2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

2581 published vulnerabilities · page 1 of 26

• CVE-2026-47693MEDIUM 6.9

  Poweradmin, a web-based tool for managing PowerDNS servers, contains a CSV injection vulnerability in its log export feature. When administrators export activity logs to CSV format, usernames containing spreadsheet formulas (starting with =, +, -, or @) are not sanitized before export. If an administrator opens the CSV file in Excel, Google Sheets, or similar applications, those formulas execute automatically. An attacker who can create or modify a user account with a malicious username could exploit this to run commands on an administrator's machine, steal data, or launch phishing attacks. The vulnerability affects Poweradmin versions before 4.2.4 and 4.3.3.

• CVE-2026-56132MEDIUM 6.9

  CVE-2026-56132 is a heap-based buffer overflow vulnerability in libexpat, a widely-used XML parsing library. The flaw occurs in the XML prologue parsing logic when multiple parser instances share internal data structures—specifically, the scaffold backing array. Improper reallocation of this shared array can cause a heap buffer overflow, potentially allowing an attacker with local access to crash the application or execute arbitrary code. The vulnerability affects libexpat versions before 2.8.2.

• CVE-2026-56406MEDIUM 6.9

  libexpat, a widely-used XML parsing library, contains an integer overflow vulnerability in its XML_ParseBuffer function. The vulnerability arises from a missing validation check that exists in a related function (XML_Parse), creating a code path that can trigger an integer overflow when processing certain XML inputs. An attacker with local access could exploit this to cause crashes or potentially execute code with elevated privileges, though remote exploitation is considered less feasible.

• CVE-2026-56407MEDIUM 6.9

  libexpat, a widely-used XML parsing library, contains an integer overflow vulnerability in its entity handling logic. The flaw occurs when the library processes XML document preambles (the prologue section) and manages entity values. An attacker could exploit this by crafting a malicious XML file that, when parsed by an application using vulnerable versions of libexpat, may cause memory corruption leading to information disclosure or data tampering. This is a local attack requiring no special privileges, though exploitation requires specific conditions to manifest.

• CVE-2026-56411MEDIUM 6.9

  libexpat, a widely-used XML parsing library, contains an integer overflow vulnerability in its xmlwf utility when processing NOTATION declarations within DOCTYPE sections. An attacker who can supply a maliciously crafted XML file with specially constructed NOTATION declarations can trigger an integer overflow, potentially leading to memory corruption and code execution on the affected system. The vulnerability affects versions of libexpat before 2.8.2.

• CVE-2025-15653MEDIUM 6.8

  Dräger's Zeus Infinity Empowered and Zeus RS C500 anesthesia workstations have a security flaw that allows someone with physical access to a device to compromise its software through USB ports. An attacker could interfere with anesthesia delivery, alter medical data, or use the device as a stepping stone to attack a hospital network if the workstation is networked or connected to Dräger's service platform.

• CVE-2026-0048MEDIUM 6.8

  A vulnerability exists in Android's WindowState component that allows an attacker to overlay malicious UI on top of legitimate system dialogs, tricking users into granting permissions they did not intend to approve. The attack exploits a tapjacking technique where touch inputs are intercepted and misdirected. No special privileges or user awareness is required for the attack to succeed, making it a local but potentially high-impact privilege escalation vector.

• CVE-2026-0086MEDIUM 6.8

  A vulnerability in Android's DisableSupervisionActivity allows an attacker to delete supervision data on a device by exploiting a missing null check in the onCreate method. This flaw enables local privilege escalation without requiring any special permissions or user interaction, meaning the exploit could trigger automatically during normal device operation. The vulnerability affects multiple Android versions and has a medium severity rating.

• CVE-2026-10609MEDIUM 6.8

  OpenShift Cluster Logging Operator contains a flaw in how it handles ServiceAccount credentials. When an operator creates a log forwarder, it automatically generates and sends ServiceAccount tokens to external destinations without first checking whether the person setting up the forwarder should have access to those credentials. This means a delegated editor—someone with limited permissions to modify cluster configurations—could trick the system into exposing sensitive authentication tokens, then use those tokens to gain higher privileges than they should have.

• CVE-2026-11166MEDIUM 6.8

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it processes SVG (Scalable Vector Graphics) content that allows attackers to inject malicious scripts or HTML into web pages. An attacker would craft a specially designed HTML page and trick a user into visiting it; if the user does, arbitrary code could execute within the browser with the user's privileges, potentially stealing data, modifying page content, or performing actions on the user's behalf. The vulnerability requires user interaction and is rated Medium severity by Google's security team.

• CVE-2026-11218MEDIUM 6.8

  A flaw in Google Chrome's platform integration layer on Windows allows attackers to trick users into running malicious files that execute arbitrary code on their system. The vulnerability requires specific user interaction—the attacker must convince the victim to perform particular UI gestures when opening a crafted file. While Chrome's vendor assessment rates this as low severity, the combination of remote reach and code execution capability elevates the practical risk for organizations with large user populations.

• CVE-2026-11628MEDIUM 6.8

  Google Chrome versions before 149.0.7827.103 contain a use-after-free memory error in the Ozone graphics subsystem. An attacker with physical access to a device can trigger this flaw to corrupt heap memory and potentially execute arbitrary code. While the Chromium project rates this as Critical, the CVSS score reflects the requirement for physical device access, which limits real-world exploitability for most organizations.

• CVE-2026-36175MEDIUM 6.8

  CVE-2026-36175 is a physical authentication bypass vulnerability affecting GNCC GP5 v7.1.76. An attacker with direct physical access to a device can interrupt the boot process and inject malicious kernel boot arguments, circumventing security controls to obtain root-level access. The vulnerability requires the attacker to be present at the device during startup, making it a targeted risk rather than a remote threat.

