2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

2141 published vulnerabilities · page 21 of 22

• CVE-2026-44785MEDIUM 4.3

  Discourse, an open-source discussion platform, contains an authorization flaw in its AI-powered "explain" feature. When a user asks the system to explain a reply to a post, the feature only checks whether the user can see the reply itself—not whether they should have access to the parent post being discussed. This oversight allows any authenticated user with access to the AI helper to read hidden or restricted parent posts by simply requesting an explanation of a public reply to them. The vulnerability affects multiple version branches and has been patched.

• CVE-2026-44957MEDIUM 4.3

  Revive Adserver versions 6.0.6 and earlier contain a flaw in their XML-RPC API that fails to properly verify user permissions when reassigning entities to different parent entities. An attacker with low-level API access cannot exploit this vulnerability alone; they would need either a separate critical vulnerability (CVE-2026-34917) or a custom third-party extension to reach the vulnerable code. When those conditions align, an attacker could reassign entities without authorization, creating inconsistent ownership relationships that may allow lateral privilege expansion or data manipulation.

• CVE-2026-45264MEDIUM 4.3

  Nextcloud versions spanning 17.0.0 through 21.0.3 contain a permission bypass vulnerability that allows users with read and create access—but explicitly not update access—to rename files within team folders. This unintended capability undermines the granular permission model Nextcloud enforces, potentially enabling unauthorized modification of file metadata and organizational disruption. The issue affects a broad version range and has been patched across all active release lines.

• CVE-2026-45286MEDIUM 4.3

  An authenticated user on a Nextcloud instance can discover other users' identities by abusing the Calendar app's attendee-suggestion feature. The vulnerability exists because this endpoint bypasses the access controls that Nextcloud applies elsewhere. An attacker already logged into the system can systematically enumerate valid usernames, potentially laying groundwork for targeted attacks like password spraying or social engineering. The flaw affects Nextcloud versions 5.5.13 through 5.5.16 and 6.2.0 through 6.2.2.

• CVE-2026-45544MEDIUM 4.3

  Nextcloud Tables, a collaborative document and data management component, contains an information disclosure vulnerability affecting versions 0.8.0 through 1.0.3. The issue allows users with read-only access to view filter criteria—potentially including sensitive column names, field definitions, or search logic—that should have been restricted to higher-privilege users. This represents a low-severity data exposure that could leak operational details about table structure and content filtering strategies. The vulnerability has been resolved in Nextcloud Tables versions 1.0.4 and 2.0.0.

• CVE-2026-45563MEDIUM 4.3

  Roxy-WI, a popular web management interface for load balancers and web servers, contains a flaw that allows any logged-in user to view detailed audit trails of other users' administrative actions. Even a guest-level user in one department can see which servers another user has accessed, what configuration changes they deployed, and what services they restarted. The vulnerability affects Roxy-WI versions 8.2.6.4 and earlier. While this doesn't grant direct control over infrastructure, it exposes sensitive operational history that should remain confidential.

• CVE-2026-45650MEDIUM 4.3

  CVE-2026-45650 is a user interface spoofing vulnerability in Microsoft Bing that allows attackers to misrepresent critical information to users over the network. An attacker can craft a malicious link or interaction that tricks Bing's UI into displaying false or misleading content, potentially leading users to believe they are viewing legitimate search results, advertisements, or information when they are not. This requires user interaction to succeed, meaning a victim must click a link or engage with the spoofed element.

• CVE-2026-45729MEDIUM 4.3

  ThorVG, a vector graphics rendering engine, contains a flaw that can crash applications using it when they process malicious SVG files. An attacker can craft a specially formatted SVG document as small as 6 bytes that triggers an application crash when the affected code path is invoked. This is a denial-of-service vulnerability affecting availability but not data confidentiality or integrity. The issue was introduced in earlier versions and is resolved in ThorVG 1.0.5.

• CVE-2026-45776MEDIUM 4.3

  OpenXDMoD is an open-source framework used by HPC (high-performance computing) centers to collect and monitor system performance metrics. Versions before 11.0.3 contain a session-handling flaw that allows an authenticated attacker to manipulate authorization checks. If an installation includes the optional Job Performance (SUPReMM) module, an attacker could view other users' job efficiency data they shouldn't have access to. The vulnerability requires an existing login but does not require admin privileges.

• CVE-2026-46542MEDIUM 4.3

  Nimiq, a Rust-based blockchain implementation, contains a vulnerability in how it validates cryptographic keys used for multisig (multi-signature) operations. When the system processes Ed25519 public keys, it only checks that the key is 32 bytes long—the correct size—but doesn't verify that those bytes actually represent a valid point on the Ed25519 elliptic curve. An attacker can send a specially crafted, mathematically invalid public key that passes the length check. When the Nimiq node attempts to process this malformed key during multisig delinearization, the code crashes due to an uncaught exception, causing a denial-of-service condition. This affects Nimiq versions before 1.4.0.

• CVE-2026-46605MEDIUM 4.3

  Apache ActiveMQ has an authorization flaw that allows authenticated users to delete message queues and topics they shouldn't be able to modify. An attacker with valid credentials to your messaging system could disrupt operations by removing critical destinations, even if permission controls suggest they shouldn't have that ability. This affects ActiveMQ versions before 5.19.7 and 6.0.0 through 6.2.5.

• CVE-2026-46645MEDIUM 4.3

  SQLAdmin, a popular admin interface library for SQLAlchemy, contains an access control bypass vulnerability in its ajax_lookup feature. When developers restrict access to certain database models using the library's access control mechanism, authenticated users can circumvent those restrictions by sending requests directly to the ajax_lookup endpoint. This allows them to retrieve data from models they shouldn't have permission to access. The vulnerability was fixed in version 0.25.1.

