2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 33 of 41

• CVE-2026-55890MEDIUM 4.8

  Grav, a file-based web content platform, contains a stored cross-site scripting (XSS) vulnerability in how it handles Markdown image styling. An authenticated editor can inject malicious code through image style parameters in Markdown that will execute in the browsers of users viewing the rendered content. This vulnerability exists because a previous XSS fix (CVE-2026-42841) was incomplete and left another code path unprotected. The vulnerability requires editor-level permissions to exploit and is fixed in version 2.0.0-rc.9.

• CVE-2026-56294MEDIUM 4.8

  A vulnerability in capacitor-native-biometric allows attackers to bypass biometric authentication on mobile applications. The flaw exists because the authentication success handler doesn't properly verify cryptographic parameters. An attacker with physical or programmatic access to a device can exploit this by intercepting and manipulating the authentication flow, gaining unauthorized access without providing valid biometric credentials. This is a medium-severity issue because it requires specific technical conditions and device access, but it directly undermines a critical security control.

• CVE-2026-56381MEDIUM 4.8

  Craft CMS versions from 5.0.0-RC1 onward contain a stored cross-site scripting (XSS) vulnerability in the User Permissions page. An administrator can inject malicious JavaScript code into user group names, which then executes whenever other users access or modify permission settings. This is a privilege-based attack where an already-compromised or malicious admin account can harm other users through their browser.

• CVE-2026-56383MEDIUM 4.8

  Craft CMS has a stored cross-site scripting (XSS) flaw in its editable table component when using row heading column types. An administrator with change permissions can inject malicious JavaScript into row heading default values. This code then runs automatically when other users view pages containing that table field, potentially compromising their accounts or stealing sensitive data. The vulnerability affects Craft CMS versions 4.5.0-beta.1 through 4.16.18 and 5.0.0-RC1 through 5.8.22.

• CVE-2026-56393MEDIUM 4.8

  Craft CMS administrators can inject malicious JavaScript code into configuration fields—such as section names, volume names, or checkbox labels—that will execute when other administrators view those settings in the control panel. This happens because Craft renders these fields without removing potentially harmful code. An attacker with admin privileges and the ability to modify admin settings could weaponize this to steal session tokens or perform unauthorized actions on behalf of other users.

• CVE-2026-57289MEDIUM 4.8

  Jenkins Bitbucket Push and Pull Request Plugin version 3.3.8 and earlier contains a security flaw that disables SSL/TLS certificate validation when sending authentication tokens to Bitbucket Server. This means an attacker positioned to intercept network traffic—such as on a shared network or compromised router—could potentially capture the authentication token in transit, even though the connection appears secure. The vulnerability requires specific network conditions to exploit but represents a meaningful risk to Jenkins installations that rely on this plugin for Bitbucket integration.

• CVE-2026-57352MEDIUM 4.8

  A vulnerability exists in the ALD – Dropshipping and Fulfillment plugin for WooCommerce (versions 2.2.0 and earlier) that allows attackers to bypass authentication controls without credentials. The flaw stems from improper validation of authentication mechanisms, creating an opening for unauthorized access. An attacker would need to perform specific actions or supply particular input to exploit this—it's not trivial, but it is accessible over the network without user interaction.

• CVE-2026-57997MEDIUM 4.8

  Strapi's users-permissions plugin has a cryptographic configuration flaw that allows attackers to bypass JWT (JSON Web Token) authentication controls. When administrators don't explicitly set the allowed JWT algorithm in their configuration, the plugin accepts multiple HMAC variants (HS384 and HS512) in addition to the default HS256. If an attacker obtains the JWT secret key—whether through a separate compromise, supply chain attack, or insider access—they can create valid tokens using these alternative algorithms to impersonate users and gain unauthorized access.

• CVE-2026-58034MEDIUM 4.8

  A cross-site scripting (XSS) vulnerability exists in Wikimedia Foundation's CheckUser extension for MediaWiki. The flaw is located in a Vue component responsible for blocking connected temporary accounts. An authenticated administrator with high privileges can craft malicious input that executes unintended JavaScript in the browsers of other users viewing the affected page, potentially leading to session hijacking or credential theft.