• CVE-2026-36933MEDIUM 6.8

  Boyleep K11 y108 devices running firmware version 2.3.0.11291 contain a vulnerability in their factory test feature that allows an attacker with physical access to execute arbitrary code. This means someone with hands-on access to the device can bypass normal security controls and run malicious code with full device privileges. The vulnerability requires no special permissions or user interaction to exploit once physical access is achieved.

• CVE-2026-39468MEDIUM 6.8

  A vulnerability in Meta Box, a popular WordPress custom fields framework, allows contributors with limited account privileges to delete arbitrary files from an affected website. The flaw exists in versions 5.11.1 and earlier. While an attacker would need contributor-level access or higher to exploit this, successful exploitation can lead to website unavailability, data loss, or system instability if critical files are deleted. This is a path traversal issue that bypasses normal file permission checks.

• CVE-2026-45608MEDIUM 6.8

  A flaw in Windows DHCP Client allows a local attacker to read sensitive memory content without authentication. The vulnerability exists because the DHCP client fails to validate buffer boundaries before reading network configuration data, exposing information like cached credentials or system details to an attacker with local access. No user interaction is required, and the attacker does not need special privileges—standard user permissions are sufficient.

• CVE-2026-45673MEDIUM 6.8

  Netty, a widely-used Java framework for building network applications, has a DNS resolver flaw that makes it easier for attackers to poison DNS caches. The issue stems from two weaknesses: the framework generates DNS request IDs using a predictable random number generator, and it sends all DNS queries from the same UDP port by default. Together, these reduce the unpredictability of DNS traffic, making it feasible for an attacker to craft malicious DNS responses that get cached and served to users—a technique known as DNS Cache Poisoning or a Kaminsky attack. Patched versions 4.1.135.Final and 4.2.15.Final address both issues.

• CVE-2026-45775MEDIUM 6.8

  Discourse, a popular open-source discussion platform, contains a path traversal vulnerability in its backup handling system that could allow an authenticated site administrator to access backup files from other sites within the same multisite deployment. The vulnerability affects versions 2026.1.0 through 2026.1.3, 2026.3.0, and 2026.4.0. An attacker with admin privileges on one Discourse site could craft a specially crafted backup download request to retrieve sensitive backup data from a different site hosted on the same infrastructure. This requires existing administrative authentication and only impacts deployments where backups are stored locally on the same server. The issue has been resolved in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

• CVE-2026-45810MEDIUM 6.8

  Nextcloud Server contains an authorization flaw that allows any authenticated user with access to a single file comment to read all comments across the system. The vulnerability stems from missing validation when retrieving comment data, effectively breaking comment-level access controls. An attacker needs valid Nextcloud credentials and interaction with at least one comment, but can then enumerate and read comments they should not have permission to access. This affects Nextcloud Server 31.0.0 through 31.0.11 and 32.0.0 through 32.0.2, with critical patches available.

• CVE-2026-47838MEDIUM 6.8

  Spring Security contains a flaw in how it processes X.509 certificate subject names (the DN field used for authentication). When a certificate contains a specially crafted Common Name (CN) value, Spring Security may misread it and extract the wrong username. An authenticated attacker could exploit this by presenting a malformed certificate to impersonate another user. The vulnerability affects multiple Spring Security versions across the 5.7, 5.8, 6.3, 6.4, and 6.5 release lines.

• CVE-2026-48117MEDIUM 6.8

  DroneAware, a drone detection platform accessible at droneaware.io, had a critical account security flaw that allowed attackers to hijack user accounts before legitimate owners completed setup. An attacker could register an account using someone else's email address with their own password, then when the real owner activated the account (either by email link or Google login), the attacker's password remained valid—giving the attacker persistent, silent access without alerting the victim. The vulnerability has already been fixed server-side as of May 20, 2025, and no action is required from users.

• CVE-2026-48775MEDIUM 6.8

  LangGraph SQLite Checkpoint, a data persistence component in LangGraph, can deserialize untrusted Python objects from checkpoint files stored in SQLite databases. If an attacker gains write access to the checkpoint storage backend, they can inject malicious serialized objects that execute arbitrary code when the application loads a checkpoint. This is a defense-in-depth vulnerability—it requires an attacker to first compromise the underlying storage layer, but if they do, they can escalate that access to runtime code execution. The issue affects versions 4.1.0 and earlier; version 4.1.1 and later contain a fix.

• CVE-2026-48782MEDIUM 6.8

  Pydantic AI, a Python framework for building AI agent applications, contains a vulnerability that allows attackers to bypass security protections designed to prevent unauthorized access to cloud credentials. The issue stems from an incomplete fix to a prior vulnerability (CVE-2026-46678). Attackers can use IPv6 address encoding tricks to reach internal cloud metadata endpoints that store temporary AWS, Azure, or GCP credentials, potentially exposing those credentials if the application has enabled downloading from local/internal URLs. The vulnerability only affects applications that explicitly enable local URL downloads and run on networks using specific IPv6 transition technologies, which are common in NAT64-configured environments and some Kubernetes clusters.

• CVE-2026-50021MEDIUM 6.8

  pnpm, a widely-used Node.js package manager, has a gap in its integrity verification logic. When a lockfile entry is missing an integrity checksum, pnpm will install the package without validating that its contents match what was originally locked. An attacker who can modify your lockfile and redirect package downloads to a compromised registry can inject altered code into your dependencies—even when you run pnpm install --frozen-lockfile, which is intended to be a safe, reproducible install. Unlike npm's ci command, which always enforces integrity checks, pnpm silently skips verification if the checksum is absent, creating a dangerous fail-open behavior.