• CVE-2026-46747MEDIUM 4.3

  SINEC INS, Siemens' network security appliance, contains a path traversal vulnerability in its file upload API endpoint. An authenticated user can craft malicious directory paths to access files outside their intended scope on the server. The vulnerability affects all versions prior to V1.0 SP2 Update 6 and requires valid login credentials to exploit, limiting but not eliminating risk in environments where account compromise or insider threats are concerns.

• CVE-2026-46764MEDIUM 4.3

  Apache Airflow contains an authorization bypass flaw in its audit-log API endpoints. An authenticated user with read access to audit logs for one workflow (Dag) can bypass per-Dag scoping restrictions and view audit-log entries from any other Dag in the same Airflow deployment by directly requesting specific event log IDs. The vulnerability stems from inconsistent permission enforcement: the collection endpoint properly restricts results by Dag, but the detail endpoint applies only a generic audit-log permission check without verifying the requester has access to the specific Dag whose logs are being retrieved. This allows low-privileged users to enumerate and read sensitive audit trails across Dags they should not be able to access.

• CVE-2026-47224MEDIUM 4.3

  NanaZip, a Windows-native fork of the popular 7-Zip archiver, contains a memory safety flaw in how it processes LVM (Logical Volume Manager) disk images. When a user opens a specially crafted LVM disk image file, the application can read beyond the boundaries of allocated memory. This weakness could cause NanaZip to crash or, in theory, leak sensitive data from memory. The issue affects NanaZip versions 3.0.1000.0 through 6.0.1697.0. Users should upgrade to version 6.0.1698.0 or later to resolve the issue.

• CVE-2026-47236MEDIUM 4.3

  Solidtime, an open-source time-tracking application, contains an authorization bypass vulnerability in its team management interface. Prior to version 0.12.2, the web page that displays team members and pending invitations fails to properly enforce permission checks, allowing any employee in the organization to view sensitive information—including pending invitation email addresses and member lists—even though the same data is correctly restricted in the official API. The vulnerability stems from incomplete permission validation in the Jetstream page handler, which checks only basic team membership rather than the required invitations:view and members:view permissions.

• CVE-2026-47263MEDIUM 4.3

  Discourse versions released between early 2026 and mid-2026 contain an access control flaw in their webhook event redelivery system. When Discourse attempts to resend failed webhook notifications, it broadcasts internal event data to a world-readable channel without properly restricting who can see it. Any logged-in user—or any visitor on instances without login requirements—can discover and read webhook events by guessing sequential webhook IDs. This exposes sensitive data that webhook endpoints are designed to receive privately, such as user activity, content moderation events, or custom application logic tied to your Discourse instance.

• CVE-2026-47675MEDIUM 4.3

  Hono, a JavaScript web framework, contains a flaw in how it sanitizes cookie options. While the framework validates certain cookie parameters (domain and path) to prevent malicious characters from breaking the Set-Cookie header, it fails to apply the same checks to sameSite and priority options. If an application passes user-controlled input directly into these parameters, an attacker could inject additional cookie attributes into the response header, potentially manipulating cookie behavior or setting unintended security policies.

• CVE-2026-47696MEDIUM 4.3

  WWBN AVideo, an open-source video hosting platform, contains a payment processing vulnerability in versions 29.0 and earlier. When both the AuthorizeNet and YPTWallet plugins are active, any logged-in user can artificially inflate their account wallet balance without actually paying. The vulnerable endpoint accepts a user-supplied amount parameter and immediately credits the wallet without verifying that a real payment transaction occurred through Authorize.Net. This is a financial manipulation flaw that bypasses payment authentication entirely.

• CVE-2026-47991MEDIUM 4.3

  Adobe Experience Manager contains a flaw that allows attackers to craft deceptive URLs that redirect users to attacker-controlled websites. If a victim clicks such a link, they may be taken to a fake login page or other malicious site where their credentials could be stolen, leading to account compromise. This vulnerability affects multiple AEM versions and requires user interaction—the attacker must convince someone to click the malicious link.

• CVE-2026-48092MEDIUM 4.3

  7-Zip versions 9.34 through 26.00 contain a flaw in how they process SquashFS archive files that can leak sensitive data from memory when extracting files. The vulnerability exists only in 32-bit builds of 7-Zip and requires an attacker to craft a malicious archive with specially modified metadata. When a user extracts such an archive, heap memory contents that should remain private are instead written into the extracted file, potentially exposing passwords, encryption keys, or other sensitive information stored in memory. The issue stems from integer arithmetic wrapping that bypasses safety checks. Users on 64-bit systems are not affected.

• CVE-2026-48103MEDIUM 4.3

  7-Zip versions 9.34 through 26.00 contain a memory read vulnerability in the WIM (Windows Imaging Format) archive handler. When processing specially crafted WIM files, the software reads a small amount of data just beyond an allocated memory region due to an off-by-one error in bounds checking. This occurs automatically in the file manager when listing directory contents, requiring only that a user open or preview a malicious WIM file. The practical impact is limited to crashes or potential minor leaks of adjacent memory; no file corruption or system compromise is possible through this flaw alone.

• CVE-2026-48111MEDIUM 4.3

  7-Zip versions 9.21 through 26.00 contain a boundary-checking flaw in their UEFI firmware image parser. When processing certain archive sections, the parser uses an incorrect comparison operator that allows a malicious opcode value to read data beyond an array's bounds. This can either crash the application when the out-of-bounds memory is invalid, or leak small amounts of adjacent string data into the archive's metadata. The flaw is triggered automatically when opening a specially crafted archive file, but the leaked information is limited and does not expose sensitive data or memory layout information.