• CVE-2026-58035MEDIUM 4.8

  MediaWiki contains a cross-site scripting (XSS) vulnerability in its Special:Block page interface that allows an authenticated user with administrative privileges to inject malicious scripts. When a victim visits the affected page after the attacker has crafted a malicious block, the injected code executes in the victim's browser in the context of the wiki. This is a reflected or stored XSS issue depending on how the input flows through the Special Block feature, and it requires both high-privilege attacker account and user interaction to successfully exploit.

• CVE-2026-58657MEDIUM 4.8

  Grav, a flat-file CMS platform, contains a stored CSS injection flaw in its Markdown image resize feature. A content editor with page-editing privileges can embed malicious CSS into image resize parameters that will execute in the browser of any administrator or reviewer who views the crafted page. Unlike traditional injections, this attack doesn't require JavaScript—it abuses CSS properties to manipulate the visual layout or create overlay attacks that could deceive users into performing unintended actions.

• CVE-2026-59876MEDIUM 4.8

  protobufjs is a popular library that converts Protocol Buffer definitions into JavaScript functions for serialization and deserialization. Between versions 8.2.0 and 8.6.4, the Text Format extension (which parses human-readable protobuf text) contained a prototype pollution vulnerability. When processing map entries, the code would assign user-supplied keys directly to the map object using standard property assignment. An attacker who controls protobuf text input could inject a key named `__proto__` to modify the prototype chain of the resulting map object, potentially affecting how the application behaves with that object and related instances. This is a moderate-severity issue that requires specific attack conditions to exploit but can lead to unexpected property access or behavior changes.

• CVE-2026-59897MEDIUM 4.8

  Hono, a JavaScript web application framework, has a flaw in how it handles HTTP headers when deployed on AWS API Gateway v1. The framework incorrectly removes duplicate header values by comparing substrings instead of exact matches. This means if a request contains the same header value multiple times with slight differences, one instance gets dropped. For applications relying on complete header chains—especially the X-Forwarded-For header used to track proxy chains—this data loss can break security controls like rate limiting, audit logging, and proxy validation. The vulnerability affects versions 4.3.3 through 4.12.26 and is resolved in 4.12.27.

• CVE-2026-59998MEDIUM 4.8

  OpenSSH versions before 10.4 contain an undocumented security behavior where the GSSAPIStrictAcceptorCheck setting fails to function correctly when the SSH server is configured with Windows Active Directory authentication. This means servers relying on this setting for access control may not enforce the intended security checks, potentially allowing unauthorized access or credential exposure in Windows AD environments.

• CVE-2026-6324MEDIUM 4.8

  libsoup, a widely-used HTTP client library, contains a logic error in how it processes chunked HTTP request bodies. An attacker can craft a malicious HTTP request that exploits an unsigned-to-signed integer conversion flaw in the chunked encoding handler. The vulnerability is most likely to be triggered in proxy scenarios—when libsoup is deployed behind a third-party proxy or acting as a proxy itself. Successful attacks can lead to cache poisoning, security control bypass, or unauthorized access to backend systems.

• CVE-2026-6371MEDIUM 4.8

  Limatek System Inc.'s LimRAD NAC product contains a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker with limited network access to inject malicious scripts into the web interface. These scripts persist in the system and execute in the browsers of other users who view affected pages, potentially compromising session integrity and enabling unauthorized actions within the NAC application.

• CVE-2026-8078MEDIUM 4.8

  Checkmk versions before 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 releases contain a stored cross-site scripting (XSS) vulnerability in the global settings change log. An administrator with permission to modify global settings can inject malicious HTML or JavaScript into changelog messages. When other users view the Activate Changes page or Audit log, this malicious code executes in their browsers, potentially compromising their sessions or stealing information.