• CVE-2026-50206MEDIUM 6.8

  A vulnerability in Acer Connect M6E 5G devices allows an authenticated administrator to execute arbitrary commands by uploading a malicious VPN configuration file. The device fails to properly sanitize special characters in VPN profile settings, which an attacker with high-level access could exploit to break out of the configuration parsing context and inject system commands. This is not a vulnerability an unauthenticated remote user can easily trigger, but it represents a significant risk in environments where VPN profiles are managed by potentially compromised accounts or supply chain actors.

• CVE-2026-50507MEDIUM 6.8

  Windows BitLocker, Microsoft's full-disk encryption feature, contains a flaw that allows an attacker with physical access to a device to bypass its security protections without providing authentication credentials. The vulnerability affects multiple versions of Windows 10, Windows 11, and Windows Server platforms. Because the attack requires physical presence, the risk is somewhat contained to scenarios where an attacker can directly access hardware—such as a stolen laptop or a device left unattended in a hostile environment. The vulnerability is classified as medium severity, but organizations relying on BitLocker as a primary defense against data theft should treat this seriously.

• CVE-2026-50573MEDIUM 6.8

  pnpm, a widely-used Node.js package manager, has a vulnerability that undermines a core security mechanism: the lockfile integrity check. When you run `pnpm install` without the frozen flag, pnpm is supposed to verify that downloaded packages match the integrity hashes stored in pnpm-lock.yaml. However, in versions before 10.34.0 and 11.4.0, if a package registry serves modified content for a previously-locked package, pnpm reports the mismatch but then silently accepts the new content, updates the lockfile, and installs the modified package anyway. This defeats the purpose of lockfile integrity verification, which exists to prevent supply-chain attacks where registries or network intermediaries might inject malicious code into your dependencies.

• CVE-2026-52809MEDIUM 6.8

  Gogs, a self-hosted Git service, contains a password-reset token vulnerability affecting versions before 0.14.3. When administrators configure a shorter password-reset window (such as 10 minutes) for security or compliance purposes, the system ignores that setting and instead issues tokens valid for the much longer account-activation lifetime. Users receive password-reset emails that falsely claim tokens expire in the configured shorter timeframe, but the tokens remain valid far longer than advertised. This discrepancy between stated and actual token lifetime significantly extends the window in which a stolen reset token can be exploited to compromise an account.

• CVE-2026-53196MEDIUM 6.8

  A vulnerability in the Linux kernel's USB serial driver for IO Technic devices allows a malicious USB device to overflow kernel memory when connected to a host system. The driver fails to properly validate the size of data it reads from a device's onboard memory, trusting an untrusted value from the device itself. When a crafted device is plugged in, it can write far more data into a small kernel buffer than it was designed to hold, potentially leading to code execution or system crash.

• CVE-2026-53523MEDIUM 6.8

  Nezha Monitoring, a self-hosted server and website monitoring tool, contains a host header injection vulnerability in its OAuth2 authentication flow. Attackers can manipulate the Host header in requests to trick the application into constructing malicious OAuth2 callback URLs, potentially redirecting users to attacker-controlled sites during the authentication process. The vulnerability affects all versions from 1.0.0 through 2.1.x and has been fixed in version 2.2.0.

• CVE-2026-54421MEDIUM 6.8

  OpenStack Ironic has a flaw where PATCH requests to update volume property fields can leak sensitive credentials like iSCSI usernames and passwords to authorized users. This is a privilege-aware vulnerability—only users with authorization to modify those fields can trigger the leak, and only through PATCH operations, not POST. The issue affects Ironic versions before 37.0.1.

• CVE-2026-55201MEDIUM 6.8

  Evil-WinRM versions through 3.9 contain a path traversal flaw in how they handle file downloads from Windows servers. When a user downloads files from a remote Windows machine using Evil-WinRM, a compromised or rogue server can trick the client into writing files outside the intended download folder by embedding special directory-traversal sequences (like "../") in filenames. An attacker controlling the remote server could exploit this to overwrite important files on the client machine—such as SSH keys or shell configuration files—potentially gaining persistent access or escalating privileges on the client system.

• CVE-2026-55411MEDIUM 6.8

  ToolJet, an open-source platform for building internal tools and AI agents, contains a credential exposure vulnerability affecting versions prior to 3.20.1780-lts. An authenticated user can request decryption of data-source secrets belonging to any other organization by knowing or guessing a credential ID. The vulnerability exists because the decryption endpoint lacks proper access controls and organization-level scoping, allowing cross-tenant secret theft. Only users with a ToolJet account can exploit this, but the attacker's organization affiliation is irrelevant—any authenticated user gains access to any other tenant's secrets.

• CVE-2026-56109MEDIUM 6.8

  CVE-2026-56109 is a memory corruption vulnerability in ALSA (Advanced Linux Sound Architecture), a fundamental audio library used across Linux systems. When the library parses a specially crafted audio configuration file, it accidentally frees the same memory location twice—a condition called a double-free. This memory corruption can crash audio services or potentially allow an attacker to corrupt data on the system. The vulnerability requires local access and a malicious configuration file, so it poses a moderate but real risk to Linux deployments where untrusted users can provide audio configuration.

• CVE-2026-56342MEDIUM 6.8

  AVideo through version 27.0 contains a server-side request forgery (SSRF) vulnerability in its Live plugin test endpoint. An authenticated administrator can craft requests to the statsURL parameter that bypass internal validation, allowing them to read responses from arbitrary URLs—including private IP ranges, localhost services, and cloud metadata endpoints. This means an attacker with admin access could potentially extract sensitive credentials, internal service configurations, and network topology information from your infrastructure.

