2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 24 of 41

• CVE-2026-55439MEDIUM 5.5

  Halo, an open-source website building tool, contains a path traversal vulnerability in its backup download feature that allows authenticated administrators to read files outside the intended backup directory. An administrator can craft requests to the backup download endpoint to access arbitrary files on the server by manipulating file paths. Additionally, the backup creation endpoint fails to sanitize status fields, which could enable data manipulation. The vulnerability affects versions prior to 2.24.3 and requires administrator-level access to exploit.

• CVE-2026-55510MEDIUM 5.5

  ImageMagick, a widely-used open-source image processing library, contains a use-after-free vulnerability triggered when the application processes a specially crafted 8BIM profile embedded in an image file. An attacker can exploit this by distributing a malicious image that, when opened or processed by ImageMagick, causes the application to crash or become unstable. The vulnerability affects versions prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch).

• CVE-2026-55597MEDIUM 5.5

  ImageMagick, widely used for image processing tasks, contains a heap buffer overflow vulnerability in its JP2 (JPEG 2000) encoder. When processing specially crafted image files, the software can write data beyond allocated memory boundaries due to improper argument handling. While the vulnerability requires user interaction—someone must open a malicious image—the outcome is a denial of service. The issue affects ImageMagick versions prior to 7.1.2-26 and has been patched in that release.

• CVE-2026-55628MEDIUM 5.5

  ImageMagick's `-concatenate` operation fails to enforce security policies that restrict file access, allowing users to read and write files outside approved paths. This vulnerability affects ImageMagick versions prior to 7.1.2-26 and requires user interaction to exploit—an attacker would need to trick someone into running a specially crafted ImageMagick command. The issue has been resolved in version 7.1.2-26 and later.

• CVE-2026-55892MEDIUM 5.5

  Vim versions before 9.2.0662 contain a stack buffer overflow vulnerability in the spell-checking module. When a user loads a maliciously crafted spell file (.spl) and dumps the word list, the editor can crash. The vulnerability exists because the code that walks through spell-file data structures doesn't validate how deep it descends before writing to fixed-size memory buffers, allowing an attacker to trigger a crash by crafting a spell file with excessive nesting.

• CVE-2026-56074MEDIUM 5.5

  PraisonAI versions before 1.5.128 have a flaw in how they remember user approval decisions for tool commands. The system caches approval based only on the tool's name, not on what specific arguments or parameters are passed to it. An attacker can trick the system by first getting approval for an innocuous command—like listing a directory—then reuse that cached approval to silently run malicious variations of the same tool, such as exfiltrating API keys or credentials, without prompting the user again. This turns a single benign approval into a gateway for unauthorized data theft.

• CVE-2026-56129MEDIUM 5.5

  A Toshiba and Dynabook Generic IO & Memory Access driver for PCs has a security flaw that allows any non-administrator user who can log into the system to directly access the computer's physical memory. The driver exposes a control interface (IOCTL) without properly restricting who can use it. This bypasses normal Windows privilege boundaries and gives an unprivileged user dangerous low-level hardware access.

• CVE-2026-56288MEDIUM 5.5

  GNU patch, a widely-used utility for applying code changes, contains a flaw that can be triggered by a specially crafted patch file. When the tool processes consecutive newline markers at the end of a file in an unexpected way, it can crash instead of applying the patch. An attacker who can supply a malicious patch file to a user or system running patch could exploit this to disrupt workflow or prevent legitimate patching operations.

• CVE-2026-56289MEDIUM 5.5

  GNU patch, a standard utility for applying source code changes, contains a denial-of-service vulnerability triggered by maliciously crafted patch files. An attacker can supply a patch with an impossibly large line number reference, causing the tool to consume CPU in a near-infinite loop while searching for that line. The application becomes unresponsive and must be killed manually. This affects systems where patch processing is automated or where users apply untrusted patches without oversight.

• CVE-2026-56301MEDIUM 5.5

  Nuxt, a popular Vue.js framework, has a security issue in its development server that exposes sensitive files on Linux systems. When developers run `nuxt dev`, the framework creates an unprotected communication channel that other users on the same machine can access. An attacker with local access to the server can read private files like environment variables and SSH keys. This only affects development environments; production deployments are safe.

• CVE-2026-56692MEDIUM 5.5

  NanoClaw versions before 2.1.17 contain a symlink-following vulnerability that allows malicious container agents to read sensitive files from the host system. When the host processes file attachments, it validates filenames using a safety check but then copies files without verifying whether those filenames point to symlinks. An attacker controlling a container agent can craft a symlink with a seemingly benign name to trick the host into copying and exposing arbitrary files it can access, leading to information disclosure.

• CVE-2026-56693MEDIUM 5.5

  NanoClaw versions before 2.1.17 contain a privilege escalation flaw in how it handles agent creation requests. The vulnerability allows confined agent containers—which are supposed to operate with restricted permissions—to bypass those restrictions and create new agent groups, modify container configurations, and add arbitrary destinations. This happens because the system doesn't properly verify that the requesting container has permission to perform these privileged operations before writing changes to the central database. An attacker with local access and the ability to operate within a confined agent container can exploit this to escape their intended security boundary.

• CVE-2026-57025MEDIUM 5.5

  A flaw in Juniper Networks Junos OS and Junos OS Evolved can crash a layer-2 network service when a low-privileged user runs specific diagnostic commands. The crash is temporary—the service restarts automatically—but causes a brief outage affecting all layer-2 switching and learning functions on EX, QFX, and MX series devices. This is a local attack requiring existing user access, not a remote threat.