• CVE-2026-8661MEDIUM 4.8

  A flaw in Rapid7 InsightConnect's Markdown Plugin allows attackers to trick the system into making unwanted outbound web requests when processing user-supplied Markdown content. The vulnerability exists in the markdown_to_pdf action and stems from incomplete sanitization of HTML elements like images and stylesheets that can load external resources. An attacker can embed specially crafted Markdown with image tags or CSS imports pointing to internal or external targets, causing the affected server to fetch those resources on the attacker's behalf. Versions prior to 4.0.2 are vulnerable; an initial patch in 4.0.0 addressed JavaScript execution but overlooked resource-loading vectors.

• CVE-2026-9549MEDIUM 4.8

  Checkmk versions before 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 releases contain a stored cross-site scripting vulnerability in the service discovery active check output feature. An administrator with the ability to configure active or custom checks can inject malicious HTML or JavaScript that will execute in the browsers of other administrators or users with host read permissions when they view or run checks on the service discovery page. The attack is persistent—the injected code remains in the system until removed.

• CVE-2026-9677MEDIUM 4.8

  The Shariff for WordPress plugin through version 1.0.11 contains a stored cross-site scripting (XSS) vulnerability in how it handles the shariff_infourl setting. An administrator can inject malicious JavaScript that persists in the site's database and executes in visitors' browsers when the plugin displays the sharing interface. This is particularly concerning in multisite WordPress environments where administrators may not have the unfiltered_html capability, yet can still weaponize this setting to attack site visitors.

• CVE-2026-10070MEDIUM 4.7

  A flaw in macrozheng mall versions up to 1.0.3 allows an authenticated administrator with high privileges to bypass authorization controls on the super admin password update endpoint. An attacker with admin credentials could manipulate requests to the /admin/update/ path and gain unauthorized access to sensitive administrative functions. The vulnerability requires valid admin-level authentication and cannot be exploited anonymously from the network.

• CVE-2026-10155MEDIUM 4.7

  A SQL injection vulnerability exists in Bdtask Multi-Store Inventory Management System version 1.0 within the Accounts Report Handler. An authenticated attacker can manipulate the 'dtpToDate' parameter in the accounts report search function to inject malicious SQL commands. While the vulnerability requires high privileges to exploit, successful attacks could leak sensitive financial data, modify account records, or disrupt reporting functionality. Public exploit code is available, increasing real-world risk.

• CVE-2026-10171MEDIUM 4.7

  A SQL injection vulnerability exists in code-projects Online Music Site version 1.0 that allows authenticated administrators to manipulate the ID parameter in the album update functionality. An attacker with admin credentials can inject malicious SQL commands through the /Administrator/PHP/AdminUpdateAlbum.php endpoint, potentially compromising database integrity and confidentiality. The vulnerability has been publicly disclosed and exploit code is available, increasing the likelihood of active exploitation.

• CVE-2026-10237MEDIUM 4.7

  A SQL injection vulnerability was identified in SourceCodester Water Billing Management System version 1.0. An authenticated administrator can manipulate the ID parameter in the user management interface to inject malicious SQL commands, potentially reading or modifying sensitive database records. The vulnerability requires administrative privileges to exploit but poses a risk to data integrity and confidentiality within billing systems. Public proof-of-concept code exists, elevating the practical risk of exploitation.

• CVE-2026-10248MEDIUM 4.7

  SourceCodester's Pharmacy Sales and Inventory System version 1.0 and earlier contains a CSV injection vulnerability in its supplier creation interface. An authenticated attacker with high privileges can inject malicious CSV formulas through the Address or Company Name fields when exporting supplier data, potentially causing data corruption, formula execution, or information disclosure when a user opens the exported file in a spreadsheet application.

• CVE-2026-10583MEDIUM 4.7

  A server-side request forgery (SSRF) vulnerability exists in nextlevelbuilder GoClaw versions up to 3.11.3. The flaw is located in the TTS Configuration Endpoint's Import function, which fails to properly validate or restrict outbound HTTP requests. An authenticated attacker with high privileges can exploit this to make the affected server initiate requests to internal or external systems on their behalf, potentially accessing sensitive internal resources or launching further attacks. The vulnerability has been publicly disclosed.

