that a user actually owns or has permission to modify a resource before allowing the action. Any authenticated user could exploit this by directly referencing another user's resource identifiers and making changes. This is categorized as an Insecure Direct Object Reference (IDOR) vulnerability. The issue is resolved in Kiteworks version 9.3.0 and later.

• CVE-2026-26379MEDIUM 6.5

  Koha, an open-source library management system, contains a Server-Side Request Forgery (SSRF) vulnerability in its Z39.50/SRU server configuration. An authenticated attacker can exploit this flaw to scan the internal network and discover which services are running by measuring how the server responds to requests. This vulnerability affects Koha versions up to and including 25.11.

• CVE-2026-26824MEDIUM 6.5

  libxls, a widely-used library for reading Microsoft Excel files, has a memory safety issue that could allow an attacker to crash applications or potentially leak sensitive information. The vulnerability exists in how the library initializes internal data structures when parsing Excel file containers. An attacker who crafts a malicious Excel file and tricks a user or application into opening it could trigger the vulnerability. This is a moderate-severity issue affecting the library through version 1.6.3.

• CVE-2026-27145MEDIUM 6.5

  Go's x509 certificate hostname verification process had a performance flaw where it unnecessarily repeated the same string-splitting operation for each DNS Subject Alternative Name (SAN) entry on a certificate. When a certificate listed many DNS SANs, verification became progressively slower—scaling with both the number of SANs and the complexity of the hostname being checked. The flaw affected all certificate verification, including checks on untrusted certificates, making it possible for an attacker to craft a certificate with an extremely large SAN list that would cause significant CPU overhead during validation.

• CVE-2026-3173MEDIUM 6.5

  The Meta Field Block plugin for WordPress has a permission-checking flaw that lets Contributor-level users and above read sensitive data stored in WordPress metadata. An attacker with basic contributor access can specify any object ID and type—bypassing the plugin's validation—to retrieve private information like user details, customer billing addresses, or other metadata that WordPress site administrators expected to keep hidden. On sites running e-commerce or membership plugins, this can expose personally identifiable information at scale.

• CVE-2026-3198MEDIUM 6.5

  MLflow 3.9.0, when deployed with basic authentication enabled, contains an authorization bypass affecting several gateway API endpoints. The application fails to properly verify user permissions before allowing access to sensitive operations that list gateway secrets, endpoints, and model definitions. This means any user who has logged in—even with minimal privileges—can view all gateway configuration data, including API keys and proprietary model information that should be restricted. The vulnerability is confined to the basic-auth deployment mode and affects information disclosure rather than data modification or system availability.

• CVE-2026-33464MEDIUM 6.5

  Kibana contains a denial-of-service vulnerability that allows low-privileged authenticated users to crash the service by sending an oversized request to an internal API. When exploited, Kibana becomes unresponsive to all users until manually restarted or the process recovers. This is a resource exhaustion attack that requires valid credentials but no special privileges.

• CVE-2026-35049MEDIUM 6.5

  Wire iOS users running versions before 4.16.0 are vulnerable to a denial-of-service attack where a specially crafted message causes the app to crash immediately upon receipt, without any user action required. The crash persists across app restarts, trapping users in a crash loop until they manually clear the app's local data. This affects authenticated users only—the attacker must have messaging access to the target.

• CVE-2026-35673MEDIUM 6.5

  OpenClaw versions before 2026.4.29 contain a Server-Side Request Forgery (SSRF) policy bypass that allows authenticated users to circumvent network security controls. The vulnerability exists in browser debug and export functionality, where attackers can reuse previously-blocked tabs to access or export content that should remain restricted by private-network SSRF policies. This is a policy evasion technique rather than a direct network breach—the attacker must already have authenticated access to these routes, but can then leverage that access to reach otherwise-protected resources.

• CVE-2026-35718MEDIUM 6.5

  VIVOTEK FD8136 network cameras running firmware version 0300a contain a path traversal vulnerability in their administrative media download function. An authenticated attacker can craft requests to the vulnerable endpoint to read files anywhere on the device, potentially exposing sensitive configuration data, credentials, or system files. This requires valid login credentials but does not require user interaction to exploit.

• CVE-2026-36499MEDIUM 6.5

  Open vSwitch v3.6.90 contains a flaw that allows someone with write access to its configuration database to cause the software to allocate an unreasonably large number of worker threads. By requesting more threads than the system can handle, an attacker can exhaust memory and CPU resources, effectively shutting down the switch. The vulnerability requires existing database access, limiting the immediate threat surface, but represents a significant availability risk in environments where OVSDB write permissions are not tightly controlled.