• CVE-2026-57452MEDIUM 5.5

  Vim, the widely-used open source text editor, has a vulnerability affecting encrypted files. When Vim tries to open a file encrypted using the VimCrypt~04! or VimCrypt~05! encryption methods (which rely on the xchacha20poly1305 algorithm, only active if Vim was compiled with the +sodium feature), a flaw in how the editor handles very small encrypted files causes it to read far beyond the file's actual contents. This memory read crash affects Vim versions before 9.2.0671 and is remedied in that release.

• CVE-2026-58198MEDIUM 5.5

  ChatterBot versions before 1.2.14 contain a local privilege escalation vulnerability in how it extracts training data. The vulnerability exists because the software creates a predictable directory in a user's home folder and extracts compressed files into it without properly validating the destination. A local attacker who already has access to the system can create a symbolic link at the expected directory location, tricking the software into writing files to any directory they choose on the system. This requires an attacker to already have local access and knowledge of when the extraction will occur, limiting the immediate risk—but it can lead to unauthorized file manipulation within the system.

• CVE-2026-58468MEDIUM 5.5

  NocoBase versions up to 2.1.20 contain a server-side request forgery (SSRF) vulnerability in its serverRequest wrapper. Authenticated administrators can trick the application into making arbitrary outbound HTTP requests by injecting malicious URLs into workflow request nodes, custom request action buttons, or the AI plugin. This allows attackers to probe internal networks, discover hidden hosts, enumerate open ports, and—most critically—retrieve sensitive IAM role credentials from cloud instance metadata endpoints. The vulnerability requires admin-level access to exploit but creates a significant bridge from internal compromise to lateral movement and credential theft.

• CVE-2026-59089MEDIUM 5.5

  GIMP, a widely-used open-source image editor, contains a flaw in its PlayStation TIM image file handler that can crash the application when processing certain malicious image files. The vulnerability stems from incorrect math when the software calculates how much memory to allocate for color data, causing it to misinterpret file contents and ultimately fail. While an attacker cannot steal data or gain system access through this flaw, they can disrupt a user's work by triggering a denial-of-service condition.

• CVE-2026-59857MEDIUM 5.5

  Vim, the widely-used command-line text editor, contains a buffer overflow vulnerability in its spell-checking feature. When Vim processes spell-file rules to suggest corrections for misspelled words, a crafted word of exactly the right length can cause the editor to write one byte past the end of an internal buffer. This corrupts Vim's memory, typically crashing the editor. The vulnerability only affects spell-checking in single-byte (non-Unicode) encodings and requires user interaction—opening a file or triggering spell suggestions on a malicious word. An attacker cannot remotely exploit this or gain code execution; the impact is denial of service through editor crashes.

• CVE-2026-61431MEDIUM 5.5

  PraisonAI versions before 4.6.78 contain a path traversal vulnerability in its context-gathering feature. When processing configuration files (.praisoncontext and .praisoninclude), the application does not properly validate file paths, allowing attackers to read sensitive files outside the intended workspace directory. An attacker who can influence these configuration files can trick the system into including arbitrary file contents in the generated context bundle, potentially exposing credentials, source code, or other sensitive data stored on the same system.

• CVE-2026-8636MEDIUM 5.5

  IBM Datacap and Datacap Navigator versions 9.1.7, 9.1.8, and 9.1.9 contain a memory exposure vulnerability that allows authenticated local users to extract sensitive credentials and encryption keys from the application's memory space. Once extracted, an attacker can use these keys to decrypt stored passwords, gain unauthorized access to the application, and retrieve sensitive data from the backend database. This is a local-privilege attack that requires existing system access but yields high-value credentials.

• CVE-2026-8643MEDIUM 5.5

  pip, the Python package installer, has a path traversal vulnerability that can cause entry point scripts to be installed in unintended locations outside the target installation directory. When a package specifies console or GUI scripts without proper path sanitization, an attacker could craft a malicious package that installs executable scripts to arbitrary filesystem locations—potentially system directories or locations with higher privilege—allowing code execution with the privileges of the installing user.

• CVE-2026-9106MEDIUM 5.5

  GitHub Enterprise Server contained a vulnerability where an OAuth application scope related to runner management was not displayed to users during authorization. This allowed an attacker to trick a user into granting an application access to manage organization runners without the user's informed consent. The vulnerability affected all versions prior to 3.22 and has been patched in multiple maintenance releases across supported version lines.

• CVE-2026-9735MEDIUM 5.5

  MongoDB servers can accidentally write authentication credentials to log files when connection health metric logging is enabled. During SASL authentication, the full authentication parameters—including usernames and passwords—may be recorded without being masked or redacted. An attacker with local access to the server could read these log files and obtain valid credentials, bypassing the need for network-based attacks.

• CVE-2026-9751MEDIUM 5.5

  MongoDB has a logging issue where LDAP passwords are exposed in plain text. When an administrator uses the runtime setParameter command to configure LDAP authentication (specifically the ldapQueryPassword parameter), the new password is written directly to the mongod.log file instead of being masked or encrypted. Any user with local access to the server or log files can read this sensitive credential, defeating password protection. This is a configuration-time mistake rather than a network-exploitable flaw, but it creates a direct path to credential compromise.