• CVE-2026-7764MEDIUM 6.8

  A flaw in Morse Micro's HaLow Wi-Fi kernel driver allows an attacker within radio range to crash devices or leak small amounts of sensitive memory by sending a specially crafted wireless frame. The vulnerability exists because the driver doesn't properly validate the size of data embedded in beacon or probe response frames before reading from it. No password, pairing, or user action is needed—an attacker simply has to be nearby with the right equipment.

• CVE-2026-7842MEDIUM 6.8

  The Infility Global WordPress plugin versions before 2.15.20 contain a SQL injection vulnerability in its import functionality. Attackers with Editor-level WordPress access can manipulate sorting parameters to extract database contents without needing to modify data. This requires the ImportData module to be enabled and the attacker to already have a valid WordPress account with elevated privileges.

• CVE-2026-9261MEDIUM 6.8

  Canon EOS Network Setting Tool versions 1.5.0 and earlier use weak SSH encryption algorithms when communicating over the network. An attacker positioned to intercept traffic—such as on a shared network or via man-in-the-middle positioning—could potentially decrypt SSH sessions or forge authentication, compromising the confidentiality and integrity of communications between the tool and network devices. This affects both macOS and Windows users of the tool.

• CVE-2026-9673MEDIUM 6.8

  The json-2-csv package contains a flaw in its CSV injection protection mechanism. Versions 3.15.0 through 5.5.10 allow an attacker to bypass the preventCsvInjection option and inject malicious formulas into CSV files. When a user opens these files in spreadsheet applications like Excel or Google Sheets, the formulas execute automatically, potentially leading to data exfiltration or further compromise.

• CVE-2026-9802MEDIUM 6.8

  Keycloak contains a vulnerability where refresh tokens can be replayed after revocation under specific conditions. When token revocation is enabled alongside persistent session storage, a server restart can cause the system to lose track of timing information, allowing an attacker who previously captured a user's refresh token to reuse it for unauthorized account access. This is a medium-severity flaw that requires network access and user interaction to exploit.

• CVE-2024-22447MEDIUM 6.7

  Dell Peripheral Manager versions before 1.7.3 contain a vulnerability that allows an attacker with local access to execute arbitrary code by placing a malicious DLL file in a location that the application searches during startup. The flaw stems from the application not properly validating the search path for required libraries, a weakness commonly exploited to hijack legitimate software execution.

• CVE-2024-22451MEDIUM 6.7

  Dell Peripheral Manager versions 1.5.1 through 1.7.2 contain a vulnerability that allows an attacker with local access to execute arbitrary code by placing malicious files in locations the software searches when loading libraries or executables. An attacker would need valid credentials and user interaction to trigger the exploit, but successful exploitation could give them the same permissions as the user running the affected application.

• CVE-2025-10237MEDIUM 6.7

  CVE-2025-10237 is a firmware vulnerability affecting ThinkPad embedded controllers that permits a user with administrative or system-level privileges to read from and write to sensitive memory regions that should be protected. An attacker with high-level local access could use this to manipulate firmware behavior, extract sensitive data, or establish persistence. The vulnerability requires elevated privileges to exploit, limiting the immediate attack surface, but the potential consequences—including complete system compromise at the firmware level—are serious.

• CVE-2025-10238MEDIUM 6.7

  A vulnerability in ThinkPad BIOS could allow someone with administrative or system-level access to a machine to write data outside intended memory boundaries, potentially enabling them to execute malicious code at the System Management Mode (SMM) level. SMM is a privileged processor mode that runs independently of the operating system, giving an attacker the ability to compromise the system at its deepest firmware level.

• CVE-2025-59613MEDIUM 6.7

  CVE-2025-59613 is a memory corruption vulnerability affecting Qualcomm wireless, compute, and AR/XR platforms. The flaw occurs when the system attempts to copy data into a buffer that is smaller than the source data being transferred, causing memory to be overwritten beyond the intended boundaries. An attacker with elevated privileges on the device could exploit this to corrupt memory and potentially compromise system integrity, confidentiality, or availability. The vulnerability requires local access and administrative-level permissions to trigger.

• CVE-2025-59614MEDIUM 6.7

  A memory corruption flaw exists in multiple Qualcomm components when processing random number generator commands with an undersized output buffer. An attacker with high-level privileges on the local system can trigger this condition to corrupt memory, potentially achieving confidentiality, integrity, and availability compromise. The vulnerability requires administrator or equivalent access and cannot be exploited remotely.

• CVE-2025-67862MEDIUM 6.7

  Fortinet FortiOS and FortiProxy contain a debug access vulnerability that allows authenticated administrators to execute arbitrary Lua scripts through specially crafted command-line commands. While admin-level credentials are required to exploit this issue, successful exploitation could enable code execution and system compromise. The vulnerability affects multiple versions across both product lines and has been assigned a CVSS score of 6.7 (Medium severity).

• CVE-2026-10805MEDIUM 6.7

  NetworkManager, a widely used Linux network configuration utility, contains a local privilege escalation vulnerability in its dhclient backend. When processing specially crafted Manufacturer Usage Description (MUD) URLs, an authenticated local user can trigger malicious script execution to gain elevated system privileges. The vulnerability requires specific administrative configuration (non-default use of dhclient backend) and user interaction, limiting its scope but making it a meaningful risk for organizations using that backend.