• CVE-2026-48518MEDIUM 4.3

  MultiJuicer, a platform for running isolated Juice Shop instances on Kubernetes clusters, contains a cross-site request forgery (CSRF) vulnerability in its team join endpoint. Versions 8.0.0 through 10.0.0 accept requests regardless of content type, allowing attackers to craft web pages that silently add victims to attacker-controlled teams. When a victim visits an attacker's page, their browser automatically submits a form to the vulnerable endpoint, enrolling them in the attacker's team without their knowledge. This causes victims to unknowingly solve security challenges under the attacker's identity, inflating scores and exposing any sensitive data entered during exercises. The attack requires no prior authentication and bypasses standard CORS protections and SameSite cookie policies.

• CVE-2026-48810MEDIUM 4.3

  FreeScout, a free help desk platform built on Laravel, contains an authorization flaw in version 1.8.220 and earlier. A user with conversation editing permissions who authored a message in one mailbox can edit that message's content even after an administrator removes them from that mailbox. The vulnerability exploits a gap in access controls: the system verifies the user created the message and has the global edit permission, but fails to confirm the user still belongs to the mailbox where the conversation lives. This allows former mailbox members to alter thread history and potentially mislead team members or customers.

• CVE-2026-48811MEDIUM 4.3

  FreeScout, an open-source helpdesk and shared inbox platform, contains a flaw that allows former team members to permanently delete internal notes—even after their access to the mailbox has been revoked. A non-admin user who previously created private threads in a conversation can return and destroy those notes without authorization, because the system fails to verify whether the user still belongs to the mailbox. This affects FreeScout versions before 1.8.221.

• CVE-2026-4888MEDIUM 4.3

  Everest Forms, a popular WordPress form-building plugin, contains a security flaw that allows low-privilege logged-in users to send emails from your website to anyone they choose. Any user with Subscriber access or higher can exploit this by calling an internal email-testing function without proper permission checks. This doesn't require clicking malicious links or advanced technical skills—just authenticated access to your WordPress admin panel.

• CVE-2026-49140MEDIUM 4.3

  Nanobot versions before 0.2.1 have a denial-of-service flaw in how they handle media downloads from Matrix chat rooms. An authenticated user in a room can deliberately send specially crafted media events with missing or wrong size information, causing the system to download large files without properly checking their declared sizes first. By sending many of these malicious requests at once, an attacker can force the Nanobot process to consume excessive memory and bandwidth until the service becomes slow or unresponsive. The attacker must already be a member of the room to exploit this.

• CVE-2026-49288MEDIUM 4.3

  Statamic, a Laravel-based content management system, contained an authorization flaw that allowed authenticated users with Control Panel access to view content and metadata they weren't supposed to see. An attacker with valid login credentials could browse restricted entries, assets, user profiles, roles, and groups—exposing titles, custom field values, entry content, asset metadata, and the mere existence of sensitive organizational structures. The vulnerability is read-only; attackers could not modify data. Fixed in Statamic 5.73.23 and 6.20.0.

• CVE-2026-49322MEDIUM 4.3

  The 2025 Indian Motorcycle Scout Bobber + Tech model contains a flaw in its wireless control system that allows someone with access to the motorcycle's internal network to steal the owner's PIN unlock code by observing just a single authentication attempt. Instead of using proper cryptographic security, the system performs simple mathematical operations that can be reversed to recover the PIN, completely bypassing the bike's primary security lock.

• CVE-2026-49323MEDIUM 4.3

  The 2025 Indian Motorcycle Scout Bobber + Tech model contains a flaw in how its wireless control module authenticates with the engine control module. An attacker positioned on the vehicle's internal network can intercept a single authentication exchange and reverse-engineer the motorcycle's immobilizer secret—the cryptographic key that prevents unauthorized engine starts. Once recovered, the attacker can bypass the immobilizer entirely and start the engine without the key fob.

• CVE-2026-49337MEDIUM 4.3

  libde265, an open-source H.265 video decoder library, contains a memory management flaw that allows attackers to trigger unbounded memory growth on a victim's system. By sending a specially crafted sequence of video data packets, an attacker can cause the decoder to accumulate slice header data in memory without ever releasing it. This happens during normal video playback and can eventually exhaust available memory (denial of service). The vulnerability requires user interaction—someone must open or play a malicious video file—but does not require any special privileges or network access beyond the ability to deliver the crafted video.

• CVE-2026-49369MEDIUM 4.3

  JetBrains YouTrack versions before 2026.1.13162 contained a flaw that allowed authenticated users to access sensitive information about other users and groups they shouldn't be able to see. The vulnerability is limited to the Users and Groups administrative pages and requires valid login credentials to exploit. This is a straightforward authorization issue where the application failed to properly restrict who could view certain user and group data.

• CVE-2026-49377MEDIUM 4.3

  JetBrains TeamCity contains a configuration flaw where default agent parameters inadvertently expose sensitive data to authenticated users. An attacker with valid login credentials can access information through TeamCity's agent configuration that should remain restricted. This is a network-accessible issue affecting TeamCity deployments before version 2025.11.2, though the vulnerability requires prior authentication to exploit.

• CVE-2026-49378MEDIUM 4.3

  JetBrains TeamCity contained a vulnerability where stored credentials could be inadvertently exposed through the parameter autocompletion feature. When users typed in parameter fields, the system would suggest previously stored credential values, potentially revealing sensitive authentication data to anyone with access to the TeamCity interface. This issue affects TeamCity versions prior to 2026.1 and requires an authenticated user to interact with the affected feature. The exposure is limited to local disclosure within the TeamCity environment rather than remote exfiltration.