• CVE-2018-25384MEDIUM 5.4

  Wikidforum 2.20 has a stored cross-site scripting (XSS) flaw that lets authenticated users inject malicious JavaScript into forum replies. When other users view those compromised posts through the rpc.php endpoint, the injected code executes in their browsers, potentially stealing session cookies, redirecting to phishing pages, or performing unauthorized actions on their behalf.

• CVE-2019-25739MEDIUM 5.4

  GigToDo version 1.3 is vulnerable to a stored cross-site scripting (XSS) attack. An authenticated user can inject malicious JavaScript or HTML code into a proposal description field. When other users—particularly administrators—view that proposal, the attacker's code executes in their browser, potentially stealing session cookies or redirecting them to malicious sites. The vulnerability requires an attacker to already have valid login credentials, but the impact affects anyone who later views the compromised proposal.

• CVE-2019-25742MEDIUM 5.4

  The Zoner Real Estate WordPress theme version 4.1.1 has a stored cross-site scripting (XSS) flaw in its property creation form. Authenticated real estate agents can inject malicious JavaScript into the property's address field, and that script will execute when site administrators review the property for approval. This could allow attackers to steal admin session cookies or hijack their accounts.

• CVE-2019-25743MEDIUM 5.4

  WordPress Soliloquy Lite version 2.5.6 contains a stored cross-site scripting (XSS) vulnerability in its post editing functionality. An authenticated attacker can inject malicious JavaScript code into a post's title field, which persists in the WordPress database. When other users—particularly administrators or editors—preview that post, the injected script executes in their browser, potentially compromising their session or enabling further attacks. The vulnerability requires an attacker to have valid WordPress credentials but does not require tricking users into clicking malicious links, making it a genuine persistence risk in multi-user WordPress environments.

• CVE-2019-25744MEDIUM 5.4

  WordPress Popup Builder version 3.49 contains a stored cross-site scripting (XSS) flaw that allows authenticated users to inject malicious JavaScript into posts or pages. An attacker with WordPress login credentials can craft a specially formatted post title containing script code that breaks out of HTML option tags, causing the malicious script to execute in the browsers of site visitors viewing popup selections. This is a persistence vulnerability—the injected code remains in the database and executes repeatedly.

• CVE-2020-37256MEDIUM 5.4

  Grav, a popular flat-file CMS, contains a cross-site scripting (XSS) flaw in its Admin plugin page editor affecting versions before 1.6.30. An authenticated user with page editing rights can embed malicious scripts into page content. When another user (typically an administrator) views or interacts with that page, the injected script executes in their browser context, potentially allowing the attacker to escalate privileges, modify site content, or install unauthorized plugins that grant deeper system access.

• CVE-2022-42479MEDIUM 5.4

  TemplateHouse Soledad contains a missing authorization check that allows authenticated users to access functionality they should not have permission to use. An attacker with valid login credentials can bypass access controls to perform actions or view information restricted to higher-privilege accounts. The vulnerability affects Soledad versions up to and including 8.2.5.

• CVE-2022-45813MEDIUM 5.4

  BeRocket Advanced AJAX Product Filters versions up to 1.6.3.3 contain a missing authorization flaw that allows authenticated users to perform actions they should not be permitted to access. An attacker with valid login credentials can exploit improperly configured access controls to read or modify data they don't own, though without disrupting service availability. This is a privilege escalation issue affecting WooCommerce sites using this plugin.

• CVE-2023-25969MEDIUM 5.4

  A security flaw in ThemeHunk Contact Form & Lead Form Elementor Builder versions up to 1.8.4 fails to properly verify user permissions before allowing certain actions. This means an unauthenticated attacker could potentially manipulate form data or disrupt form functionality by exploiting weak access controls. The vulnerability requires user interaction (such as clicking a malicious link) to be triggered, limiting but not eliminating the risk.

• CVE-2024-30476MEDIUM 5.4

  PowerStore Manager contains a vulnerability that allows authenticated users with low-level permissions to inject malicious scripts into the application. When other users access affected areas, their browsers execute these scripts, potentially allowing the attacker to steal sessions, modify data, or perform actions on their behalf. The attack requires an authenticated account and user interaction to succeed.

• CVE-2025-15546MEDIUM 5.4

  The Iptanus File Upload WordPress plugin versions before 5.1.7 contain a race condition vulnerability that allows authenticated users to overwrite files uploaded by other users when the "maintain both" duplicate file policy is enabled. An attacker must be logged in and the victim must actively upload a file at nearly the same moment the attacker attempts their action, making exploitation difficult but possible in environments with concurrent file uploads.

• CVE-2025-33128MEDIUM 5.4

  IBM Engineering Workflow Management contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript into the Web UI. An attacker with valid credentials could craft a payload that executes in the browser of other users viewing the same application, potentially stealing session credentials or performing unauthorized actions on their behalf. The vulnerability requires user interaction (a victim must view the attacker's injected content) but spreads through a trusted application interface, making it a meaningful risk in collaborative engineering environments.

• CVE-2025-36323MEDIUM 5.4

  IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript into the Web UI. An attacker with valid credentials could craft a payload that executes in the browser of other users viewing the application, potentially stealing session credentials or manipulating application behavior within that trusted session. This requires user interaction—the victim must click a malicious link or visit a compromised page—but operates within the security perimeter of an already-authenticated application.

• CVE-2025-53648MEDIUM 5.4

  A SQL misconfiguration in Apache Gravitino's web interface allows authenticated users to read or delete files on the server. This vulnerability exists in version 1.0.0 and earlier. While an attacker must have valid login credentials, the impact is significant—they can extract sensitive data or destroy critical files without elevated permissions.