• CVE-2026-36604MEDIUM 6.5

  A Mercusys AC12G (EU) V1 router running firmware version AC12G(EU)_V1_200909 fails to validate the HTTP Host header in requests, creating an opening for DNS rebinding attacks. When an attacker controls a domain, they can redirect that domain to the router's internal IP address. The router's existing CORS misconfiguration (which already allows requests from any origin) amplifies this weakness, permitting the attacker to extract sensitive information from the router's web interface as if the request came from a trusted source. This vulnerability requires user interaction—typically visiting a malicious website—but does not require authentication.

• CVE-2026-36605MEDIUM 6.5

  Mercusys AC12G (EU) V1 routers running firmware version AC12G(EU)_V1_200909 contain a denial-of-service vulnerability where an attacker on the local network can send a small number of specially crafted incomplete HTTP requests to crash the router. The device becomes unresponsive and requires a physical power cycle to restore function. This affects network availability for all connected devices.

• CVE-2026-3870MEDIUM 6.5

  Zyxel VMG4005-B50B routers with firmware up to version 5.13(ABRL.5.4)C0 contain a buffer overflow flaw in their UPnP port-mapping feature. An attacker on the same local network can exploit this to crash the UPnP service temporarily, preventing legitimate port-forwarding operations until the service recovers or the device is rebooted.

• CVE-2026-3871MEDIUM 6.5

  Zyxel VMG4005-B50B gateway devices running firmware version 5.13(ABRL.5.4)C0 and earlier contain a buffer overflow flaw in the UPnP DeletePortMapping command. An attacker on the same local network can exploit this to crash the UPnP service, temporarily disabling port mapping features. The vulnerability requires network adjacency and does not enable data theft or system compromise, but does degrade device functionality.

• CVE-2026-39229MEDIUM 6.5

  Bolt CMS versions up to 3.7.0 contain a SQL injection vulnerability in how it processes the 'order' parameter on content listing pages. An attacker who has legitimate user credentials—even with minimal permissions—can craft malicious input to extract sensitive data from the database. The vulnerability is triggered through the OrderDirective component during normal sorting operations. This is an information disclosure risk; attackers cannot modify or delete data, but they can read information they shouldn't access.

• CVE-2026-40861MEDIUM 6.5

  CVE-2026-40861 is a path traversal vulnerability in Apache Airflow that allows a DAG (Directed Acyclic Graph) author to read or write arbitrary files on the system when the worker and API server share a log directory. An attacker with DAG authoring privileges can either create symbolic links in their task's log folder to access sensitive files like `/etc/passwd` or `airflow.cfg`, or inject path traversal sequences (`..`) in task IDs to escape the intended log directory. The vulnerability exposes confidential configuration data and could enable file overwrites on the API server's filesystem.

• CVE-2026-41141MEDIUM 6.5

  EspoCRM versions before 9.3.5 contain an access control bypass in the email template preparation endpoint. An authenticated user with basic EmailTemplate read permissions can extract sensitive field data from any Contact, Lead, Account, or User record by providing the target's email address—effectively circumventing role-based visibility restrictions. This allows lower-privileged users to read information they should not have access to, such as financial details, personal fields, or team-restricted records.

• CVE-2026-41184MEDIUM 6.5

  Calico's CNI installer container accidentally logs Kubernetes ServiceAccount tokens to standard output during deployment, specifically when using Canal or Flannel-Calico configurations. Any user with permission to view pod logs in the affected namespace can retrieve this token, which grants the ability to modify pod annotations—a vector for attacking workloads in your cluster. The vulnerability is a regression of a previously fixed issue and does not affect deployments using the default kubeconfig authentication method.

• CVE-2026-41185MEDIUM 6.5

  Calico, a widely-used open-source networking plugin for Kubernetes, logs sensitive authentication credentials to plaintext files when deployed with Azure's IPAM plugin and token-based Kubernetes authentication. The vulnerability occurs because the Calico CNI binary adds subnet information to the configuration before forwarding it to Azure IPAM for processing. During this handoff, the entire configuration—including Kubernetes ServiceAccount tokens, client keys, and certificate authority data—is logged at INFO level to /var/log/calico/cni/cni.log. This happens on every pod scheduling or termination, creating a high-frequency credential leak. Any user or process with read access to node-level logs can extract cluster-wide Calico networking administrator credentials without triggering alarms.

