2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 30 of 41

• CVE-2026-54665MEDIUM 5.3

  Apache NiFi versions up to 2.9.0 fail to validate certain HTTP headers that web proxies use to communicate the client's original hostname. An attacker can send specially crafted headers to trick NiFi into generating incorrect URLs for redirects or embedding in responses, potentially directing users to malicious sites or exposing data references. This is a header-injection vulnerability that affects the application's URL-building logic. The fix is available in NiFi 2.10.0, which adds validation for these proxy headers.

• CVE-2026-54712MEDIUM 5.3

  OpenTelemetry Java Instrumentation versions before 2.27.0 contain a denial-of-service vulnerability in the RMI context propagation handler. An attacker with network access to an exposed RMI endpoint can send specially crafted payloads that bypass size limits on individual context strings, forcing the instrumented JVM to allocate excessive memory. This can degrade or crash the application. The vulnerability only affects deployments where RMI instrumentation is explicitly enabled and the RMI endpoint is network-accessible.

• CVE-2026-55205MEDIUM 5.3

  Hermes WebUI versions before 0.51.468 contain a flaw in an unauthenticated login-flow endpoint that fails to limit how many simultaneous requests it processes. An attacker can repeatedly hit this endpoint to flood the server with memory-consuming state objects and worker threads, eventually exhausting available resources and causing the service to become slow or unresponsive. The endpoint also triggers outbound device-code requests to upstream OAuth providers, so repeated exploitation can trigger cascading load on those services as well.

• CVE-2026-55594MEDIUM 5.3

  ImageMagick, a widely-used open-source image processing toolkit, contains a stack overflow vulnerability in its MVG (Magick Vector Graphics) decoder. When processing a specially crafted image file, the decoder fails to validate recursion depth, allowing the stack to overflow and crash the application. An attacker can exploit this by sending a malicious image to any system running a vulnerable version of ImageMagick, causing a denial of service. The vulnerability affects versions prior to 6.9.13-51 (stable branch) and 7.1.2-26 (development branch).

• CVE-2026-55605MEDIUM 5.3

  DeepSeek MCP Server, a tool for integrating DeepSeek V4 AI capabilities, had a critical flaw in its self-hosted HTTP configuration: the main API endpoint accepted requests without any authentication. This meant anyone with network access to a running instance could interact with it as if they were an authorized user. They could initialize sessions, list available tools, and invoke local functions—including one that exposes session data and another that uses the server's own API credentials to make DeepSeek API calls. The issue affected versions 1.4.2 through 1.7.x, and self-hosted deployments using the default container configuration were particularly exposed since HTTP mode and port 3000 are enabled by default.

• CVE-2026-55686MEDIUM 5.3

  Podman, a widely-used container management tool, contains a symlink-handling vulnerability that allows a malicious container image to create directories or modify file ownership on the host system. The flaw exists in versions 3.0.0 through 5.7.0 and has been patched in version 5.7.1. An attacker would need to craft a container with a symlink in the WORKDIR path; modifying ownership requires additional coordination with a compromised host process during a race condition window, making that outcome less probable but still possible.

• CVE-2026-55726MEDIUM 5.3

  Gardyn's Azure Blob Storage container holding device logs is misconfigured to allow public listing without authentication. An attacker can browse and download any device log file stored in this container, potentially exposing sensitive operational and diagnostic information from connected devices.

• CVE-2026-55964MEDIUM 5.3

  wolfSSL's certificate verification code accepted intermediate CA certificates that claimed to be signing authorities (CA:TRUE) without properly checking that they possessed the required signing capability (keyCertSign). This loophole applied specifically to temporary CAs injected during certificate chain building in OpenSSL-compatible mode, not to user-loaded root certificates. An attacker could potentially use a malformed intermediate certificate in a chain to bypass security checks and gain unauthorized signing privileges, though actual exploitation depends on how applications use the verified certificate chain.

• CVE-2026-56021MEDIUM 5.3

  Webmin contains a flaw that allows anyone on the network to read sensitive configuration files without logging in. The vulnerability bypasses a validation filter that's supposed to block access to .conf files in module directories. An attacker can exploit this to extract configuration data that may contain credentials, API keys, or other sensitive information. This is a straightforward information disclosure issue with moderate severity.

• CVE-2026-56022MEDIUM 5.3

  Webmin contains an authentication bypass vulnerability that allows attackers to skip multi-factor authentication (MFA) requirements by sending a specially crafted HTTP header. An attacker can log in using basic credentials without providing session cookies, provided they include 'User-Agent: webmin' in their request. This undermines the security controls that organizations rely on to protect administrative access. The issue affects Webmin versions prior to 2.641.

• CVE-2026-56099MEDIUM 5.3

  OpenBSD systems running versions before commit 6a23123 (released 2026-06-18) are vulnerable to a memory disclosure flaw in their MPLS networking stack. An attacker on the network can send specially crafted MPLS frames to trigger an out-of-bounds read, potentially leaking sensitive data from the kernel's memory. This is a remote attack requiring no authentication or user interaction, but the impact is limited to information disclosure—no system compromise or denial of service.

• CVE-2026-56113MEDIUM 5.3

  dhcpcd, a widely-used DHCP client daemon, contains a memory safety bug that can be triggered by a malicious DHCPv6 server on the same network. An attacker who can send a specially crafted DHCPv6 renewal message can cause dhcpcd to crash. The vulnerability exists in how dhcpcd manages IPv6 address delegation—specifically when an attacker sets both lifetime values to zero in a prefix delegation exclusion option. Versions through 10.3.2 are affected; the fix is available in commit 5733d3c and later releases.