• CVE-2025-62198MEDIUM 5.4

  Apache Atlas, a metadata governance platform, contains a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. An attacker with valid credentials can craft requests that execute arbitrary JavaScript in the browsers of other users who interact with the application. This is a browser-based attack that relies on user interaction to succeed; the attacker cannot directly access or modify data on the server, but can steal session tokens, deface content, or redirect users to malicious sites.

• CVE-2025-63041MEDIUM 5.4

  A broken access control vulnerability in the Forget About Shortcode Buttons WordPress plugin (versions 2.1.3 and earlier) allows authenticated users with the contributor role to perform unauthorized actions they should not have permission to execute. This weakness stems from insufficient permission checks on certain functions, enabling contributors to modify or delete content beyond their intended scope.

• CVE-2026-10213MEDIUM 5.4

  AstrBot version 4.23.6 contains a path traversal vulnerability in its API endpoint that handles skill deletion. An authenticated attacker can manipulate the Name parameter to traverse the file system and read or modify files outside the intended directory structure. The vulnerability is network-accessible and does not require user interaction beyond the attacker having valid credentials. Public exploit code is available, increasing the risk of active exploitation.

• CVE-2026-10218MEDIUM 5.4

  A security flaw exists in nextlevelbuilder GoClaw versions up to 3.11.3 that allows authenticated users to perform actions they shouldn't be authorized to perform. The vulnerability resides in the authentication logic of the application and can be exploited remotely by someone with valid login credentials. Because the flaw has been publicly disclosed, there's elevated risk that attackers may attempt to exploit it.

• CVE-2026-10284MEDIUM 5.4

  A security flaw in DevaslanPHP project-management versions up to 2.0.0-beta1 allows authenticated users to bypass authorization controls when editing or deleting comments in ticket management workflows. An attacker with login credentials can manipulate comment-related functions to perform actions they shouldn't be authorized to perform, such as deleting or modifying comments belonging to other users. The issue resides in the Livewire handler component and can be exploited remotely without requiring additional user interaction.

• CVE-2026-10285MEDIUM 5.4

  DevaslanPHP project-management versions up to 2.0.0-beta1 contain an authorization flaw in the ticket handler component. An authenticated user can manipulate ticket records in ways they should not be permitted to perform, potentially modifying or deleting ticket data without proper access controls. The vulnerability requires an existing login but can be exploited remotely over the network.

• CVE-2026-10531MEDIUM 5.4

  A stored cross-site scripting (XSS) vulnerability exists in the AI Share & Summarize WordPress plugin versions before 2.0.4. The plugin fails to properly sanitize and escape certain shortcode attributes before displaying them on pages. This allows users with Contributor role or higher permissions to inject malicious scripts that persist in the database and execute when other users view the affected pages. The vulnerability requires an authenticated attacker with at least Contributor-level access, limiting the immediate risk to multi-user WordPress installations where internal users pose a threat.

• CVE-2026-10585MEDIUM 5.4

  A vulnerability in GitHub Enterprise Server allows an authenticated user to inject malicious code into discussion titles that executes in other users' browsers. The flaw stems from improper handling of user input in Q&A discussions—specifically, the system failed to sanitize discussion titles before embedding them in structured data markup, creating an opening for attackers to break out of that context and run arbitrary JavaScript. An attacker would need valid credentials and would need to trick another user into viewing the malicious discussion, but the payload could then access that victim's session or sensitive information.

• CVE-2026-10601MEDIUM 5.4

  A vulnerability in Grafana's Tempo and Loki data source plugins allows users with basic Viewer permissions to bypass intended access controls and reach backend endpoints they shouldn't be able to access. By crafting specially designed requests, an authenticated attacker can potentially steal database credentials, extract sensitive internal information, or execute administrative commands on the connected backend system. While the attack requires valid user credentials, the low barrier to entry (Viewer level is a basic permission tier) and the potential exposure of sensitive infrastructure credentials make this a meaningful risk for most organizations.

• CVE-2026-10850MEDIUM 5.4

  Plane CE version 1.3.1 contains a stored cross-site scripting (XSS) vulnerability in its API. A user with low-level project membership can inject malicious HTML and JavaScript code into the description field when creating intake work items through the REST API. This code is then stored and executed in the browsers of other users who view that work item, potentially allowing attackers to steal session tokens, redirect users to phishing sites, or perform actions on behalf of victims.

• CVE-2026-10984MEDIUM 5.4

  Google Chrome on Android contains a flaw in how it handles accessibility features that allows attackers to trick users with a fake interface. By hosting a malicious webpage, an attacker can make Chrome display misleading or fraudulent content that mimics legitimate UI elements, potentially deceiving users into performing unintended actions. The vulnerability requires user interaction—specifically, a user must visit the crafted page—but does not require special privileges or complex setup.

• CVE-2026-11157MEDIUM 5.4

  A script injection vulnerability in Google Chrome's accessibility features allows attackers to inject arbitrary scripts and HTML into web pages if a user installs a malicious extension. The vulnerability, tracked as CVE-2026-11157, requires user interaction (installing an extension) to exploit, making it a social engineering vector rather than a network-based attack. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-11232MEDIUM 5.4

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the TabGroups feature handles network input, allowing attackers to deceive users through fake or misleading visual elements in the browser interface. An attacker would need to trick a user into visiting a malicious website or intercepting network traffic, but the actual attack surface is relatively narrow—the vulnerability requires user interaction and does not enable data theft or system crashes on its own.