• CVE-2026-20453MEDIUM 6.7

  CVE-2026-20453 is a local privilege escalation vulnerability in MediaTek's geniezone component affecting multiple SoC (System-on-Chip) firmware and chipsets. The flaw stems from missing bounds validation during a write operation, allowing an attacker who already has system-level privileges to escalate further or corrupt memory. Because the attack requires prior system access and involves no user interaction, this is a post-compromise risk rather than an initial attack vector. The vulnerability carries a CVSS 3.1 score of 6.7 (Medium severity).

• CVE-2026-46732MEDIUM 6.7

  Dell Display and Peripheral Manager (DDPM) for macOS versions before 2.3 contain a race condition vulnerability that allows a low-privileged local user to escalate their privileges on an affected system. A race condition occurs when a program accesses a shared resource in an unsafe manner, allowing an attacker to manipulate the timing or sequence of operations to gain unauthorized access. In this case, the vulnerability requires the attacker to already have local access to the system and user interaction to be exploited, which somewhat limits its attack surface but still represents a meaningful privilege escalation risk.

• CVE-2026-48914MEDIUM 6.7

  QEMU, a widely-used virtualization platform, contains a flaw in its virtio-blk device that fails to properly validate the size of input descriptors. A malicious guest operating system—one with administrative privileges inside a virtual machine—can craft a specially formed SCSI request to trigger an out-of-bounds memory write on the host system. This could crash the QEMU process, disrupting all virtual machines running under that hypervisor. The attack requires the attacker to already have high-level access within the guest, so this is not a remote vulnerability from the untrusted internet.

• CVE-2026-48981MEDIUM 6.7

  pam_usb is a Linux authentication module that uses removable USB devices as security keys. Versions before 0.9.2 have a flaw where the configuration file is parsed insecurely, allowing an attacker with root-level write access to inject malicious XML code. This injected code could cause the authentication system to read local files, make unexpected network connections, or execute other harmful actions when someone attempts to authenticate. The risk is limited because the attacker needs to already have write access to the root-owned configuration file, but the impact is concerning because the authentication process runs with elevated privileges (setuid), potentially affecting sudo and su operations.

• CVE-2026-49278MEDIUM 6.7

  Rocket.Chat versions before specific patched releases leak authentication tokens in the visitors.info API endpoint response. An attacker with administrative privileges could retrieve visitor information and capture these tokens, potentially using them to escalate access or impersonate users. The vulnerability requires high privilege level to exploit but exposes sensitive authentication material that should never be returned by the API.

• CVE-2026-50255MEDIUM 6.7

  Optical Disc Archive Software for Windows versions 5.5.3 and earlier contain a permissions misconfiguration that could allow a local attacker to execute code with SYSTEM-level privileges. An attacker with low-level access to the system would need to interact with the vulnerable component, but once successful, they could gain full system control. This is a local privilege escalation risk rather than a remote network-based threat.

• CVE-2026-6739MEDIUM 6.7

  Mattermost Server has a privilege escalation flaw affecting multiple recent versions (11.6.1, 11.5.4, 10.11.15, and 10.11.16). Users with delegated user-management permissions can abuse the role patch API to modify built-in system roles without proper authorization checks, effectively gaining elevated system privileges they shouldn't possess. An authenticated attacker doesn't need admin status—just user-management delegation—to exploit this, making it a meaningful risk in environments with distributed role administration.

• CVE-2025-7064MEDIUM 6.6

  ABB Freelance contains an authentication bypass vulnerability that allows users with local system access to circumvent normal login controls. By exploiting a primary weakness in the authentication mechanism, an attacker with low-level privileges can gain unauthorized access to functionality that should be restricted. This affects multiple versions of Freelance spanning from 2013 through 2024.

• CVE-2026-12115MEDIUM 6.6

  The Counter Box plugin for WordPress contains a vulnerability that allows administrator-level users to inject malicious PHP objects into the system through its import feature. The vulnerability exists in how the plugin processes imported data without properly validating it first. However, the injected objects themselves cannot cause direct harm unless other plugins or themes on the same WordPress site contain specific vulnerable code patterns (called POP chains) that could be chained together with this vulnerability. The injection occurs automatically when importing data or editing imported items, with no extra steps required from the attacker.

• CVE-2026-35291MEDIUM 6.6

  Oracle WebLogic Server contains a vulnerability in its Console component that could allow a highly privileged attacker to take over the server if they have network access. The flaw affects versions 14.1.2.0.0 and 15.1.1.0.0 and requires the attacker to already have high-level administrative privileges and overcome additional technical barriers to exploit it. Successful exploitation would give an attacker complete control over the WebLogic Server's data and operations.

• CVE-2026-41976MEDIUM 6.6

  CVE-2026-41976 is a permission control flaw in an audio framework that could allow an attacker with local access to read sensitive audio data. The vulnerability requires user interaction to trigger but does not need special privileges to exploit. While the confidentiality impact is high, the ability to modify or destroy audio data or services is more limited. This is a medium-severity issue that warrants prompt attention in environments where audio processing handles sensitive information.

• CVE-2026-42014MEDIUM 6.6

  GnuTLS, a widely-used cryptographic library, contains a use-after-free memory bug in its PIN management function. When an attacker attempts to change a Security Officer PIN on a hardware token that doesn't have protected authentication safeguards, the library incorrectly handles memory, potentially allowing local attackers to crash the service or manipulate sensitive cryptographic operations. This vulnerability requires local access and elevated privileges to exploit, making it primarily a risk in multi-tenant or shared-access environments.