• CVE-2026-49482MEDIUM 4.3

  ClipBucket v5 has a vulnerability in its subtitle editing feature that allows authenticated users to corrupt subtitle data across multiple videos at once. By sending a specially crafted request with a wildcard character, an attacker with valid credentials can overwrite all subtitle titles for any video they control in a single action. This is a data integrity issue rather than a data exposure risk, and affects versions before 5.5.3 - #141.

• CVE-2026-49848MEDIUM 4.3

  FreeSWITCH versions prior to 1.11.1 contain a flaw in the Verto module's authentication handler that allows user-supplied session variables to be written into connection state before password validation occurs. Because these writes are append-only and failed authentication attempts don't close the WebSocket connection, variables from a bad login attempt persist and carry over into a subsequent successful login on the same connection. This creates a window for session state manipulation through repeated authentication attempts.

• CVE-2026-50569MEDIUM 4.3

  Fission, an open-source Kubernetes serverless framework, contains a validation bypass in its HTTP trigger configuration. Prior to version 1.25.0, two URL-related fields—RelativeURL and Prefix—were not properly validated when HTTPTrigger resources were created directly through kubectl or the Kubernetes REST API. While these fields were validated at the CLI level, the validation logic was absent from the core application and its API server rules. This means an attacker with Kubernetes API access could bypass URL restrictions by creating or modifying HTTPTrigger resources directly, potentially routing traffic to unintended functions or exposing restricted endpoints.

• CVE-2026-53436MEDIUM 4.3

  Jenkins contains a validation flaw in its login redirect mechanism that allows attackers to craft phishing URLs appearing to come from a legitimate Jenkins instance. When users log in, Jenkins is supposed to redirect them to internal pages, but the vulnerability allows attackers to redirect users to external malicious sites by exploiting how the application handles relative path segments (like `./` or `../`). An attacker would need to trick a user into clicking a specially crafted link, but the exploit itself is straightforward and doesn't require special technical skills.

• CVE-2026-53437MEDIUM 4.3

  Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier) contain a flaw in how they validate redirect URLs after user login. An attacker can craft a malicious redirect URL that appears to point to a legitimate Jenkins instance by inserting tab or newline characters between the `//` protocol separator, causing the validation to pass. When a user clicks such a link after logging in, they may be redirected to an attacker-controlled site while believing they're staying within Jenkins, enabling credential harvesting or other phishing attacks.

• CVE-2026-53438MEDIUM 4.3

  Jenkins versions 2.567 and earlier (or LTS 2.555.2 and earlier) contain a permission bypass flaw that allows authenticated users holding the Item/Cancel permission to cancel build queue items without requiring Item/Read permission. This means an attacker with limited cancellation rights can disrupt builds they shouldn't be able to view or access, effectively using one permission to circumvent another. The vulnerability is not actively exploited in the wild and requires authenticated access, making it a moderate risk in most deployments.

• CVE-2026-53439MEDIUM 4.3

  Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier) contain a permission bypass vulnerability that allows low-privileged attackers to discover sensitive information about other users. Specifically, attackers who have been granted the basic Overall/Read permission can view other users' timezone settings and enumerate the names of views in other users' private "My Views" sections. This is an information disclosure issue that could support reconnaissance or social engineering attacks, though it does not enable direct system compromise.

• CVE-2026-53440MEDIUM 4.3

  Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier) contain a flaw in their "Delegate to servlet container" security realm that fails to validate redirect destinations after user login. An attacker can craft a malicious link that redirects authenticated users to an attacker-controlled website, enabling phishing attacks that steal credentials or distribute malware while appearing to come from a legitimate Jenkins instance.

• CVE-2026-53463MEDIUM 4.3

  ImageMagick, a widely-used open-source image editing library, has a vulnerability in its distort operation that can cause the application to crash when given malformed parameters. The issue stems from improper handling of null pointers—a memory safety problem that occurs before the software attempts to process the distort command. Users who interact with untrusted images or accept image files from external sources face potential denial-of-service risk, though the vulnerability does not compromise data confidentiality or integrity.

• CVE-2026-53634MEDIUM 4.3

  Sharp, a Laravel-based content management framework, contains an authorization bypass affecting its Quick Creation Command feature in versions 9.0.0 through 9.22.2. An authenticated user without permission to create records in a specific entity could still use the Quick Creation feature to view creation forms and submit new records, provided that entity had a Quick Creation Command handler configured. This represents a privilege escalation flaw where the access control layer was not properly enforced on certain endpoints. The vulnerability has been resolved in version 9.22.3.

• CVE-2026-53675MEDIUM 4.3

  BuddyPress 14.4.0 has a flaw in its friends REST API that allows any logged-in user to view another user's complete friend list without permission. The vulnerability exists because the API endpoint checks only that someone is authenticated, not whether they should have access to the specific friend list being requested. An attacker with any user account can enumerate and collect the private social connections of any other user on the platform.

• CVE-2026-53736MEDIUM 4.3

  Easy Twitter Feeds versions before 1.2.13 have a cross-site request forgery (CSRF) vulnerability in their post duplication feature. An attacker can craft a malicious link that, when clicked by a logged-in user, will automatically duplicate posts without the user's knowledge or consent. The vulnerability exists because the plugin fails to validate that duplication requests actually came from the user, making it trivial for attackers to abuse the feature via social engineering or injected links.

• CVE-2026-53739MEDIUM 4.3

  Yoast Duplicate Post, a popular WordPress plugin for content management, contains a cross-site request forgery (CSRF) flaw in versions through 4.6. The vulnerability allows an attacker to craft a malicious webpage or email that, when visited by a logged-in WordPress administrator, automatically suppresses admin notices across the entire network without the admin's knowledge or consent. No special technical skill is required to exploit this—only the ability to trick an admin into clicking a link or visiting a page.