• CVE-2026-11243MEDIUM 5.4

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles downloads that allows an attacker to bypass navigation restrictions by serving a specially crafted web page. When a user visits the malicious page, the browser's normal safeguards that prevent unwanted navigation can be circumvented, potentially allowing redirection to unintended destinations or other restricted actions. The vulnerability requires user interaction (clicking or visiting a page) and affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11372MEDIUM 5.4

  IBM TRIRIGA Application Platform versions 5.0.2 and 5.0.3 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript into the web interface. An attacker with valid credentials can manipulate the application's behavior and potentially steal session credentials from other users. This requires an existing account but does not need user interaction to execute once injected.

• CVE-2026-11466MEDIUM 5.4

  Zilliz's deep-searcher library contains an access control vulnerability in its collection routing logic. An authenticated attacker can manipulate function arguments to bypass intended restrictions, gaining unauthorized read access to data or causing service disruption. The issue affects versions up to 0.0.2, and exploit code is now publicly available, raising the risk of opportunistic attacks.

• CVE-2026-11467MEDIUM 5.4

  A path traversal vulnerability exists in jishenghua jshERP versions up to 3.6. An authenticated attacker can manipulate the fileName parameter in the addAccountHeadAndDetail endpoint to write or access files outside the intended directory. Because the vulnerability requires valid credentials to exploit, the immediate risk is constrained to insider threats or compromised accounts. However, the public disclosure of the issue increases the likelihood of exploitation attempts.

• CVE-2026-11533MEDIUM 5.4

  A vulnerability in the imvks786 student_management_system allows an authenticated user to bypass authorization controls on the student deletion function. By manipulating a parameter called 'del' in the /see.php endpoint, an attacker with login credentials can perform unauthorized deletions of student records. The vulnerability requires valid authentication but does not need special privileges, meaning any logged-in user—including those with limited access—could exploit it. Public disclosure has occurred, increasing the likelihood of active exploitation.

• CVE-2026-11569MEDIUM 5.4

  Quay, a container image registry platform, contains a vulnerability in its file upload endpoint that fails to properly validate file types. An authenticated user with write access to a repository can exploit this to upload a malicious SVG file containing embedded JavaScript code. Because the file is stored and then served inline by the CDN without proper content-type restrictions, any user visiting the archive URL will have that JavaScript execute in their browser—a stored cross-site scripting attack. The vulnerability requires an attacker to already have repository write permissions and the victim to click a link, which limits but does not eliminate risk in collaborative development environments.

• CVE-2026-11666MEDIUM 5.4

  Google Chrome versions prior to 149.0.7827.103 contain a flaw where the browser fails to properly validate user-supplied input in certain UI elements. An attacker can exploit this by crafting a malicious HTML page that, when visited, displays fake browser UI components or dialogs—a technique known as UI spoofing. This could trick users into believing they're interacting with legitimate Chrome interface elements, potentially leading to credential theft, social engineering attacks, or other user-directed compromise. The vulnerability requires user interaction (visiting the crafted page) but no special privileges, making it a concern for general web browsing.

• CVE-2026-11701MEDIUM 5.4

  Google Chrome versions before 149.0.7827.103 contain a flaw in how the Guest View feature handles crafted HTML pages, allowing attackers to trick users with fake or misleading interface elements. An attacker would need to host a malicious webpage and convince a user to visit it while Chrome's Guest View is active. The vulnerability does not allow data theft or system compromise on its own, but the spoofed interface could be used to deceive users into taking actions they wouldn't otherwise take.

• CVE-2026-11778MEDIUM 5.4

  A WordPress plugin called CURCY – Multi Currency for WooCommerce has a security flaw that allows attackers to execute WordPress shortcodes without proper authorization. Shortcodes are a WordPress feature that lets users insert dynamic content into pages and posts; in the wrong hands, they can be abused to inject malicious content or trigger unintended actions. The vulnerability affects all versions up to 2.2.14 and exploits a gap in input validation that fails to sanitize user-supplied data before processing shortcodes.

• CVE-2026-11818MEDIUM 5.4

  WPCafe, a popular WordPress plugin for restaurant management, contains a flaw that allows low-privilege users to perform actions restricted to administrators. Specifically, any logged-in user with subscriber access or higher can create, modify, or delete automated notification workflows—a capability meant only for site administrators. The vulnerability exists because the plugin relies on a single check (a REST API nonce) that is publicly visible in the webpage source, making it trivial for any authenticated user to bypass intended restrictions.

• CVE-2026-12084MEDIUM 5.4

  IBM DevOps Deploy (UCD) contains a Cross-Origin Resource Sharing (CORS) misconfiguration that allows attackers to trick authenticated users into performing unauthorized actions or exposing sensitive data. The vulnerability affects versions 8.1 through 8.1.2.6 and 8.2 through 8.2.1.0. Because CORS policies are not properly restricting trusted domains, an attacker can host a malicious webpage that, when visited by a logged-in DevOps Deploy user, silently executes privileged operations or exfiltrates information in the user's security context.

• CVE-2026-12298MEDIUM 5.4

  A memory safety vulnerability was discovered in Mozilla Firefox and Thunderbird that allows an attacker to read or modify memory during user interaction with a malicious website or email. The flaw does not enable remote code execution or denial of service, but could leak sensitive information or corrupt application state. Mozilla has released patched versions to address this issue.