• CVE-2026-44754MEDIUM 6.6

  CVE-2026-44754 is a missing access control issue in SAP's Operational Data Provisioning (ODP) Remote Function Call module. The RFC interface is not properly verifying which applications are permitted to use it, allowing unapproved customer or third-party applications to call functions they shouldn't have access to. This creates an uncontrolled data disclosure risk but does not compromise data integrity or significantly impact system availability. The vulnerability requires an attacker to already have high-level privileged access to the environment, which limits immediate exploitability in most organizations.

• CVE-2026-53818MEDIUM 6.6

  OpenClaw versions before 2026.4.24 have a security flaw in their MCP loopback feature that lets unauthorized users bypass owner-level restrictions. An attacker with local access can invoke privileged tools that should only be available to the system owner, potentially leading to unauthorized actions within OpenClaw's environment.

• CVE-2026-53820MEDIUM 6.6

  OpenClaw versions before 2026.5.12 contain a security flaw that allows authorized users to bypass restrictions on what commands they can execute. The vulnerability exists in the bundled MCP (likely a module or component interface) loopback session-spawn mechanism. An authenticated attacker can exploit this to gain access to command execution capabilities that should have been restricted, potentially allowing them to perform actions beyond their intended permissions.

• CVE-2026-53861MEDIUM 6.6

  OpenClaw, a macOS security tool, has a flaw in how it validates commands before executing them. The vulnerability allows an attacker with local access to bypass the allowlist (a list of approved commands) by using a specific syntax trick with combined POSIX flags. This means an attacker could potentially run commands that should have been blocked, though the actual impact depends on how the tool is configured by the operator.

• CVE-2026-57438MEDIUM 6.6

  Nokogiri, a widely-used Ruby library for parsing XML and HTML, has a memory safety flaw in its XInclude feature. When the library processes XInclude directives (a standard XML feature that lets documents reference external content), it frees memory without properly notifying Ruby objects that may still reference it. If your application code has kept a reference to a fallback element or namespace from an included file, using that reference afterward can read from or write to memory that's no longer valid, potentially causing crashes or unexpected behavior.

• CVE-2026-7566MEDIUM 6.6

  The LearnPress – Backup & Migration Tool WordPress plugin contains a PHP Object Injection flaw that allows authenticated administrators to inject malicious serialized objects into the application. By itself, this vulnerability is limited in impact because the plugin does not include a known Property-Oriented Programming (POP) chain. However, if your WordPress installation also runs other vulnerable plugins or themes that contain POP chains, an administrator could potentially weaponize this vulnerability to delete files, steal sensitive data, or execute arbitrary code on your server.

• CVE-2018-25393MEDIUM 6.5

  Navigate CMS version 2.8.5 contains a flaw that allows authenticated users to download files they shouldn't have access to by manipulating the download request. An attacker with valid login credentials can craft specially-formed requests to the navigate_download.php component using directory traversal patterns (such as ../../../) to sidestep folder boundaries and retrieve sensitive system files like configuration files outside the application's normal download directory.

• CVE-2018-25421MEDIUM 6.5

  Open STA Manager version 2.3 has a security flaw that allows authenticated users to download files they shouldn't have access to. An attacker with valid login credentials can manipulate web requests to trick the application into retrieving sensitive system files, such as configuration files or data stored outside the intended application directory. The vulnerability exists in the backup module and exploits how the application handles file path requests.

• CVE-2019-25716MEDIUM 6.5

  Dräger's Infinity Delta, Delta XL, and Kappa patient monitors are vulnerable to a denial-of-service attack triggered by malformed network packets. An attacker on the same network segment can send specially crafted packets that force the monitor to reboot repeatedly, disrupting patient monitoring and causing the device to lose network connectivity and revert to default settings. This is a network-adjacent threat that degrades clinical visibility rather than exposing patient data directly.

• CVE-2019-25720MEDIUM 6.5

  Dräger patient monitoring systems (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) are vulnerable to denial-of-service attacks from attackers on the same network segment. An unauthenticated attacker can send specially crafted network packets to force the monitor to reboot repeatedly, disrupting continuous patient monitoring. The device may then revert to default settings and lose network connectivity, compounding the disruption to clinical workflows.

• CVE-2019-25721MEDIUM 6.5

  Dräger Infinity M300 wearable patient monitors running software version VG2.3.1 or earlier are vulnerable to network-based denial-of-service attacks. An attacker positioned on the same network can send specially crafted requests that force the device to reboot repeatedly, effectively taking the monitor offline and disrupting patient monitoring. This is a network-adjacent threat that requires no authentication or user interaction to trigger.

• CVE-2019-25724MEDIUM 6.5

  Dräger Infinity M300 wearable patient monitors running software version VG2.x and earlier are vulnerable to a network-based denial-of-service attack that forces repeated device reboots. An attacker positioned on the hospital network or Infinity Network can trigger these reboots until the monitor enters a failed state, requiring manual intervention to restore function. During this attack window, wireless connectivity drops, patient monitoring capability is interrupted, and alarm functions become unavailable—creating a gap in real-time clinical visibility that could delay detection of patient deterioration.

• CVE-2019-25740MEDIUM 6.5

  A vulnerability in Joomla's com_jsjobs extension version 1.2.6 allows authenticated users to delete files from the web server. An attacker who has valid login credentials can craft a malicious request that exploits how the extension handles file path parameters, bypassing intended restrictions and removing files the web server can access. This is a path traversal flaw that turns file upload/management functionality into an unauthorized deletion mechanism.

• CVE-2020-37248MEDIUM 6.5

  OfflineIMAP before version 8.0.3 contains a man-in-the-middle vulnerability in its STARTTLS implementation. The application accepts the server's claim that TLS encryption is available without verifying it before sending login credentials, allowing an attacker on the network to intercept and read account usernames and passwords in cleartext. This is a classic STRIPTLS attack where the attacker downgrades the connection from encrypted to unencrypted.