• CVE-2026-53781MEDIUM 4.3

  Summarize, a podcast and media management CLI tool, contains a vulnerability that allows attackers to exhaust a system's disk space. If you use Summarize before version 0.17.0, an attacker who controls a podcast feed or media URL can force the application to download an extremely large (or infinite) file to your disk. The vulnerability exists because Summarize doesn't properly validate file sizes when the server doesn't send proper size headers or uses certain types of data streaming. This can render your system unusable by filling up its storage.

• CVE-2026-53826MEDIUM 4.3

  OpenClaw versions prior to 2026.4.26 inadvertently leak sensitive workspace path information when child AI model sessions are spawned from sandboxed parent environments. An authenticated attacker can trigger this disclosure by creating child sessions, allowing them to discover the real underlying workspace location or related memory context that should remain isolated. The vulnerability requires valid credentials and does not involve network-level attacks or severe data manipulation, but it does undermine the security boundary that sandboxing is designed to maintain.

• CVE-2026-53835MEDIUM 4.3

  OpenClaw versions before 2026.5.6 have a flaw in how they enforce configuration rules for Feishu dynamic-agent bindings. An authenticated user can create or modify these bindings while bypassing the normal access controls that should restrict who can make such changes. This means someone with legitimate credentials could potentially create unauthorized connections between senders and agents that policy should have blocked.

• CVE-2026-53845MEDIUM 4.3

  OpenClaw versions before 2026.5.6 contain a vulnerability that allows authenticated users to bypass security hooks designed to audit and enforce policies on skill command execution. When skill commands are routed through a specific dispatch path, they skip the before-tool-call hooks that normally intercept and validate these operations. An attacker with valid credentials could exploit this to execute commands without triggering audit logs or policy checks.

• CVE-2026-53848MEDIUM 4.3

  OpenClaw before version 2026.5.26 has a security flaw that allows authenticated operators to bypass command allowlist restrictions. An attacker with valid operator credentials can craft specially formed requests that use transparent command wrappers to execute operations that should have been blocked by the allowlist. This affects the integrity of command execution controls but does not expose data or cause system availability issues.

• CVE-2026-53867MEDIUM 4.3

  Capgo versions prior to 12.128.2 do not properly clean up user profile images from storage when those images are replaced or deleted. This means old image files remain accessible on the backend server even after users think they've removed them. An attacker with a user account can leverage previously shared or discovered image URLs to retrieve these orphaned files, potentially accessing private user photos or other sensitive image data that should have been deleted.

• CVE-2026-53900MEDIUM 4.3

  Firefox for iOS was inadvertently preserving cookies from initial PDF requests even when those requests were redirected across different websites. An attacker could craft a malicious site that, when visited by a user, exploits this behavior to inject cookies into legitimate requests sent to an unrelated target domain—potentially allowing credential theft or session hijacking without the user's knowledge. Apple users running Firefox for iOS below version 152.0 are affected. Mozilla has patched this in Firefox for iOS 152.0.

• CVE-2026-55653MEDIUM 4.3

  A vulnerability in OpenSSH's Diffie-Hellman Group Exchange (DH-GEX) implementation allows a malicious SSH server to crash an SSH client through a double free memory error. The flaw is triggered when the client validates DH-GEX group parameters in FIPS mode and processes specially crafted attacker-controlled values. While the attack requires user interaction (initiating an SSH connection to a compromised server), it reliably terminates the client process, making it a straightforward denial-of-service vector. This affects OpenSSH clients across multiple platforms, particularly those running on Red Hat systems with FIPS compliance enabled.

• CVE-2026-56255MEDIUM 4.3

  Capgo versions before 12.128.2 contain a denial of service flaw in the demo application creation endpoint. An authenticated user with organization write permissions can abuse this endpoint to repeatedly create demo applications without any rate limiting. Each request triggers approximately 138 database operations, which can degrade system performance, inflate operational costs, and potentially cause service instability for all users.

• CVE-2026-56307MEDIUM 4.3

  Cap-go versions before 12.128.12 contain a pagination flaw in the device-management API endpoint that allows authenticated users with read access to devices to encounter broken pagination loops. When requesting lists of devices, the cursor mechanism fails to advance properly, causing the same pages of results to repeat indefinitely while later data becomes unreachable. This can disrupt workflows that depend on iterating through device inventories and may cause duplicate processing of device records.

• CVE-2026-6277MEDIUM 4.3

  GitLab EE contains an authorization bypass that allows authenticated users with Security Manager role to modify project security settings even when that feature is supposed to be disabled. An attacker with this role can circumvent intended access controls to manage security configurations that should be locked down, potentially weakening project defenses.

• CVE-2026-6689MEDIUM 4.3

  Mattermost has a permissions bypass vulnerability affecting multiple versions where authenticated users with team-creation rights can inappropriately configure invitation settings during team setup. Specifically, users lacking the PermissionInviteUser permission can set AllowOpenInvite (making a team publicly joinable) and AllowedDomains (restricting team membership to specific domains) during POST-based team creation—settings they would normally be blocked from configuring on existing teams. The vulnerability requires an authenticated account and results in unauthorized configuration of team access controls, not data disclosure or system failure.

• CVE-2026-7047MEDIUM 4.3

  The Frontend User Notes plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting all versions through 2.1.1. An attacker can craft a malicious webpage that, when visited by a logged-in WordPress user, silently overwrites that user's own notes without their knowledge or consent. The attack requires social engineering—tricking the victim into clicking a link or visiting a malicious site—but once successful, allows unauthorized modification of the victim's note content. Importantly, the vulnerability is self-contained: attackers cannot use it to tamper with other users' notes, only those belonging to the person they've tricked.