• CVE-2026-12299MEDIUM 5.4

  A flaw in Firefox and Thunderbird's just-in-time (JIT) compiler causes incorrect code generation when processing web page structures (DOM). An attacker can craft a malicious webpage that, when visited, exploits this miscompilation to read small amounts of data or alter page content in the user's browser session. The vulnerability requires user interaction—specifically, visiting a compromised or attacker-controlled site—but does not allow the attacker to execute arbitrary code or crash the application.

• CVE-2026-12321MEDIUM 5.4

  A flaw in Firefox and Thunderbird's JavaScript-to-WebAssembly compiler causes it to generate incorrect machine code in certain scenarios. An attacker could exploit this by serving a malicious webpage or email with crafted script, potentially allowing them to read sensitive data or modify page content. The vulnerability requires user interaction (visiting a site or opening an email) and does not enable system crashes or privilege escalation.

• CVE-2026-12322MEDIUM 5.4

  A clickjacking vulnerability exists in the Gtk widget component used by Firefox and Thunderbird. An attacker could craft a malicious webpage that tricks users into clicking on hidden UI elements, potentially allowing unauthorized actions such as modifying settings or accessing sensitive information. The vulnerability requires user interaction—a click on a deceptive overlay—but no special privileges. It affects both confidentiality and availability of the application.

• CVE-2026-12323MEDIUM 5.4

  A spoofing vulnerability exists in Firefox and Thunderbird's DOM (Document Object Model) and HTML processing component. An attacker could potentially deceive users about the true origin or content of a webpage or email through DOM manipulation. The issue requires user interaction to trigger and affects confidentiality and availability rather than integrity. Mozilla fixed this in Firefox 152 and Thunderbird 152.

• CVE-2026-12330MEDIUM 5.4

  A boundary condition error in Mozilla Firefox and Thunderbird's internationalization component can allow an attacker to read small amounts of user data or modify content on a webpage, provided the user interacts with a malicious site. The vulnerability requires user action (clicking, submitting forms) to trigger, and does not enable system-level compromise or denial of service. Mozilla has released security updates across multiple Firefox ESR branches and Thunderbird to address this flaw.

• CVE-2026-12528MEDIUM 5.4

  A bug in 389 Directory Server's ACI (Access Control Instruction) parsing can allow an authenticated user to corrupt memory on the server. When a specially crafted ACI string is processed, the parser fails to properly validate keyword length after removing whitespace, causing it to write one byte beyond allocated heap memory and then read from invalid locations. An attacker with write permissions to the aci attribute could exploit this to silently damage the server's memory state, potentially leading to service degradation or unexpected behavior.

• CVE-2026-12580MEDIUM 5.4

  EasyFlow .NET, a Digiwin product, contains a vulnerability that lets authenticated users inject malicious JavaScript code into web pages. When other users visit those pages, the injected code runs automatically in their browsers, potentially compromising their sessions, stealing sensitive data, or redirecting them to malicious sites. This is a stored attack—the malicious code persists on the server and affects anyone who views the affected content.

• CVE-2026-12619MEDIUM 5.4

  Microchip GridTime 3000 contains a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into web pages. When another user views the affected page, the injected script executes in their browser within the GridTime 3000 application context, potentially compromising their session, stealing credentials, or performing unauthorized actions on their behalf. The vulnerability requires an authenticated attacker and user interaction (a victim must click a link or visit a crafted page), but can affect users across different security boundaries.

• CVE-2026-12621MEDIUM 5.4

  A cross-site scripting (XSS) vulnerability exists in the password reset form of GridTime 3000. An attacker with valid login credentials can inject malicious JavaScript code that executes in the browser of other users viewing the form, potentially stealing session cookies, credentials, or triggering unauthorized actions. The vulnerability affects versions 1.0r0.03 through 1.1.x, with the fix available in version 1.2r0.0 and later.

• CVE-2026-12622MEDIUM 5.4

  GridTime 3000 GNSS Time Servers contain an open redirect flaw in their password change functionality. When an authenticated user submits a password change request, the application can be tricked into redirecting them to an attacker-controlled website. An attacker would need valid credentials or the ability to socially engineer a legitimate user into clicking a malicious link that contains the redirect target. While the attacker cannot directly steal data or crash the system through this flaw, they can use it to harvest credentials, distribute malware, or conduct phishing attacks by making the redirect destination appear trustworthy.

• CVE-2026-12770MEDIUM 5.4

  A security flaw was found in BerriAI's litellm, an open-source library for managing large language model API calls, affecting versions up to 1.63.1. The vulnerability resides in the admin key management system and allows authenticated users to perform actions they shouldn't be authorized to perform. An attacker who already has some level of access to the system could exploit this to modify or disrupt operations. The flaw has been publicly disclosed and patches are available.

• CVE-2026-13426MEDIUM 5.4

  Mattermost's Go module contains a path traversal vulnerability in API route construction that allows authenticated attackers to redirect API calls to unintended endpoints. An attacker with valid credentials can craft malicious IDs containing path traversal sequences to bypass intended routing logic, potentially accessing or modifying data they shouldn't have access to. The vulnerability affects versions of the mattermost/server/public module prior to v0.1.22.