• CVE-2026-56114MEDIUM 5.3

  dhcpcd, a widely-used DHCP client for Unix-like systems, contains a stack memory vulnerability that can be triggered by an attacker on the same network segment. An attacker can send a specially crafted DHCPv6 advertisement message that causes dhcpcd to write one byte past the boundary of an internal buffer. While this is a limited write (one byte), it occurs on the stack and can corrupt adjacent memory structures, potentially leading to a denial of service. The vulnerability affects dhcpcd versions up to 10.3.2 and has been fixed in a subsequent commit.

• CVE-2026-56139MEDIUM 5.3

  Apache Camel's Undertow HTTP component has a configuration flaw that causes it to leak sensitive information through error messages. When a client sends a request that triggers an exception, the server returns the full Java stack trace to the requester instead of a generic error response. This happens because the component defaults to exposing exceptions (muteException=false), contrary to other Camel HTTP components. An attacker who can reach an affected endpoint and cause any processing error—such as sending malformed data or invalid parameters—receives detailed internal information including credentials, hostnames, file paths, database names, and application architecture details. The flaw is particularly dangerous in Rest DSL deployments, where the mitigation option is completely ignored even if configured.

• CVE-2026-56152MEDIUM 5.3

  Elastic Defend contains an authorization flaw that allows low-privileged authenticated users to view response action data they should not have access to. The vulnerability exploits a gap in access control enforcement, enabling information disclosure under specific conditions. An attacker would need valid credentials and network access to the affected system, but the barrier to exploitation is moderately high due to the required conditions.

• CVE-2026-56213MEDIUM 5.3

  Capgo, a mobile app update and deployment platform, has a security flaw where an unauthenticated attacker can modify application version metadata through a publicly accessible API endpoint. By sending requests with basic authentication credentials, an attacker can insert fake data into any application's version records, corrupting the metrics and statistics that operators rely on for monitoring. This poisoning attack doesn't steal data or crash systems, but it pollutes the information dashboards display, potentially triggering false alarms and undermining confidence in application health metrics.

• CVE-2026-56218MEDIUM 5.3

  Capgo versions before 12.128.2 do not remove sensitive location data embedded in images that users upload to the platform. When someone uploads a photo taken with a smartphone or modern camera, that device typically records GPS coordinates, timestamps, and other metadata in the image file itself. Capgo fails to strip this data before storing or serving the image, meaning anyone who downloads an uploaded image can extract the precise latitude and longitude showing exactly where and when the photo was taken. This allows attackers to discover where users were physically located at specific moments, posing a privacy and safety risk.

• CVE-2026-56234MEDIUM 5.3

  Capgo versions before 12.128.2 have a flaw in their password validation endpoint that allows anyone on the internet to check user passwords without needing to log in. The endpoint is misconfigured to accept requests from any website and has no protection against repeated attempts, making it straightforward for attackers to systematically try common passwords or stolen credential lists against user accounts. This credential stuffing vulnerability can lead to unauthorized account access.

• CVE-2026-56235MEDIUM 5.3

  Cap-go capgo versions before 12.128.2 expose a flaw where three database query functions (get_app_metrics, get_global_metrics, get_total_metrics) can be called by anyone without authentication. An attacker only needs Cap-go's public API key to request usage data for any organization, including ones they don't belong to. This allows leaking how many users each org has, bandwidth consumption, app installation counts, and which apps belong to a target organization. Additionally, an attacker can determine whether a specific organization exists in the system.

• CVE-2026-56282MEDIUM 5.3

  Capgo versions before 12.128.2 expose sensitive database replication information through an unauthenticated endpoint. An attacker can access the /replication endpoint without logging in to retrieve PostgreSQL replication slot names, write-ahead log (WAL) positions, and other infrastructure telemetry. This reconnaissance data could help an adversary understand your database topology and replication strategy without needing valid credentials.

• CVE-2026-56284MEDIUM 5.3

  Capgo, a platform for managing mobile app updates, has an information disclosure flaw that allows anyone on the internet to retrieve sensitive operational metrics about organizations using the service. An attacker doesn't need valid credentials—they only need a valid organization identifier (UUID) and can then extract data like monthly active users, bandwidth consumption, and app installation counts. This works because a backend database function that should be restricted is accidentally callable by anonymous users. The vulnerability was patched in version 12.128.2.

• CVE-2026-56299MEDIUM 5.3

  Capgo, a software build and deployment tool, has a security flaw that lets attackers bypass authentication on a specific upload endpoint. By sending specially crafted HTTP OPTIONS requests, an attacker can trigger errors repeatedly without needing valid credentials. This causes the service to become unavailable—a denial-of-service attack. The vulnerability affects versions before 12.128.2.

• CVE-2026-56311MEDIUM 5.3

  Capgo before version 12.128.2 has a security flaw that allows anyone on the internet to view billing and plan information about any organization, even without logging in. An attacker only needs to know an organization's ID and can call a specific function to retrieve sensitive details like monthly active user limits, bandwidth allowances, storage quotas, and build time restrictions. This is a data disclosure vulnerability that exposes business-critical information.

• CVE-2026-56316MEDIUM 5.3

  Cap-go versions before 12.128.2 expose a weakness in how the build upload endpoint responds to requests. An attacker doesn't need credentials to send specially crafted requests and figure out which job IDs are real ones based on how the server responds. This allows them to probe the system repeatedly, potentially causing performance issues through sustained unauthenticated traffic.