• CVE-2026-10659MEDIUM 4.7

  A NULL pointer dereference vulnerability exists in Zephyr's Dhara flash translation layer driver. When the driver initializes or mounts a flash-based storage disk, it may attempt to read checkpoint pages to resume the filesystem state. If the flash hardware returns an error (such as a corrected ECC failure or bad block detection), the driver code unconditionally writes the error code through a NULL pointer instead of using the library's safe error-handling function. This causes a kernel fault and system crash. The vulnerability requires local access and depends on specific flash health conditions or crafted on-disk content, making it a localized but critical availability risk for embedded systems relying on Zephyr's flash storage.

• CVE-2026-11233MEDIUM 4.7

  CVE-2026-11233 is a same-origin policy bypass vulnerability in Google Chrome's FoldableAPIs feature. An attacker who has already gained control of Chrome's renderer process—the component that executes web page code—can use a specially crafted HTML page to break through Chrome's security boundary and access data from websites the user visits. This requires the attacker to have already compromised the renderer, making it a secondary exploit rather than a direct entry point. The vulnerability affects Chrome versions prior to 149.0.7827.53.

• CVE-2026-11249MEDIUM 4.7

  Google Chrome versions before 149.0.7827.53 contain a use-after-free vulnerability in the Network component. If an attacker compromises Chrome's renderer process—the sandboxed part that runs web content—they could read sensitive data from the browser's memory using a specially crafted HTML page. This is a memory safety issue: the code attempts to access data after it has already been freed, potentially exposing unencrypted information that was in use moments before.

• CVE-2026-11448MEDIUM 4.7

  GL.iNet GL-MT3000 routers running firmware version 4.4.5 and earlier contain a command injection flaw in the Minidlna service. An authenticated remote attacker can manipulate a specific parameter to inject arbitrary commands, potentially allowing them to execute code on the device. The vulnerability requires administrative privileges to exploit and has been resolved in firmware version 4.7 through enhanced input validation added to the SDK.

• CVE-2026-11469MEDIUM 4.7

  A vulnerability exists in jishenghua jshERP versions up to 3.6 that allows an authenticated administrator to perform server-side request forgery (SSRF) attacks by manipulating configuration parameters. An attacker with high-level privileges can craft malicious input to the platformConfig add endpoint, causing the server to make unintended requests to internal or external systems. This vulnerability requires authentication and administrative access to exploit, limiting immediate risk but potentially enabling lateral movement or data exfiltration once an admin account is compromised.

• CVE-2026-11596MEDIUM 4.7

  ScreenConnect versions before 26.2 contain a weakness in how it validates input when administrators or authorized users create Host Pass tokens—special access credentials that grant temporary delegated access. An authenticated user with Host Pass creation privileges can bypass the intended expiration time limits and specify tokens that remain valid far longer than intended, potentially allowing extended unauthorized access to systems after the token should have expired.

• CVE-2026-11621MEDIUM 4.7

  Dcat-Admin versions up to 2.2.3-beta contain a file upload vulnerability in the User Setting Page. An authenticated administrator can upload arbitrary files by manipulating the image upload parameter in the editor component, potentially leading to code execution or data compromise. The vulnerability requires high-level privileges but poses a meaningful risk in multi-user admin environments.

• CVE-2026-12002MEDIUM 4.7

  A WordPress plugin called Smash Balloon Social Photo Feed contains a security flaw that allows attackers to hijack the site's connection to Instagram and Facebook. The vulnerability exists because the plugin doesn't properly verify that requests to change authentication tokens actually come from authorized administrators. An attacker can craft a malicious link that, when clicked by a site admin, silently swaps out the legitimate access tokens for attacker-controlled ones. This doesn't give immediate visibility into private data, but it severs the site's legitimate social media feeds and could allow the attacker to post content or monitor activity through those accounts.

• CVE-2026-12175MEDIUM 4.7

  CodeAstro Student Attendance Management System version 1.0 contains a SQL injection vulnerability in its student creation interface. An authenticated administrator can exploit this flaw by manipulating the admission number field to inject malicious SQL commands, potentially reading, modifying, or deleting sensitive student and attendance data. The vulnerability requires valid admin credentials to exploit, but the attack itself is straightforward and exploit code is publicly available.