• CVE-2024-35690MEDIUM 6.5

  CVE-2024-35690 is a data exposure vulnerability in MarketingFire's Widget Options plugin. The flaw allows authenticated users to retrieve sensitive information that should not be transmitted over the network. An attacker with valid login credentials can extract embedded sensitive data by exploiting how the plugin handles and sends data. This is not a remote unauthenticated attack, but the exposure of sensitive information through a trusted plugin represents a meaningful risk to organizations relying on MarketingFire.

• CVE-2024-37210MEDIUM 6.5

  CVE-2024-37210 is a missing authorization flaw in ali2woo AliNext that allows authenticated users to access resources or perform actions they shouldn't be permitted to reach due to improperly configured access controls. An attacker with valid login credentials can exploit weak authorization checks to view sensitive information, though they cannot modify data or disrupt service availability. All versions through 3.3.5 are affected.

• CVE-2024-47477MEDIUM 6.5

  Dell PowerFlex Manager versions before 4.5.1.1 have a flaw in how they validate SSL/TLS certificates from servers they connect to. An attacker on the network path between a user and PowerFlex Manager could intercept and impersonate the legitimate server, potentially gaining access to sensitive data or modifying communications. The vulnerability requires the attacker to also poison DNS records to redirect traffic, but both techniques are well-established attack vectors that don't require authentication or user interaction.

• CVE-2024-51454MEDIUM 6.5

  IBM Engineering Workflow Management versions 7.0.2, 7.0.3, and 7.1 (up to specific interim fixes) contain a flaw in how they validate HTTP HOST headers. An attacker can inject malicious content into these headers to manipulate how the application processes requests. This could enable attackers to steal session credentials, poison cached content, or execute JavaScript in users' browsers. The vulnerability requires no authentication and can be triggered remotely over the network.

• CVE-2024-54178MEDIUM 6.5

  IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data contain a resource allocation flaw that allows authenticated users to trigger a denial of service condition when creating new databases. An attacker with valid credentials can exhaust system resources during database creation, making the service unavailable to legitimate users. This is not a remote unauthenticated attack—the threat actor must first obtain valid authentication credentials.

• CVE-2024-6858MEDIUM 6.5

  Arista EOS switches running in 802.1X authentication mode contain a logic flaw that can allow unauthorized devices to bypass port access controls. If an unauthenticated device is present on a port configured for multi-auth, and there is an EAPOL-capable (Extensible Authentication Protocol over LAN) device in the fallback VLAN, the unauthenticated device may be granted network access when it should remain blocked. This creates an authentication bypass condition specific to the multi-auth scenario and fallback VLAN configuration.

• CVE-2025-15661MEDIUM 6.5

  libssh2 versions up to 1.11.1 contain a flaw in how they handle responses from SSH servers during SFTP file operations. A malicious or compromised SSH server can craft a specially-malformed response that causes the client library to read beyond the boundaries of its own memory buffer. This can leak sensitive data from the application's memory or cause the client to crash. The vulnerability exists in the symlink-related operations (READLINK and REALPATH) and requires network access to an SSH server, but does not require user interaction or special privileges.

• CVE-2025-48977MEDIUM 6.5

  Apache Ignite REST API contains a path traversal vulnerability that allows authenticated users to read arbitrary files from the server by manipulating the log path parameter in API commands. An attacker with valid REST API credentials can escape the intended log directory and access sensitive files anywhere on the system. This affects Ignite versions 2.0.0 through 2.17.0, and the vendor has released version 2.18.0 to address it.

• CVE-2025-5089MEDIUM 6.5

  CVE-2025-5089 is a denial-of-service vulnerability affecting Arista EOS switches and CloudVision eXchange (CVX) servers when they communicate with each other. When either device receives specially crafted messages over their management connection, it can crash internal system processes, causing the EOS switch to reset or the CVX cluster to become unstable. An attacker would need legitimate administrative access to one of these connected devices to exploit this vulnerability—it cannot be triggered remotely by an unauthenticated outsider.

• CVE-2025-5090MEDIUM 6.5

  CVX, a network control platform, crashes when it receives malformed or unexpected messages from a connected network switch. An attacker with administrative access to that switch could exploit this instability to repeatedly trigger crashes, disrupting the CVX cluster's availability. This is a denial-of-service vulnerability that requires high privilege on the switch infrastructure to execute.

• CVE-2025-52766MEDIUM 6.5

  CVE-2025-52766 is a missing authorization flaw in Printeers Print & Ship that allows authenticated users to perform actions they shouldn't have permission to do. An attacker with valid login credentials can exploit improperly configured access controls to modify data or settings—for instance, altering print job configurations, shipping labels, or account information belonging to other users or tenants. The vulnerability requires an authenticated user; it cannot be exploited by unauthenticated attackers. The impact is elevation of privilege within the application, not confidentiality compromise or service disruption.

• CVE-2025-55639MEDIUM 6.5

  GPAC's MP4Box version 2.4 contains a flaw that can crash the application when processing a specially crafted MP4 file. An attacker can exploit this by distributing a malicious MP4 that triggers a crash in any system using MP4Box to process or validate video files, disrupting availability without requiring special privileges or authentication.

• CVE-2025-55642MEDIUM 6.5

  GPAC MP4Box version 2.4 contains a flaw that can cause the application to crash when processing certain MP4 files. The vulnerability exists in code responsible for handling audio and video data during file writing operations. An attacker could craft a malicious MP4 file that, when opened in MP4Box, triggers a mathematical error leading to a denial of service. No data theft or file corruption occurs, but the crash prevents legitimate work with video files.