• CVE-2026-56318MEDIUM 5.3

  Capgo versions before 12.128.2 contain a flaw that leaks information about which organization IDs exist in the system. An attacker without any authentication can send requests to a password validation endpoint and observe whether the system returns different error messages or status codes depending on whether an organization ID is real or fake. By systematically probing the endpoint, an attacker can build a list of valid organization UUIDs, effectively enumerating the platform's organizational structure. This is a reconnaissance-enabling vulnerability that does not allow direct data theft or system manipulation on its own, but significantly reduces the attacker's reconnaissance effort.

• CVE-2026-56321MEDIUM 5.3

  Capgo's backend authentication system has an inconsistency: the GET endpoint for retrieving role bindings in a specific organization doesn't require authentication before reaching the application code, while the POST and DELETE endpoints do. The endpoint itself still rejects unauthenticated requests with an 'Unauthorized' response, so the vulnerability doesn't directly leak data today. However, this architectural mismatch creates a maintenance risk—if the application-level authorization check is removed or modified in future updates, the missing middleware layer would fail to catch it, potentially exposing sensitive organizational role information.

• CVE-2026-56327MEDIUM 5.3

  Capgo versions before 12.128.2 contain a flaw that lets unauthenticated attackers figure out which organizations exist in the system. An attacker can use a publicly available API key to call a specific function and observe whether the system responds with 'organization doesn't exist' versus 'you don't have permission.' By comparing these two different error messages, an attacker can methodically discover which organization IDs are valid, essentially mapping out the tenant structure without needing legitimate credentials.

• CVE-2026-56331MEDIUM 5.3

  Capgo versions prior to 12.128.2 contain a vulnerability where the invitation acceptance endpoint fails to properly handle invalid input, causing the server to respond with a 500 error instead of a standard client error. This allows attackers to submit malformed invitation codes and observe server errors that may reveal internal system details. The vulnerability requires only the public key to trigger and cannot be exploited for authentication bypass or data modification, but the information leakage could support reconnaissance activities.

• CVE-2026-56337MEDIUM 5.3

  Capgo versions before 12.128.2 expose a flaw that lets anyone on the internet discover which app IDs exist in the platform's database. An unauthenticated attacker can probe the system by sending requests to a specific endpoint, learning whether apps with particular IDs have been registered. This leaks information across different tenants and undermines privacy boundaries—an attacker could methodically enumerate apps belonging to other organizations.

• CVE-2026-56338MEDIUM 5.3

  Capgo versions prior to 12.128.2 have a denial-of-service flaw in their two-factor authentication system. When users attempt to verify their email address as part of 2FA setup, a broken captcha validation process causes the authentication endpoint to fail repeatedly with server errors. This prevents users from completing 2FA enrollment, leaving accounts without this critical security layer—a particularly concerning impact since the vulnerability blocks access to security controls rather than enabling unauthorized access.

• CVE-2026-56371MEDIUM 5.3

  ImageMagick, a widely-used image processing library, contains a memory leak when handling specially crafted TXT files that include texture attributes. The vulnerability occurs because the software fails to properly clean up memory allocated during texture processing when a subsequent operation fails, causing memory to be progressively consumed with each malicious file processed. An attacker can exploit this by sending or hosting a crafted TXT file that, when processed by a vulnerable ImageMagick installation, exhausts available memory and causes a denial of service.

• CVE-2026-56762MEDIUM 5.3

  Hono, a popular web framework, has a vulnerability in how it handles cookie names when developers use user-controlled input. Before version 4.12.12, the framework doesn't properly validate cookie names, allowing special characters like line breaks to slip through. While modern JavaScript runtimes (Node.js, Cloudflare Workers) actively reject these malformed cookies and prevent them from being sent, the result is a runtime crash rather than a successful attack. This means your application stops responding rather than being exploited for data theft or tampering.

• CVE-2026-56781MEDIUM 5.3

  Teable, a database and collaboration platform, contains a flaw that allows anyone on the internet to read data fields that administrators intended to hide from public view. An attacker can discover which fields exist by examining metadata shared with them, then request those hidden fields by name when viewing shared records. The vulnerability affects Teable versions released before June 15, 2026, and requires no authentication or user interaction to exploit.

• CVE-2026-57021MEDIUM 5.3

  Juniper Networks Junos OS on SRX Series devices contain a memory handling flaw in their web management component that allows remote attackers to knock the system offline. If your SRX is configured to perform security checks before users log in to the VPN, an attacker can send specially crafted network traffic that crashes the web service, taking down VPN access, J-Web management, and firewall authentication until the service restarts on its own. No authentication or user interaction is needed to trigger this problem.

• CVE-2026-57024MEDIUM 5.3

  Juniper's IKE daemon (iked) on MX devices with SPC3 and SRX Series routers contains a flaw that causes it to crash repeatedly when handling a large number of failed VPN connection attempts. The underlying issue stems from the daemon reusing peer index values that are already assigned, leading to internal state conflicts. Each time iked crashes, it becomes unable to establish new VPN tunnels or refresh existing ones until the entire system is rebooted. An attacker on the network can trigger this by initiating many unsuccessful VPN negotiations, effectively disabling VPN connectivity for an extended period.

• CVE-2026-57029MEDIUM 5.3

  A synchronization flaw in Juniper's Junos OS Evolved operating system can crash the flow collector handler on QFX Series switches when sFlow collector reachability changes at the same moment the sFlow thread reads network routing data. An adjacent attacker without authentication can trigger this race condition, forcing the packet forwarding engine (evo-pfemand process) to restart and briefly interrupting all traffic until recovery completes. The vulnerability affects multiple recent versions of Junos OS Evolved on QFX10008, QFX10016, QFX51xx, and QFX52xx platforms.