• CVE-2026-12311MEDIUM 4.7

  CVE-2026-12311 is a sandbox escape vulnerability in Firefox and Thunderbird that can leak information to an attacker. The flaw exists in the process sandboxing security component and requires user interaction—such as clicking a link or visiting a malicious webpage—to trigger. While the vulnerability is rated as medium severity, it undermines a critical security boundary, allowing an attacker to read sensitive information that should be isolated within the sandbox. This affects current-generation Firefox and Thunderbird releases.

• CVE-2026-12313MEDIUM 4.7

  A vulnerability in Firefox and Thunderbird's process sandboxing mechanism allows an attacker to leak sensitive information and potentially escape the sandbox through a crafted webpage or message. The attack requires user interaction (such as visiting a malicious site or opening a specially prepared message) and affects your system's security boundary—the sandbox that isolates the browser process from the rest of your computer. Mozilla has patched this in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

• CVE-2026-12463MEDIUM 4.7

  Google Chrome on Linux contains a flaw in how it handles Views that allows an attacker who has already compromised Chrome's rendering engine to inject malicious scripts or HTML content into web pages. This is a secondary attack—the attacker must first gain control of the renderer process before exploiting this vulnerability. The flaw affects Chrome versions prior to 149.0.7827.155 on Linux systems.

• CVE-2026-12789MEDIUM 4.7

  ILIAS Learning Management System version 11.0 contains a SQL injection vulnerability in its Learning Progress Tracking component. An authenticated administrator can manipulate a parameter called troup_table_nav to inject malicious SQL commands, potentially allowing unauthorized data access or modification within the LMS database. The vulnerability requires administrative privileges to exploit and poses a medium-severity risk to institutions using this open-source learning platform.

• CVE-2026-13034MEDIUM 4.7

  Google Chrome versions before 149.0.7827.197 contain a flaw in how it handles passwords that allows an attacker who has already compromised Chrome's renderer process to break out of site isolation—Chrome's critical security boundary that prevents malicious websites from accessing data belonging to other websites. An attacker would need to trick a user into visiting a specially crafted webpage after first gaining control of the renderer, but if successful, could view sensitive information like passwords or cookies from other sites.

• CVE-2026-13495MEDIUM 4.7

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0 affecting the /adminprofile.php file. An attacker with administrative privileges can manipulate the loginid parameter to inject malicious SQL commands, potentially allowing unauthorized data access or modification. The vulnerability has been publicly disclosed and is remotely exploitable, though it requires high-level privileges to execute.

• CVE-2026-13569MEDIUM 4.7

  A SQL injection vulnerability exists in EyouCMS versions up to 1.7.1, affecting the API endpoint at /index.php. An authenticated attacker can inject malicious SQL commands through the 'click_like' parameter to manipulate database queries. The vulnerability requires administrative or high-privilege credentials to exploit, but once triggered, allows an attacker to read, modify, or delete sensitive database records. Public exploit code is already available.

• CVE-2026-13812MEDIUM 4.7

  A vulnerability in Google Chrome for iOS allows attackers to inject malicious scripts or HTML into web pages through specific user interactions. An attacker would need to convince a user to perform particular gestures on a crafted webpage to exploit this flaw. The vulnerability stems from insufficient validation of user-supplied input before processing it in the browser's rendering engine.

• CVE-2026-14361MEDIUM 4.7

  Consul-template versions before 0.42.1 contain a vulnerability in how the writeToFile template helper processes file paths. An attacker with local access and limited privileges could potentially craft a malicious template that writes output to unintended directories or overwrites existing files on the system. This is a local privilege escalation concern rather than a remote vulnerability, and requires active template manipulation to exploit.

• CVE-2026-14620MEDIUM 4.7

  webpack-dev-server, a popular development utility for JavaScript applications, contains a cross-site request forgery (CSRF) vulnerability that allows any website a developer visits to secretly perform actions on their local development server. Specifically, two internal endpoints that manage file editing and code recompilation accept requests from external sites without verification. An attacker can craft a malicious webpage that, when opened by a developer, triggers these endpoints to open arbitrary files on the developer's system in their code editor or force wasteful recompilations. The vulnerability affects webpack-dev-server version 5.2.5 and earlier.