• CVE-2026-7516MEDIUM 4.3

  A vulnerability in Lenovo's Android application for tablets sold in China allows websites visited through the device's built-in browser to manipulate the system clipboard. An attacker could craft a malicious website that, when visited, overwrites clipboard contents with arbitrary data—potentially redirecting a user's next paste action to unintended destinations or injecting malicious content into applications that rely on clipboard input.

• CVE-2026-7523MEDIUM 4.3

  The Alba Board plugin for WordPress contains a flaw that allows attackers to bypass access controls and view sensitive project information they shouldn't be able to see. An authenticated user with basic subscriber access can retrieve private card data—titles, descriptions, due dates, and comments—that should be restricted to administrators and editors only. More critically, the vulnerability can be exploited by unauthenticated site visitors if the Alba Board shortcode appears anywhere on the website, because the security token (nonce) is exposed in the page source. All versions up to and including 2.1.3 are affected.

• CVE-2026-7526MEDIUM 4.3

  The PDF Embedder plugin for WordPress contains a flaw that allows authenticated users with basic contributor permissions or higher to access sensitive configuration information. If the premium add-on is installed with a saved license key, that key can be exposed; on free installations, the exposure is limited to non-sensitive viewer settings like dimensions and toolbar options. An attacker would need valid WordPress login credentials at the contributor level or above to exploit this, but no user interaction or network complexity is required once authenticated.

• CVE-2026-7533MEDIUM 4.3

  The Easy Digital Downloads plugin for WordPress contains a security flaw that allows attackers to hijack a store's Square payment processing account. An attacker can send a malicious link to a WordPress administrator; if clicked while logged in, the link silently changes the store's Square payment credentials to attacker-controlled ones, redirecting future payments to the attacker. The vulnerability exists because the plugin does not verify that payment configuration requests come from legitimate, authorized actions—a standard web security practice called CSRF protection.

• CVE-2026-7621MEDIUM 4.3

  The SMTP2GO for WordPress plugin contains an authorization flaw that allows any logged-in user with subscriber-level permissions or higher to delete all SMTP email logs from the database or export sensitive email records to CSV format. This affects all versions up to 1.16.0 and exposes recipient addresses, sender information, message subjects, and API response data. An attacker with basic user access can perform these destructive and data-exfiltration actions without additional authentication checks.

• CVE-2026-7624MEDIUM 4.3

  The Squirrly SEO plugin for WordPress has an access control flaw that allows lower-privileged users to perform actions meant only for administrators. Specifically, a contributor-level user can disconnect the website from Google Search Console and Google Analytics by invoking backend API calls that should be blocked. This is a privilege escalation issue affecting all versions up to 12.4.16.

• CVE-2026-8422MEDIUM 4.3

  The Remove meta boxes per user role WordPress plugin contains a security flaw that allows attackers to change how meta boxes (content panels) are hidden or shown for different user roles on a WordPress site. An attacker can't do this directly, but by tricking a site administrator into clicking a malicious link, the attacker can force the admin's browser to make unauthorized changes to these visibility settings. The vulnerability affects all versions up to and including 1.01.

• CVE-2026-8611MEDIUM 4.3

  A WordPress plugin called Klamra Paycal for Aspaclaria contains a flaw that allows authenticated users with subscriber-level permissions to access and download invoices belonging to other customers. The vulnerability stems from insufficient access controls on invoice retrieval—an attacker can simply modify an invoice identifier in a request to view sensitive billing data from any customer, including names, email addresses, phone numbers, order amounts, and internal notes. No special privileges or user interaction are required beyond basic authenticated access.

• CVE-2026-8682MEDIUM 4.3

  The 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On WordPress plugin contains a flaw that allows users with basic subscriber access to change critical plugin settings they should not be able to modify. An authenticated attacker can bypass authorization checks to write arbitrary data directly to the plugin's configuration stored in the database, potentially affecting how the 3D viewer and virtual try-on features function across the site.

• CVE-2026-8689MEDIUM 4.3

  The Visualizer: Tables and Charts Manager WordPress plugin contains an authorization bypass flaw that allows logged-in users with minimal privileges (Subscriber level and above) to create chart posts without proper permission checks and to view or modify charts belonging to other users, including site administrators. The vulnerability affects all versions through 3.11.14 and stems from missing capability validation in two critical AJAX functions. While the flaw requires an authenticated account, the low barrier to entry and potential for unauthorized data access make it a meaningful risk for multi-user WordPress installations.

• CVE-2026-8902MEDIUM 4.3

  The AJAX Report Comments plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 2.0.4. An attacker can trick a WordPress site administrator into unknowingly changing critical plugin settings—such as notification email addresses, comment thresholds, success messages, and cookie durations—by crafting a malicious link or webpage. The attack requires social engineering to get an admin to click a link, but once successful, the attacker can alter how the plugin behaves without any authentication.

• CVE-2026-8904MEDIUM 4.3

  The FastPicker plugin for WordPress, which integrates order picking and management capabilities with WooCommerce, contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 1.0.2. An attacker cannot exploit this vulnerability directly; instead, they must trick a WordPress site administrator into clicking a malicious link while logged in. If successful, the attacker can alter critical plugin settings—including webhook toggles and API endpoint URLs for FastPicker and KDZ services—without the administrator's knowledge or consent. This is a configuration-tampering risk rather than a direct data breach vector.

• CVE-2026-8909MEDIUM 4.3

  The WpMobi WordPress plugin contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick administrators into modifying plugin settings and injecting malicious scripts. An unauthenticated attacker can craft a malicious link or webpage that, when clicked by a site admin, silently changes the plugin's General Settings without the admin's knowledge or consent. The vulnerability is particularly concerning because the injected script executes in the admin's browser even when the malicious input fails validation, meaning the attack works regardless of server-side data checks.