• CVE-2026-57079MEDIUM 5.3

  Net::BitTorrent, a Perl BitTorrent client library, contains a path traversal vulnerability that allows remote attackers to write files outside the intended download directory. When a peer sends specially crafted metadata—either through magnet links or the BEP09 ut_metadata extension—an attacker can embed directory traversal sequences (".." path components) that the library fails to sanitize. This allows writing malicious files to arbitrary locations on the victim's system with the privileges of the downloading user. The attacker controls both the file content and its destination path, making this a serious integrity risk for systems running vulnerable versions.

• CVE-2026-57436MEDIUM 5.3

  Nokogiri, a popular Ruby library for parsing and manipulating XML and HTML documents, contains a memory safety bug in versions prior to 1.19.4. The vulnerability allows an attacker to set an invalid type of object (specifically a DTD node) as a document's root element, bypassing validation checks. This causes the library to crash or behave unpredictably when the invalid structure is processed during garbage collection. The issue is resolved in version 1.19.4 and later.

• CVE-2026-57437MEDIUM 5.3

  Nokogiri, a widely-used Ruby library for parsing XML and HTML, contains a memory safety issue in its XPath evaluation feature. If application code manually creates an XPathContext object and then allows the underlying XML/HTML document to be garbage collected while the context is still in use, subsequent XPath queries can read from freed memory, potentially crashing the application. This is a narrow vulnerability—it requires specific patterns in application code and cannot be triggered by feeding a malicious document to the library. The standard document search methods (Document#xpath, Document#css) are not affected.

• CVE-2026-57451MEDIUM 5.3

  Vim, the popular command-line text editor, contains a buffer over-read vulnerability in how it processes text properties stored within files. When Vim opens a specially crafted undo file, it may read far beyond the intended data boundaries, causing the application to crash. The vulnerability exists because Vim trusts a count value in the file without validating it against the actual data present. An attacker would need to convince a user to open a malicious undo file, but no special privileges or complex setup are required.

• CVE-2026-57587MEDIUM 5.3

  A SQL injection flaw in Nessus allows an unauthenticated attacker to manipulate reverse DNS records for a host being scanned, then inject malicious SQL commands into Nessus's scan results database. This could let the attacker read sensitive data from scan results without needing valid credentials. The attack requires the attacker to control DNS infrastructure for a target host, which limits the scope but is feasible in some network configurations.

• CVE-2026-57630MEDIUM 5.3

  Blocksy Companion Pro versions up to 2.1.46 contain an Insecure Direct Object References (IDOR) vulnerability that allows attackers to access sensitive information without authentication. An attacker can bypass access controls by directly referencing object identifiers—such as user IDs or resource handles—and retrieve data they shouldn't have permission to view. This is a network-based attack requiring no special privileges or user interaction, making it straightforward to exploit.

• CVE-2026-57633MEDIUM 5.3

  WCBoost – Products Compare, a WordPress plugin, exposes sensitive information to unauthenticated users in versions 1.1.0 and earlier. An attacker can access data without authentication due to improper access controls, though the data itself is not modified or service availability compromised. This is a localized but meaningful exposure risk for sites relying on this plugin.

• CVE-2026-57652MEDIUM 5.3

  JS Help Desk versions 3.1.0 and earlier contain an unauthenticated IDOR vulnerability that allows attackers to access sensitive information without logging in. An attacker can bypass authentication mechanisms and retrieve data they shouldn't have access to by manipulating object references in requests. This is a confidentiality risk but does not enable data modification or system disruption.

• CVE-2026-57660MEDIUM 5.3

  Booking and Rental Manager versions 2.7.1 and earlier contain a flaw that allows unauthenticated attackers to modify data without proper access controls. An attacker can exploit this vulnerability by sending direct requests to the application without logging in, potentially altering booking records, rental information, or other critical business data. No authentication is required, making this a network-accessible vulnerability that could be discovered and exploited relatively easily.

• CVE-2026-57721MEDIUM 5.3

  WP Reloaded ApplyOnline contains a missing authorization flaw that allows attackers to bypass access controls and modify data they should not have permission to change. The vulnerability stems from incorrectly configured security levels that fail to properly validate user permissions before allowing certain actions. An attacker on the network can exploit this without needing credentials or user interaction, potentially altering application data or settings.

• CVE-2026-57750MEDIUM 5.3

  A security vulnerability exists in ez Form Calculator Premium versions 2.14.1.2 and earlier that allows attackers to modify data without authentication. The flaw stems from insufficient access controls, meaning anyone with network access—no login required—can potentially alter form submissions or configurations. This is classified as a medium-severity issue because while the integrity of data can be compromised, there is no exposure of sensitive information or service disruption in the vulnerability itself.

• CVE-2026-57753MEDIUM 5.3

  The Kit for WooCommerce plugin (formerly ConvertKit) up to version 2.1.5 contains a flaw that allows unauthenticated attackers to access sensitive data. An attacker does not need credentials or user interaction to exploit this issue. The vulnerability exposes information that should remain confidential, though it does not enable modification of data or service disruption. WooCommerce sites running the affected plugin versions are at risk of information disclosure.

• CVE-2026-57760MEDIUM 5.3

  Sendcloud Shipping contains a missing authorization flaw that allows attackers to manipulate access control settings. Because the vulnerability lacks proper permission checks, an unauthenticated attacker can modify authorization levels without needing valid credentials or user interaction. This could enable unauthorized changes to shipping configurations or access permissions within affected installations.