• CVE-2026-13549MEDIUM 5.4

  CodeAstro Complaint Management System version 1.0 contains an authorization bypass vulnerability in its Report deletion functionality. An attacker can remotely trigger improper access controls in the deletereport function, allowing unauthorized deletion or modification of report data. The vulnerability requires user interaction (such as tricking an administrator into clicking a malicious link) but does not require authentication. Public exploit code is available, increasing the risk of opportunistic attacks.

• CVE-2026-13977MEDIUM 5.4

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser parses HTML that allows attackers to inject malicious scripts or HTML content into web pages. An attacker can craft a specially designed webpage that, when visited, injects arbitrary code into the page—potentially stealing data, capturing user credentials, or performing actions on the user's behalf. The vulnerability requires user interaction (visiting the malicious page) but does not require special browser permissions or system access.

• CVE-2026-14131MEDIUM 5.4

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in the WebAppInstalls feature that fails to properly validate user-supplied input. An attacker who has already compromised the renderer process—the sandboxed component responsible for displaying web content—could exploit this to deceive users through visual spoofing attacks. The attacker could craft a deceptive HTML page that mimics legitimate Chrome UI elements, potentially tricking users into performing unintended actions. This is a post-compromise attack; the initial renderer compromise is the critical prerequisite.

• CVE-2026-14132MEDIUM 5.4

  A flaw in Google Chrome's WebXR (extended reality) implementation allows attackers to trick users by displaying fake UI elements on web pages. An attacker crafting a malicious HTML page can exploit this to make users believe they're interacting with legitimate interface elements when they're actually interacting with attacker-controlled content. This requires user interaction and doesn't affect data confidentiality or system availability, but can be used for phishing or social engineering attacks.

• CVE-2026-14135MEDIUM 5.4

  Google Chrome versions prior to 150.0.7871.47 contain a vulnerability that allows an attacker who has already compromised Chrome's renderer process to trick users into seeing fake interface elements or UI components. The attacker would deliver a malicious HTML page that exploits insufficient input validation in the Network component, creating a spoofing condition. While the underlying severity is rated Low by Chromium, the CVSS score reflects moderate concern due to user interaction requirements and the need for prior renderer compromise.

• CVE-2026-14142MEDIUM 5.4

  A flaw in how Google Chrome handles extensions could allow an attacker who has already compromised your browser's rendering engine to trick you into clicking malicious UI elements by disguising them as legitimate browser controls. The attacker would need to first gain control of the renderer process—typically through a separate vulnerability or compromise—then exploit this weakness to display fake dialogs or buttons that appear to come from Chrome itself. This is a secondary attack that depends on prior compromise.

• CVE-2026-14150MEDIUM 5.4

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the Speech feature validates user input. An attacker who has already gained control of Chrome's renderer process—the component that displays web pages—can exploit this to trick users into thinking they're interacting with legitimate browser UI when they're actually seeing forged content. This is a UI spoofing attack that requires the attacker to have compromised the renderer first, limiting the immediate threat but still worth addressing through timely patching.

• CVE-2026-14614MEDIUM 5.4

  Keycloak administrators with limited permissions can bypass access controls to modify hidden client scopes—settings that control what data and permissions get added to security tokens. By exploiting this flaw, a restricted admin could inject unauthorized permissions into tokens issued to end-users, potentially granting other applications unintended access. This affects Keycloak installations using the Fine-Grained Admin Permissions v2 feature.

• CVE-2026-14636MEDIUM 5.4

  A path traversal vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap project's vendor image upload feature. When authenticated users upload images through the Vendor Image Manager, an attacker can manipulate the folder parameter to access or write files outside the intended upload directory. The flaw is remotely exploitable by any logged-in user and requires no special interaction. This is a medium-severity issue affecting file integrity and confidentiality for systems using the vulnerable codebase.

• CVE-2026-14693MEDIUM 5.4

  A vulnerability exists in SourceCodester Multi-Vendor Online Grocery Management System version 1.0 that allows authenticated users to perform unauthorized actions through the order cancellation feature. An attacker with valid login credentials can manipulate the cancel_order function to bypass authorization checks, potentially modifying or disrupting orders that should not be under their control. The vulnerability requires authentication but poses a real risk in multi-tenant or shared-credential environments. An exploit is publicly available.

• CVE-2026-15320MEDIUM 5.4

  Sipeed PicoClaw versions up to 0.2.9 contain a flaw in how it handles configuration reload requests. An authenticated user can manipulate a message parameter to bypass authorization checks, allowing them to modify system behavior or deny service to others. The vulnerability requires an existing login but no special privileges, and exploitation can occur over the network. Public exploit code is available.

• CVE-2026-15331MEDIUM 5.4

  CowAgent, a framework used for building AI agent skills, contains a path traversal vulnerability in its Skill Installation Handler. An authenticated attacker can manipulate the 'Name' parameter during skill installation to write files to unintended locations on the system, potentially corrupting data or disrupting service availability. The vulnerability affects versions up to 2.1.0 and is resolved in version 2.1.2.

• CVE-2026-24754MEDIUM 5.4

  Kiteworks, a private data network platform used for secure file sharing and collaboration, contains a stored cross-site scripting (XSS) vulnerability in its Secure Data Forms feature. An authenticated user with legitimate access could craft malicious input that persists in the application and executes in other users' browsers when they view the affected form. This allows the attacker to steal session tokens, perform actions on behalf of victims, or harvest sensitive data passing through their sessions. The vulnerability requires prior authentication and user interaction (clicking a link or viewing a page), limiting but not eliminating its risk. Kiteworks versions before 9.3.0 are affected; upgrading resolves the issue.