• CVE-2026-8940MEDIUM 4.3

  The WP Meta Sort Posts WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to 0.9. An attacker can craft a malicious link or webpage that, when clicked by an administrator, silently changes plugin settings without their knowledge or consent. Specifically, the vulnerability allows modification of the msp_loop_file and msp_nav_location settings. This is possible because the plugin fails to properly validate security tokens (nonces) on the options page. The attack requires social engineering to trick an admin into clicking a link, but once successful, can alter how the plugin sorts and displays posts on the website.

• CVE-2026-8976MEDIUM 4.3

  The RSS Aggregator by Feedzy plugin for WordPress fails to properly verify user permissions, allowing contributors and higher-level users to perform administrative actions they shouldn't be able to access. An authenticated attacker with basic contributor rights can create RSS import jobs, delete all posts from any import, clear error logs, and view sensitive taxonomy and post metadata information. The vulnerability is particularly dangerous because the security token needed to perform these actions is automatically exposed to anyone who can edit posts through the block editor interface—no additional hacking or theft is required.

• CVE-2026-8995MEDIUM 4.3

  The Poll Maker – Versus Polls plugin for WordPress has a flaw that lets logged-in users see sensitive account information they shouldn't access, including password hashes. The vulnerability stems from an AJAX endpoint that returns the entire WordPress user object without proper security checks. Any subscriber or higher can call this endpoint and retrieve not just their own data, but potentially others' account details including email addresses, registration dates, roles, and capabilities. While the exposure doesn't immediately compromise an account, the password hash data could be targeted by offline cracking attempts.

• CVE-2026-9008MEDIUM 4.3

  The Page-list plugin for WordPress contains an authorization flaw in its shortcode feature that allows authenticated users with contributor-level or higher permissions to view sensitive content they shouldn't be able to access. By inserting a specially crafted shortcode into a draft post and previewing it, attackers can extract titles, body text, and metadata from private or draft pages across the entire site. The vulnerability exists because the plugin doesn't verify whether the current user is permitted to view the pages being queried.

• CVE-2026-9015MEDIUM 4.3

  The Equalize Digital Accessibility Checker plugin for WordPress contains a flaw that allows users with basic subscriber access to modify accessibility audit findings they shouldn't be able to touch. An authenticated attacker can change whether issues are marked as ignored, alter the reason for ignoring them, and add comments to any accessibility finding on the site. In some cases, they can perform bulk modifications across multiple related findings at once. This means someone with minimal privileges could systematically hide or dismiss accessibility compliance problems, undermining the integrity of WCAG and ADA audit records without proper authorization.

• CVE-2026-9048MEDIUM 4.3

  Slider Revolution, a popular WordPress plugin, contains a vulnerability that allows authenticated users with basic contributor privileges to view sensitive social media API credentials through a specific AJAX action. An attacker with contributor-level access or higher can call the 'slider.get.full' AJAX action to retrieve raw API tokens and keys—including Instagram OAuth tokens, Flickr API keys, YouTube Data API credentials, and Facebook App IDs—that have been configured within slider settings. This exposure affects plugin versions 7.0.0 through 7.0.14.

• CVE-2026-9050MEDIUM 4.3

  Slider Revolution, a popular WordPress plugin, contains a flaw that allows contributors and higher-privileged users to disable any plugin on a WordPress site without proper authorization checks. An attacker with basic contributor access—a common account level in multi-author sites—can leverage this to shut down security plugins, backup solutions, or other critical extensions. The vulnerability affects versions 6.0.0 through 6.7.55 and 7.0.0 through 7.0.14.

• CVE-2026-9228MEDIUM 4.3

  A WordPress plugin called Timetable and Event Schedule by MotoPress has a flaw that allows users with contributor-level access or higher to see confidential information they shouldn't have access to. Specifically, they can view drafts, pending reviews, and private event posts created by other users, including the content, excerpts, and author information. The vulnerability stems from the plugin failing to properly validate user input when retrieving event data, making it possible to directly access posts by guessing or enumerating their IDs.

• CVE-2026-9234MEDIUM 4.3

  The JTL-Connector for WooCommerce plugin contains authorization flaws that allow low-privileged WordPress users (Subscriber level and above) to perform administrative actions without proper permission checks. Specifically, attackers can change plugin configuration, download sensitive log files containing developer information, and delete those logs. This bypasses WordPress's built-in permission model and could lead to configuration tampering or information disclosure.

• CVE-2026-9241MEDIUM 4.3

  The FOX – Currency Switcher Professional for WooCommerce plugin contains a flaw that lets authenticated users trick the system into thinking they have higher privileges than they actually do. By manipulating a request parameter, a subscriber-level user can impersonate a wholesale customer or administrator to access pricing they shouldn't be able to see. This only matters if your store uses the fixed user-role pricing feature and has set special prices for privileged customer types.

• CVE-2026-9599MEDIUM 4.3

  The Tectite Forms plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 1.3. An attacker can trick a site administrator into clicking a malicious link, which then allows the attacker to change the plugin's settings without the administrator's knowledge. This could include modifying the tectite_forms_button option or other plugin configurations. The vulnerability requires social engineering but poses a real risk to WordPress sites using this plugin.

• CVE-2026-9618MEDIUM 4.3

  The PeachPay plugin for WordPress, which integrates payment processing for Stripe, PayPal, Square, and other providers, contains a cross-site request forgery (CSRF) vulnerability in all versions up to 1.120.46. An attacker can craft a malicious link or webpage that, when clicked by a site administrator, silently deletes all stored Stripe credentials from the site's database without the administrator's knowledge or consent. This disables Stripe payments immediately and requires the administrator to reconfigure the integration. The attack requires social engineering to trick an admin into clicking the link, but requires no special authentication or technical sophistication once the admin takes the bait.