• CVE-2026-57923MEDIUM 5.3

  JetBrains YouTrack versions before 2026.2.16593 contain an authorization bypass in the application configurations endpoint that allows authenticated users to modify project settings they should not have access to. An attacker with valid login credentials could escalate privileges within a YouTrack instance by changing project configurations without proper permission validation.

• CVE-2026-57942MEDIUM 5.3

  LibreTranslate versions up to 1.9.7 contain a header spoofing vulnerability that allows attackers to forge client IP addresses. By injecting fake values into the X-Forwarded-For HTTP header, unauthenticated attackers can bypass rate limiting and flood protections designed to prevent API abuse. This enables attackers to send unlimited requests from what appear to be different IP addresses, potentially exhausting service availability or overwhelming the translation API.

• CVE-2026-57952MEDIUM 5.3

  Mythic, a command-and-control framework, contains a flaw that allows operators with access to one attack operation to view sensitive configuration details—including encryption keys—from a completely different operation. This works because four specific API endpoints do not properly verify that a request belongs to the operation it claims to access. An attacker with any valid operator account can exploit this by guessing or knowing a configuration ID from another operation and accessing its secrets. The vendor patched this in version 3.4.0.60.

• CVE-2026-57962MEDIUM 5.3

  Thunderbird users who have configured LDAP (Lightweight Directory Access Protocol) servers for address-book autocomplete are vulnerable to a denial-of-service attack. A malicious LDAP server can respond with extremely large amounts of data that Thunderbird attempts to store, eventually consuming all available memory and crashing the application. An attacker would need to either control an LDAP server that a victim queries, or intercept traffic to a legitimate LDAP server. This is not a data breach or code execution risk, but it can disrupt email service availability.

• CVE-2026-57994MEDIUM 5.3

  phpMyFAQ versions before 4.1.5 contain a flaw that allows anyone on the internet to view draft or unpublished FAQ content that administrators intended to keep private. The vulnerability stems from inconsistent filtering rules across different API endpoints—some endpoints check whether content should be public before returning it, while others do not. An attacker can exploit this by querying the API directly to retrieve full FAQ text, question titles, and preview content from inactive items.

• CVE-2026-58203MEDIUM 5.3

  pydantic-settings is a Python library that manages application configuration through Pydantic models. Versions 2.12.0 through 2.14.1 contain a flaw in how they handle secret files stored in a designated secrets directory. When the nested subdirectory feature is enabled, the library will follow symbolic links (shortcuts) that point outside the intended secrets directory, allowing it to read arbitrary files from the system. An attacker with write access to the secrets directory—such as in a shared or world-writable mount—can create malicious symbolic links to trick the application into loading sensitive files from anywhere on the system. This also bypasses the documented size limit protection meant to prevent loading oversized files.

• CVE-2026-58369MEDIUM 5.3

  Woodpecker versions before 3.15.0 contain a flaw where an unauthenticated user can send requests to a specific endpoint (/api/orgs/lookup/*org_full_name) that the application fails to properly protect. When the endpoint receives these requests, it attempts to use information from a user session that doesn't exist, causing the application to crash briefly. The crash is caught by error handling code so the service keeps running, but each malicious request fills the logs with 37+ lines of error details. An attacker can exploit this by repeatedly sending requests to intentionally bloat log files, consuming disk space and potentially hiding legitimate security events.

• CVE-2026-58470MEDIUM 5.3

  GNU Wget, the widely-used command-line download utility, contains a flaw in how it parses HTTP Content-Range headers sent by servers. An attacker controlling a web server can craft a specially malicious Content-Range header that causes Wget to perform incorrect integer math, leading to unpredictable behavior and download corruption. The vulnerability affects Wget versions through 1.25.0 and has been patched in the project's commit 43d3ba9.

• CVE-2026-59097MEDIUM 5.3

  Taiga, a popular open-source project management and agile planning platform, contains a gap in access controls that allows anyone on the internet to manipulate due-date records within projects without needing to log in. An attacker can create default due-date entries for user stories, tasks, and issues in any project by simply knowing or guessing the project ID. This pre-empts legitimate administrators from setting up their own due dates and can cause confusion or operational disruption. The vulnerability affects versions before 6.10.2.

• CVE-2026-59218MEDIUM 5.3

  Open WebUI versions before 0.10.0 contain a user enumeration vulnerability in the sign-in endpoint. The flaw allows an attacker to determine whether an email address is registered by measuring response times: accounts that exist take longer to reject (because the system verifies a password), while non-existent accounts are rejected faster. This leaks information about registered users without needing valid credentials.

• CVE-2026-59511MEDIUM 5.3

  A vulnerability in Exclusive Addons Elementor, a WordPress plugin providing extended functionality for the Elementor page builder, allows sensitive information to be embedded and transmitted in outbound data. The flaw stems from improper handling of sensitive data during the plugin's normal operation, potentially exposing information that should remain private. Versions through 2.7.9.9 are affected. While the attack requires no user interaction and can be initiated remotely, the impact is limited to confidentiality—data disclosure rather than system compromise or modification.

• CVE-2026-59519MEDIUM 5.3

  Softaculous FormLayer versions up to 1.0.6 inadvertently expose sensitive information in network traffic by including it in outbound data where it shouldn't be. An attacker on the network path can retrieve this sensitive data without needing authentication or user interaction. This is a moderate-severity issue that affects the confidentiality of information processed by the affected plugin.