• CVE-2026-24755MEDIUM 5.4

  Kiteworks, a platform for secure data sharing and management, contains a flaw in its Secure Data Forms feature that allows logged-in users to change permissions on files and folders belonging to other users. The vulnerability stems from the system not properly verifying whether a user actually owns or has authority over a resource before allowing permission changes. An attacker with valid credentials could exploit this to gain access to, or revoke access from, other users' sensitive data without authorization.

• CVE-2026-25557MEDIUM 5.4

  Evoluted PHP Directory Listing Script versions up to 4.0.5 contain a reflected cross-site scripting (XSS) vulnerability in the directory parameter handling. When a user visits a specially crafted malicious link, JavaScript code embedded in the directory path gets executed in their browser, potentially allowing attackers to steal session cookies, redirect users to phishing sites, or perform actions on their behalf. The vulnerability requires user interaction—victims must click a malicious link—but no special privileges are needed to exploit it.

• CVE-2026-26378MEDIUM 5.4

  Koha, an open-source library management system, contains a cross-site scripting (XSS) vulnerability in its Invoice feature file upload functionality. An authenticated attacker can craft a malicious file upload that executes arbitrary code in the browsers of users who interact with the uploaded invoice. The vulnerability affects Koha version 25.11 and earlier. Exploitation requires an attacker to have valid library system credentials and user interaction—typically a staff member viewing or processing the invoice.

• CVE-2026-27351MEDIUM 5.4

  Sekander Badsha Crew HRM contains a missing authorization vulnerability that allows authenticated users to perform actions they should not be permitted to perform due to incorrectly configured access controls. An attacker with valid login credentials can exploit weak permission checks to modify data or disrupt availability, even if their role should restrict such access.

• CVE-2026-29509MEDIUM 5.4

  Patool, a popular archive extraction utility, contains a flaw in how it validates whether extracted files stay within their intended directory. An attacker can craft a malicious archive with specially named files that trick the validation check and write files anywhere on the system. The vulnerability only affects systems running Python versions before 3.12. While the immediate impact is limited by the need for user interaction (the user must extract the archive), this is a classic arbitrary file write scenario that could lead to code execution or system compromise depending on file placement and permissions.

• CVE-2026-33113MEDIUM 5.4

  Microsoft Office SharePoint contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. When a user visits a compromised SharePoint page, the injected code executes in their browser, potentially allowing the attacker to steal session tokens, redirect users to phishing sites, or perform actions on behalf of the victim. This is a reflected or stored XSS flaw—the vulnerability itself requires user interaction to trigger, but the impact can be significant for organizations relying on SharePoint for document collaboration and intranet services.

• CVE-2026-33244MEDIUM 5.4

  React Router versions 7.5.1 through 7.13.1 contain a cross-site scripting (XSS) vulnerability when used in Framework Mode with pre-rendering. If your application redirects users to untrusted URLs and generates static HTML files during build time, attackers can inject malicious scripts into those pre-rendered pages. This vulnerability does not affect applications using the more common Declarative Mode or Data Mode routing approaches. The issue has been fixed in version 7.13.2.

• CVE-2026-3341MEDIUM 5.4

  IBM Langflow Desktop versions 1.0.0 through 1.9.2 contain a server-side request forgery (SSRF) vulnerability that allows authenticated users to make unauthorized network requests from the affected system. An attacker with valid credentials could exploit this to map internal networks, access restricted services, or set up for secondary attacks. The vulnerability requires authentication, which reduces—but does not eliminate—the risk in environments where account compromise is possible.

• CVE-2026-34033MEDIUM 5.4

  Apache Answer contains a cross-site scripting (XSS) vulnerability in its notification email system. When authenticated users include content in certain fields, that content reaches other users' inboxes without proper HTML escaping, potentially allowing injection of malicious scripts. An attacker with valid credentials could craft messages designed to execute code when recipients open their emails or click embedded links. This affects Apache Answer versions through 2.0.0.

• CVE-2026-34460MEDIUM 5.4

  NamelessMC, a website platform for Minecraft servers, contains a vulnerability in how it handles OAuth authentication callbacks. When a user logs in via OAuth (a third-party authentication method), the application fails to verify a security token called a 'state parameter' before accepting the login. An attacker can exploit this by crafting a malicious link that tricks a victim into logging in with the attacker's own account credentials. Once clicked, the victim's session becomes authenticated as the attacker, potentially granting unauthorized access to the victim's account on that NamelessMC instance. The vulnerability affects NamelessMC versions 2.2.4 and earlier.

• CVE-2026-34507MEDIUM 5.4

  OpenClaw versions before 2026.4.29 contain a flaw that allows authenticated users to bypass security policies protecting sensitive admin commands. Specifically, attackers can circumvent message delivery restrictions (DM-only policy) and sender authorization checks (allowFrom policy), enabling them to execute administrative functions from contexts or senders that should be blocked. The vulnerability requires an attacker to already have authentication credentials, limiting its blast radius but creating insider risk and account compromise scenarios.

• CVE-2026-34692MEDIUM 5.4

  Adobe Experience Manager contains a cross-site scripting (XSS) flaw that allows attackers to inject and execute malicious JavaScript in a user's browser. The attack requires tricking a victim into visiting a specially crafted webpage while authenticated to AEM. Once executed, the attacker can steal session data, modify page content, or perform actions on behalf of the victim within the AEM interface.