• CVE-2025-55658MEDIUM 6.5

  GPAC MP4Box version 2.4 contains a bug in how it processes Opus audio codec headers within MP4 files. When processing a specially crafted MP4 file, the application crashes due to a floating point exception—essentially a mathematical error in code that causes the program to terminate. An attacker can exploit this by distributing a malicious MP4 file, causing MP4Box to crash whenever a user or automated system tries to process it. This is a denial-of-service vulnerability that affects availability but does not compromise data confidentiality or integrity.

• CVE-2025-55659MEDIUM 6.5

  GPAC MP4Box version 2.4 contains a flaw that causes the application to crash when processing a specially crafted MP4 media file. An attacker can exploit this by distributing a malicious MP4 file that, when opened by a user, triggers a denial of service condition. The vulnerability does not compromise data confidentiality or integrity—it simply stops the application from functioning until it is restarted.

• CVE-2025-58175MEDIUM 6.5

  GeoServer, an open-source geospatial data sharing platform, contains a Server-Side Request Forgery (SSRF) vulnerability in versions before 2.26.4 and 2.27.3. An attacker without authentication can exploit this flaw to make the server perform unauthorized network requests on their behalf, potentially accessing internal resources or sensitive data. The vulnerability is only active when GeoServer is configured with a proxy base URL lacking a path component or trailing slash, and when entity resolution allowlist is enabled (the default since version 2.25.0).

• CVE-2025-59174MEDIUM 6.5

  Ericsson's Packet Core Controller (PCC) software versions before 1.39 can be knocked offline or severely degraded when an attacker on the same network segment sends large numbers of specially crafted messages. An attacker doesn't need credentials or user interaction to trigger the problem, but they do need network access to the affected system. This is a denial-of-service vulnerability that could disrupt telecom packet routing and control functions.

• CVE-2025-59601MEDIUM 6.5

  CVE-2025-59601 describes an information disclosure vulnerability in multiple Qualcomm wireless and audio components. When a device is factory reset through its powerline interface, sensitive configuration data may be exposed to an attacker with adjacent network access. This allows unauthorized parties to read device settings that should have been wiped during the reset process. The vulnerability does not allow modification of settings or denial of service, but the exposure of configuration details could enable further attacks or reveal sensitive operational parameters.

• CVE-2025-62858MEDIUM 6.5

  A buffer overflow flaw exists in QNAP's QTS and QuTS hero operating systems that allows a high-privileged attacker to corrupt memory or crash running processes. Because the vulnerability requires prior administrative access, the risk is contained to scenarios where an admin account has been compromised or a trusted insider acts maliciously. QNAP has released patched versions across all affected product lines.

• CVE-2025-64215MEDIUM 6.5

  StylemixThemes MasterStudy LMS Pro contains a missing authorization vulnerability that allows unauthenticated attackers to access functionality that should be restricted by access control lists (ACLs). An attacker can exploit this flaw to perform unauthorized actions affecting the integrity and availability of the learning management system without requiring authentication or user interaction.

• CVE-2025-70101MEDIUM 6.5

  CVE-2025-70101 is a memory safety flaw in the lwext4 library, a lightweight ext4 filesystem implementation. When processing a specially crafted ext4 disk image, the library can read past the end of allocated memory due to missing validation checks. An attacker who tricks a user into opening a malicious filesystem image can trigger this out-of-bounds read, causing the application to crash. This is primarily a denial-of-service risk rather than a gateway to data theft or system compromise.

• CVE-2025-71332MEDIUM 6.5

  Flowise, a popular workflow automation platform, contains a SQL injection vulnerability in its chatflow import feature. An authenticated attacker can upload a specially crafted JSON file that executes arbitrary SQL commands on the backend database. The vulnerability stems from a failure to properly sanitize the chatflow ID before inserting it into a SQL query. While authentication is required to exploit this issue, the impact is significant: attackers can extract sensitive data from the credential table, potentially compromising stored API keys, passwords, and other authentication tokens used by the platform.

• CVE-2025-71382MEDIUM 6.5

  MuPDF, a popular open-source PDF and EPUB rendering library, contains a denial-of-service vulnerability in its EPUB CSS processing engine. An attacker can craft a malicious EPUB file with deeply nested HTML elements and CSS styles that causes the application to recursively process CSS property inheritance without stopping, ultimately crashing any application using MuPDF to read EPUB files. The vulnerability requires user interaction (opening the file) but affects any software embedding MuPDF for document viewing.

• CVE-2026-0039MEDIUM 6.5

  CVE-2026-0039 is an integer overflow vulnerability in Android's ubsan_throwing_runtime.cpp that allows an authenticated attacker to remotely crash or disable affected devices. The flaw resides in multiple functions and can be exploited without user interaction, making it a straightforward denial-of-service vector for anyone with network access to a vulnerable Android system.

• CVE-2026-0040MEDIUM 6.5

  CVE-2026-0040 is an integer overflow vulnerability in Google Android's ubsan_throwing_runtime.cpp file that allows an authenticated attacker to remotely crash the system. No special privileges or user interaction are required for exploitation, making this a straightforward denial-of-service attack vector. The flaw resides in multiple functions within a core runtime component, meaning the exposure is likely widespread across affected Android versions.

• CVE-2026-0041MEDIUM 6.5

  An integer overflow vulnerability exists in Google Android's UBSan (Undefined Behavior Sanitizer) runtime code. When triggered, the overflow causes the sanitizer itself to fail rather than safely handling undefined behavior, resulting in application crashes or service disruption. An authenticated attacker can remotely exploit this without user interaction, making it a network-reachable denial-of-service vector.