• CVE-2026-59817MEDIUM 5.3

  Ghost, a Node.js-based content management system, contains a vulnerability in its donation checkout feature that allows unauthenticated attackers to manipulate checkout metadata. By exploiting this flaw, attackers can obtain paid gift memberships at a fraction of their intended cost, effectively devaluing your membership revenue stream. The vulnerability affects versions 6.27.0 through 6.43.x and is resolved in version 6.44.0.

• CVE-2026-59828MEDIUM 5.3

  Discourse, an open-source discussion platform, contains a vulnerability that allows post revision history to leak information that should remain hidden from regular users. When users view adjacent post revisions, the serialization process can expose diffs that include content from hidden revisions. This affects instances running Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5. The leak occurs through normal diff display functionality rather than requiring special privileges, though the impact is limited to information disclosure.

• CVE-2026-59868MEDIUM 5.3

  js-yaml, a popular JavaScript library for parsing YAML files, contains a performance vulnerability in versions 5.0.0 through 5.1.x. When YAML merge keys are enabled, an attacker can craft a malicious document that causes the parser to consume quadratic amounts of CPU time despite the document itself growing only linearly in size. This creates a denial-of-service condition where relatively small payloads trigger disproportionate computational overhead. The vulnerability is resolved in version 5.2.0.

• CVE-2026-59870MEDIUM 5.3

  js-yaml, a popular JavaScript library for parsing YAML files, contains a performance vulnerability in its ordered-map (omap) tag handling. When processing specially crafted YAML documents, the library performs redundant duplicate-key checks that consume excessive CPU resources, potentially causing denial-of-service conditions. The vulnerability affects versions 5.0.0 through 5.2.0 and is resolved in version 5.2.1.

• CVE-2026-59871MEDIUM 5.3

  node-tar, a popular Node.js library for handling tar archives, has a flaw in how it processes certain archive metadata. When a tar file contains paths or link targets that are purely numeric values, the library incorrectly converts them into JavaScript numbers instead of treating them as text. This conversion breaks downstream code that expects to work with file paths as strings, causing the application to crash with an uncaught error. The issue affects versions prior to 7.5.18 and has been patched in that release.

• CVE-2026-59875MEDIUM 5.3

  A vulnerability in node-tar, a popular Node.js library for reading and writing tar archives, allows an attacker to craft a malicious tar file that crashes applications processing it. The flaw stems from improper handling of special characters (NUL bytes) embedded in file path metadata within tar archives. When an affected version of node-tar encounters such an archive, the resulting error terminates the application unexpectedly, causing a denial of service. This impacts any Node.js application that extracts or processes untrusted tar files without additional validation.

• CVE-2026-59877MEDIUM 5.3

  protobufjs, a JavaScript library that converts Protocol Buffer schema definitions into executable code, contains a parsing vulnerability in versions before 7.6.5 and 8.6.6. An attacker who supplies a malformed .proto schema file can trigger an infinite loop during parsing, causing the application to hang indefinitely. This affects any developer or system that loads untrusted protobuf schemas using the vulnerable library versions.

• CVE-2026-59927MEDIUM 5.3

  Mistune, a popular Python Markdown parser, contains a flaw in how it handles file inclusion directives. When two Markdown files are set up to include each other (either directly or through a chain), the parser enters an infinite loop trying to resolve the circular reference. This causes the application to crash with a RecursionError rather than gracefully detecting and rejecting the cycle. The vulnerability was introduced because the inclusion logic only checked for immediate self-references but missed indirect circular dependencies. The issue affects all versions prior to 3.3.0.

• CVE-2026-59938MEDIUM 5.3

  A memory exhaustion vulnerability exists in pypdf, a popular open-source Python PDF library. An attacker can craft a malicious PDF file that declares image dimensions far larger than the actual image data contained within it. When pypdf processes such a file, it allocates excessive memory based on the declared sizes, leading to memory exhaustion and denial of service. The flaw affects all versions prior to 6.14.0 and is resolved in that release.

• CVE-2026-60086MEDIUM 5.3

  PraisonAI versions before 4.6.78 have a weakness in their prompt injection defense system. The defense is designed to block dangerous attacks, but it only stops threats it classifies as CRITICAL—which requires matching three or more threat detection families at once. Attackers can bypass this by crafting simpler prompt injections that are classified as HIGH severity instead, allowing malicious inputs to reach the underlying AI model without being blocked.

• CVE-2026-6046MEDIUM 5.3

  Mattermost has a vulnerability in its bot registration process that fails to properly verify bot account ownership. An attacker with basic user access can register a standard user account using a name that matches a plugin bot's predictable username. This allows them to intercept private messages intended for that bot—messages that often contain sensitive information passed between plugins and administrators. The vulnerability affects multiple Mattermost versions across the 11.6, 11.5, and 10.11 release lines.

• CVE-2026-6092MEDIUM 5.3

  CVE-2026-6092 is a cryptographic implementation flaw in WolfSSL where the library may unexpectedly downgrade from the stronger Encrypt-then-MAC mode to the weaker MAC-then-Encrypt mode, even when configured to enforce Encrypt-then-MAC. This downgrade weakens the integrity guarantees of TLS connections by allowing potential plaintext recovery attacks. An attacker on the network can exploit this without authentication to read sensitive data transmitted over affected connections.

• CVE-2026-61344MEDIUM 5.3

  California's Superior Court Hearing Reminder Service (HRS) at https://www.hrs.courts.ca.gov contains an API endpoint that leaks court hearing reminder records to anyone on the internet without requiring login credentials. The exposed data is not encrypted or restricted, meaning an attacker can retrieve potentially sensitive case and scheduling information simply by querying the endpoint. This is a missing authentication issue affecting a public government service.