• CVE-2026-42073MEDIUM 6.5

  OpenClaude, an open-source command-line tool for interacting with cloud and local AI models, has a flaw in how it handles user login. When you authenticate using OAuth, the software runs a temporary web server locally to catch the login response. To prevent attackers from hijacking this process, the server checks a security token called a 'state parameter.' However, due to a bug in how the code checks this token, an attacker can bypass the security check entirely and crash the server without even knowing what the token is. This has been fixed in version 0.5.1 and later.

• CVE-2026-42358MEDIUM 6.5

  Apache Airflow's secret-masking feature, which is supposed to hide sensitive values in Variables when they're accessed through the UI or API, has a flaw that lets authenticated users read plaintext secrets stored in deeply nested JSON structures. The masking tool gives up checking for sensitive key names (like 'password', 'token', 'secret', 'api_key') once it reaches a certain nesting depth, so secrets buried deeper than that limit slip through unmasked. Any user with permission to read Variables can exploit this. This is a follow-up to an earlier fix; that patch addressed shallow nesting, but didn't raise the depth limit itself, leaving the same bypass hole for deeper structures.

• CVE-2026-42360MEDIUM 6.5

  Apache Airflow has a flaw in how it protects sensitive information embedded within complex data structures (like JSON templates). When a workflow template is large enough to exceed Airflow's size limit for storing template data, the system converts it to plain text before masking secrets—a process that loses track of nested sensitive fields like passwords, tokens, and API keys. An authenticated user with access to read stored template fields could then retrieve these unmasked secrets. The issue affects Airflow deployments where workflow authors pass structured data containing nested sensitive values to operators. Even organizations that patched a related vulnerability (CVE-2025-68438) last year need to apply this additional update, as that earlier fix did not address this specific nested-key masking gap.

• CVE-2026-42399MEDIUM 6.5

  A vulnerability in Kibana allows authenticated users with basic access to crash the application by uploading specially crafted visualizations. An attacker submits a Timelion visualization with deeply nested function calls that causes Kibana to allocate memory without limit, eventually consuming all available RAM and taking the service offline for everyone. This is a denial-of-service attack that requires valid credentials but no administrative privileges.

• CVE-2026-42400MEDIUM 6.5

  CVE-2026-42400 is a denial-of-service vulnerability in Kibana that allows an authenticated user to crash or freeze a Kibana instance by sending a malicious compressed request. The vulnerability exists because Kibana processes and decompresses incoming requests before fully validating user permissions, meaning an attacker can consume excessive memory and CPU resources on the server before authorization checks can stop them. While this requires valid credentials to exploit, the impact is straightforward: a Kibana instance can become unresponsive or crash entirely, disrupting visibility and analysis capabilities that teams depend on.

• CVE-2026-42539MEDIUM 6.5

  IRIS is a web-based platform used by incident response teams to collaborate and share technical details during security investigations. A vulnerability in versions before 2.4.28 causes the platform to leak sensitive information to authenticated users that those users should not have access to. This happens because the application returns unnecessary data in responses, exposing information beyond what the client application actually needs to function. An attacker with valid IRIS credentials can exploit this to view restricted incident data.

• CVE-2026-42671MEDIUM 6.5

  Paolo GeoDirectory versions up to 2.8.157 contain a missing authorization flaw that allows attackers to bypass access controls. Without needing credentials or user interaction, an attacker on the network can exploit misconfigured security levels to gain unauthorized access to sensitive operations, potentially modifying data or causing service disruption.

• CVE-2026-42676MEDIUM 6.5

  myCred, a gamification and community engagement plugin, contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into web pages. Unlike reflected XSS attacks that require victims to click a link, stored XSS persists in the application's database, meaning any user—including administrators—who views the affected content will execute the attacker's code. The vulnerability affects myCred versions up to and including 3.0.4. An authenticated attacker could exploit this to steal session tokens, redirect users, deface content, or perform actions on behalf of legitimate users.

• CVE-2026-42679MEDIUM 6.5

  CVE-2026-42679 is a path traversal vulnerability in Mamunur Rashid Classified Listing that allows authenticated users to read sensitive files outside the application's intended directory structure. An attacker with valid login credentials can craft specially formatted file path requests to access restricted files on the server, potentially exposing configuration data, database backups, or other confidential information. The vulnerability affects Classified Listing versions up through 5.3.8.

• CVE-2025-14042MEDIUM 6.4

  The Automotive Car Dealership Business WordPress Theme contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 13.4.1. An attacker with contributor-level or higher permissions can inject malicious scripts into Portfolio Item 'Project Details' fields. These scripts will execute when other users view the affected pages, potentially compromising visitor sessions, stealing credentials, or defacing content. The vulnerability stems from the theme's failure to properly sanitize and escape user input in a custom field.