• CVE-2026-9719MEDIUM 4.3

  The LatePoint WordPress plugin, which handles calendar booking and appointment scheduling, contains a security flaw that allows attackers to manipulate invoice statuses without proper authorization. An attacker can craft a malicious link or webpage and, if they trick a WordPress administrator into clicking it, change the status of any invoice—including fraudulently marking unpaid invoices as paid. This works because the plugin fails to properly validate requests before processing status changes.

• CVE-2026-9722MEDIUM 4.3

  The Laiser Tag plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting all versions through 1.2.5. An attacker can craft a malicious link or webpage that, when clicked by a site administrator, silently modifies critical plugin settings without the administrator's knowledge or consent. This includes changes to API keys, tag filtering rules, and tagging behavior—settings that directly control how the plugin functions across the site.

• CVE-2026-9723MEDIUM 4.3

  The Google Plus One Bottom plugin for WordPress contains a cross-site request forgery (CSRF) flaw that allows attackers to manipulate plugin settings without proper authorization. An attacker can craft a malicious link or web page that, when clicked by a site administrator, will change critical plugin configuration options—such as language preferences, callback functions, and URLs—without the administrator's knowledge or consent. This attack requires social engineering to trick an admin into clicking the malicious link, but requires no authentication or technical exploit code to execute.

• CVE-2026-9730MEDIUM 4.3

  The Remove NoFollow Commenter URL plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows unauthenticated attackers to change how the plugin displays comments. An attacker can craft a malicious link or webpage that, when clicked by a WordPress site administrator, silently modifies the plugin's comment settings without the administrator's knowledge or consent. This requires social engineering to trick an admin into visiting the attacker's content, but requires no special technical skills to exploit once that condition is met.

• CVE-2026-9732MEDIUM 4.3

  The EmergencyWP plugin for WordPress has a security flaw that allows attackers to change important plugin settings without authorization. An attacker would need to trick a WordPress site administrator into clicking a malicious link, but if successful, they could alter access controls, email addresses, and other critical configurations. This is a cross-site request forgery (CSRF) vulnerability caused by the plugin failing to properly validate requests before processing them.

• CVE-2026-9791MEDIUM 4.3

  An authenticated user who belongs to a Keycloak organization can request tokens or access APIs in ways that expose organization metadata, even after an administrator has turned off the Organizations feature. This metadata leakage could cause downstream applications (resource servers) to make incorrect access control decisions based on stale or unintended organization information.

• CVE-2026-9798MEDIUM 4.3

  Keycloak's account lockout feature, which temporarily disables accounts after repeated failed login attempts, can be bypassed when an attacker possesses valid client credentials. By using the Client-Initiated Backchannel Authentication (CIBA) flow—a legitimate OAuth 2.0 feature—attackers can circumvent the lockout and continue attempting to authenticate or obtain tokens. This undermines brute-force protection and creates a secondary path for unauthorized access once the attacker has obtained initial client credentials.

• CVE-2026-9807MEDIUM 4.3

  GitLab has patched a flaw in its Community and Enterprise editions where a Project Access Token that was supposed to be blocked could still access private project resources. This happened because the authorization checks weren't applied correctly when a token was revoked or blocked. An authenticated user with permissions to create or manage tokens could potentially exploit this before the fix was released, though the vulnerability requires prior login access and the attacker would need knowledge of or ability to create a blocked token.

• CVE-2026-9907MEDIUM 4.3

  A memory read vulnerability in Google Chrome's Dawn graphics component allows attackers to access sensitive data from different website origins. An attacker can craft a malicious web page that, when visited by a user, tricks Chrome into reading memory beyond intended boundaries and leaking information from other websites the user may have open. This affects Windows systems running Chrome versions prior to 148.0.7778.216.

• CVE-2026-9911MEDIUM 4.3

  CVE-2026-9911 is a memory safety issue in the ANGLE graphics library used by Google Chrome. When a user visits a specially crafted webpage, an attacker can read small amounts of sensitive data from the browser's memory. The vulnerability requires user interaction—visiting the malicious page—but needs no special permissions or browser configuration to exploit. While the data exposure is limited in scope, it could leak sensitive information like passwords, tokens, or cached credentials stored in memory.

• CVE-2026-9913MEDIUM 4.3

  A flaw in the ANGLE graphics library component of Google Chrome prior to version 148.0.7778.216 could allow an attacker to access memory outside intended bounds when a user visits a malicious website. The vulnerability requires user interaction (visiting a crafted page) but does not require special privileges. Potential impacts include disclosure of sensitive information, though the attacker cannot modify data or crash the browser directly through this flaw.

• CVE-2026-9919MEDIUM 4.3

  A WebGL processing flaw in Google Chrome for Android allows attackers to read data they shouldn't have access to by tricking users into visiting a malicious webpage. The vulnerability exists in how Chrome handles certain graphics operations and can leak information across website boundaries, but only affects the Android version of Chrome and requires user interaction to exploit.

• CVE-2026-9921MEDIUM 4.3

  Google Chrome on Android contains a flaw in its WebGL graphics processing where memory buffers may not be properly initialized before use. An attacker can exploit this by crafting a malicious HTML page that, when visited, allows them to read sensitive information from other websites—a cross-origin data leak. The vulnerability requires user interaction (clicking a link or viewing a page) but does not require special privileges or complex attack setup.

• CVE-2026-9929MEDIUM 4.3

  A flaw in how Google Chrome on Android handles WebGL—a technology that enables 3D graphics in web browsers—could allow an attacker to trick a user into visiting a malicious webpage and expose data from other websites the user has open. The attacker cannot force this to happen; the user must interact with the page, such as by clicking or scrolling. This is a cross-origin data leak, meaning sensitive information from one domain could become visible to JavaScript code running on an attacker's domain.