• CVE-2026-6450MEDIUM 5.3

  A flaw in how WolfSSL processes certificate revocation lists (CRLs) allows specially crafted CRLs with unrecognized critical extensions to bypass validation checks. When a CRL carries a valid signature, the library should reject any critical extensions it doesn't understand—but this implementation fails to do so. An attacker could supply a malicious CRL that appears legitimate to certificate validation logic, potentially leading to acceptance of certificates that should have been revoked. This affects only WolfSSL builds compiled with CRL support enabled.

• CVE-2026-6678MEDIUM 5.3

  A flaw in wolfSSL's PKCS#7 decryption function can cause incorrect handling of encrypted data when processing specially crafted messages. The vulnerability stems from an integer underflow—a mathematical error where a calculation produces a value smaller than intended—affecting how the library determines the length of decrypted content. While this does not expose encrypted data or allow an attacker to decrypt messages they shouldn't access, it can cause the decryption process to fail or behave unexpectedly, potentially leading to a denial of service.

• CVE-2026-6681MEDIUM 5.3

  wolfSSL versions 5.9.0 and earlier contain a buffer overflow vulnerability in their PKCS#7 decoding functionality. When applications call the PKCS#7 decoder and provide a buffer along with its size, the decoder ignores the size limit and writes decoded data beyond the buffer boundary. An unauthenticated remote attacker can exploit this to corrupt memory and potentially modify application state or behavior. The vulnerability was patched in wolfSSL 5.9.1.

• CVE-2026-6798MEDIUM 5.3

  The 2Download Connector for 2DL Hosted Checkout WordPress plugin contains a critical authorization flaw that exposes subscription data to anyone on the internet. An attacker without any login credentials can access another customer's subscription details—including whether their subscription is active, what they purchased, order numbers, and renewal dates. The vulnerability affects all versions up to 0.1.5 and requires immediate patching.

• CVE-2026-6802MEDIUM 5.3

  A WordPress plugin called Easy Upload Files During Checkout contains a security flaw that allows anyone on the internet to delete files from a site's media library without needing a password or any special access. The vulnerability exists in versions 3.0.1 and earlier. An attacker could exploit this to remove important images, documents, or other media, potentially disrupting site operations or destroying content.

• CVE-2026-6937MEDIUM 5.3

  A WordPress plugin called 'Appointment Booking Calendar — Simply Schedule Appointments' has a flaw that allows anyone on the internet to view and modify appointment data without logging in. Attackers can change appointment details, payment status, meeting links, and steal customer information by exploiting a predictable security token that's visible in the HTML of booking pages. The vulnerability affects all versions up to 1.6.11.8.

• CVE-2026-6964MEDIUM 5.3

  A WordPress plugin for video conferencing with Zoom has a flaw that allows anyone on the internet to obtain sensitive credentials—specifically the site's Zoom SDK API key and a signed authentication token—without needing to log in or have permission. An attacker with these credentials can use Zoom's Web SDK to join any meeting hosted through that Zoom account, bypassing the normal meeting access controls. The vulnerability affects all versions of the plugin up to and including 4.6.7.

• CVE-2026-7552MEDIUM 5.3

  The Geo Mashup plugin for WordPress has a flaw that allows anyone on the internet to retrieve sensitive configuration information without needing to log in or have any authorization. Specifically, attackers can obtain Google Maps API keys and GeoNames service credentials stored in the plugin's settings. This happens because the plugin fails to properly check whether a request is coming from someone who should actually have access to that data.

• CVE-2026-7558MEDIUM 5.3

  A WordPress plugin called Age Verification & Identity Verification by Token of Trust allows anyone visiting a website—even without logging in—to download sensitive donation and order information by simply adding a special web address parameter. The plugin doesn't check whether visitors have permission to access this data, meaning attackers could collect details about charitable donations, order IDs, dates, and internal admin links without any authentication. All versions up to 4.0.2 are affected.

• CVE-2026-7617MEDIUM 5.3

  The Secufor_OAuth plugin for WordPress contains an authorization flaw that allows unauthenticated attackers to disconnect a WordPress site from its linked Secufor account. An attacker can clear the plugin's stored authentication token and user login configuration without needing any valid credentials or permission. This creates a denial-of-service condition for legitimate users trying to access their Secufor-integrated authentication system.

• CVE-2026-7651MEDIUM 5.3

  A widely-used WordPress membership plugin contains a flaw that allows any logged-in user with basic subscriber privileges to delete media files (images, documents, etc.) that belong to other users, including administrators. The plugin fails to verify ownership before allowing deletion, meaning an attacker could systematically destroy important content without authorization. This affects all versions up to 5.1.5.

• CVE-2026-7665MEDIUM 5.3

  A WordPress plugin called Essential Addons for Elementor contains a flaw that allows anyone on the internet to view sensitive posts they shouldn't be able to see—including password-protected pages, private posts, and draft content. The vulnerability exists in a feature called 'ajax_load_more' that doesn't properly check permissions before returning post data. An attacker needs only a web browser; no login credentials or special interaction is required.

• CVE-2026-7765MEDIUM 5.3

  Checkmk contains a flaw in how it controls access to user messages through its dashboard feature. When someone shares a dashboard using a public token, the system incorrectly returns messages belonging to the dashboard creator instead of the person viewing it. An attacker who obtains a valid share token can bypass normal access controls and read the creator's private messages directly from the underlying API endpoints—even if no User Messages widget is visible on the dashboard itself. This is an authorization bypass that leaks sensitive information.

• CVE-2026-7792MEDIUM 5.3

  The WPForms plugin for WordPress is vulnerable to webhook forgery that allows attackers to impersonate PayPal and manipulate subscription payment records. An attacker who knows a subscription ID can craft fake PayPal webhook messages to reactivate cancelled subscriptions, change payment status, or modify other subscription details—all without needing to authenticate or access PayPal itself. The vulnerability exists because the plugin accepts webhook payloads without verifying they actually came from PayPal using the required cryptographic signature check.

• CVE-2026-7828MEDIUM 5.3

  UltraVNC repeater versions up to 1.8.2.2 contain a memory allocation flaw triggered by oversized HTTP requests. When a user sends an HTTP request with an exceptionally long URI to the repeater's web interface port, the logging function attempts to allocate memory based on the URI length but miscalculates the size due to integer overflow. This causes the system to reserve far less memory than needed, and the subsequent copy of the full URI data spills beyond the allocated buffer, corrupting heap memory. An attacker on the network can trigger this condition without authentication, potentially destabilizing the repeater process or, in theory, achieving limited code execution through heap manipulation.

• CVE-2026-7859MEDIUM 5.3

  The Motors WordPress plugin contains a security flaw that allows attackers to change important website content without logging in. By exploiting a missing security check in one of the plugin's automated actions, an attacker can modify post metadata—such as gallery settings and featured images. On sites selling products with WooCommerce, this extends to changing product prices. The vulnerability affects all versions of the plugin before 1.4.110.

• CVE-2026-8049MEDIUM 5.3

  SignalRGB, a popular RGB lighting control application, contains a local privilege escalation vulnerability affecting versions before 1.3.7.0. The application creates a system device object without proper security restrictions, allowing any user logged into the system to send administrative commands to the device driver. This could let an attacker read sensitive data, modify system settings, or cause the application to crash.

• CVE-2026-8382MEDIUM 5.3

  The Advanced Custom Fields (ACF) plugin for WordPress contains a flaw that allows anyone on the internet to modify the title and content of posts that use ACF forms, without needing to log in or have any special permissions. An attacker can inject malicious values into form fields to alter published content, potentially leading to defacement, misinformation, or reputational damage. All versions up to 6.8.1 are affected.

• CVE-2026-8383MEDIUM 5.3

  A flaw in the LearnPress WordPress plugin before version 4.3.7 exposes sensitive user information to anyone on the internet without needing to log in. The plugin's REST API endpoint fails to properly restrict access to user details—specifically roles, capabilities, locale, and registration dates—which should only be available to administrators. An attacker can craft a simple web request to retrieve this data for any user on an affected site.

• CVE-2026-8385MEDIUM 5.3

  The WP Go Maps WordPress plugin contains an access control flaw that exposes unapproved map markers to anyone on the internet. Site owners use marker approval workflows to control which locations, names, and descriptions appear publicly on their maps. This vulnerability bypasses that approval gate through a fallback admin endpoint, leaking sensitive location data—including titles, categories, addresses, and descriptions—to unauthenticated visitors. The issue affects all versions before 10.0.10.

• CVE-2026-8386MEDIUM 5.3

  A flaw in the WP Go Maps WordPress plugin before version 10.0.10 exposes unapproved location markers to anyone on the internet. When an administrator creates a marker on a map but hasn't published it yet, the plugin still serves that marker's data via a public API endpoint without checking whether it should be visible. This means sensitive details—like personal addresses, descriptions, and exact GPS coordinates—can leak to unauthorized visitors before the admin intends to make them public.

• CVE-2026-8474MEDIUM 5.3

  A reflected cross-site scripting (XSS) vulnerability exists in the login API of Stormshield Network Security (SNS) appliances. An attacker can craft a malicious link or inject code that, when accessed by a user, executes arbitrary JavaScript in their browser. This could allow theft of session cookies, capture of credentials, or redirection to phishing sites. The vulnerability affects versions 4.3.0–4.3.41, 4.8.0–4.8.15, and 5.0.0–5.0.5.

• CVE-2026-8499MEDIUM 5.3

  The Helpfulcrowd Product Reviews plugin for WordPress contains a critical logic flaw that allows unauthenticated attackers to bypass security checks and modify the plugin's configuration settings. An attacker can send a specially crafted request with a JSON boolean value to trick the plugin's validation function into accepting unauthorized access, then write arbitrary settings into the WordPress database. This vulnerability affects versions 1.2.9 and earlier.

• CVE-2026-8502MEDIUM 5.3

  The LearnPress WordPress LMS plugin contains a flaw that lets unauthenticated attackers read sensitive course data. By crafting a specific request to the courses API endpoint with two parameters (c_status=all and return_type=json), an attacker can bypass intended access controls and retrieve plaintext passwords for protected courses, as well as unpublished course content, author names, and other metadata. The vulnerability affects all versions up to 4.3.6.

• CVE-2026-8608MEDIUM 5.3

  The Event Monster WordPress plugin, used for event management and ticket sales, contains a flaw that allows attackers to create fake payment records without actually paying. An unauthenticated attacker can submit forged transaction details through the plugin's payment handler, tricking the system into marking bookings as completed and issuing valid QR code tickets. This bypasses payment verification entirely, enabling ticket fraud on any affected WordPress site.

• CVE-2026-8609MEDIUM 5.3

  Grafana has a denial-of-service vulnerability in its OAuth login flow. An unauthenticated attacker can send repeated login attempts with varying parameters, causing the application to leak memory without bound. Eventually, the Grafana instance runs out of memory and crashes, disrupting availability for legitimate users. No authentication is required to trigger this issue, making it accessible to anyone on the network.