• CVE-2026-15173MEDIUM 4.7

  Wireshark versions 4.6.0 through 4.6.6 contain a flaw in how they parse pcapng packet capture files. A malformed pcapng file can cause Wireshark to crash, denying service to users who open the file. An attacker would need to trick a user into opening a specially crafted pcapng file, but requires no special privileges and the attack leaves no data integrity or confidentiality impact—only availability is affected.

• CVE-2026-2827MEDIUM 4.7

  The Open User Map PRO WordPress plugin contains a security flaw that allows attackers to inject malicious scripts into website pages. An unauthenticated attacker can exploit insufficient input validation in the 'oum_location_notification' parameter to store harmful code that executes whenever site visitors view an affected page. This stored cross-site scripting (XSS) vulnerability affects all versions up to and including 1.4.31.

• CVE-2026-3602MEDIUM 4.7

  IBM App Connect Enterprise and Integration Bus contain a SQL injection vulnerability that could allow a remote attacker to trick users into inadvertently creating files on their systems. While the attack requires user interaction and operates with local system access constraints, successful exploitation could result in unauthorized file creation or modification. The vulnerability affects multiple versions across IBM's integration middleware stack.

• CVE-2026-41991MEDIUM 4.7

  GNU gzip's gzexe utility has a flaw in how it creates temporary files when the mktemp utility is unavailable. Instead of using a secure method, it generates predictable temporary filenames based on the process ID (PID) alone. A local attacker can exploit this by creating a symbolic link at the predicted filename pointing to any file the victim can write to. When gzexe runs and follows that symlink, it overwrites the target file—giving an attacker a way to corrupt or modify files belonging to the user running gzexe.

• CVE-2026-42329MEDIUM 4.7

  Iris, a web platform used by incident responders to collaborate and share technical details during security investigations, contains an open redirect vulnerability in versions before 2.4.28. An attacker can craft a malicious link within the application that tricks users into visiting an external website under the attacker's control. This is a social engineering risk rather than a direct system compromise—the attack depends on user interaction and targets the trust users place in links shared within their incident response platform.

• CVE-2026-43743MEDIUM 4.7

  CVE-2026-43743 is a race condition affecting Apple's operating systems that can cause an application to unexpectedly crash or terminate the system. The vulnerability requires an attacker to already have code execution on the device (local access) and involves a timing-sensitive flaw in how the operating system handles concurrent operations. While the impact is limited to availability—the system can be made to crash—the fix is straightforward through standard OS updates.

• CVE-2026-44587MEDIUM 4.7

  CarrierWave, a popular Ruby file-upload framework, contains a flaw in its content-type blocking mechanism that silently fails to prevent dangerous uploads. When developers configure a denylist to block file types—most commonly SVG files to prevent stored cross-site scripting (XSS)—the framework inadvertently allows those exact files through due to improper handling of special characters in the filter rules. An attacker can exploit this to upload malicious SVG files containing embedded JavaScript that executes in users' browsers when served by the application, resulting in account compromise or data theft.

• CVE-2026-44757MEDIUM 4.7

  SAP Wily Introscope Enterprise Manager contains a cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious code into a specially crafted URL. When a legitimate user visits that URL, the attacker's script runs in their browser under the application's security context. This could expose sensitive session data or allow the attacker to perform actions on behalf of the victim. The vulnerability requires the attacker to trick a user into clicking a link, and carries a CVSS 4.7 (Medium) severity rating.

• CVE-2026-45366MEDIUM 4.7

  The @utcp/http package in typescript-utcp contains a blind Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to trick the software into making requests to internal services. The flaw stems from inconsistent validation: while manual URL registration checks that URLs are HTTPS or localhost, the tool invocation pathway skips this validation and directly uses URLs from attacker-controlled OpenAPI specifications. An attacker can host a malicious OpenAPI spec on a legitimate HTTPS endpoint that declares internal server addresses (like http://127.0.0.1:9090 or AWS metadata endpoints), and the affected software will create tools that point to those internal targets. Versions prior to 1.1.2 are vulnerable.

• CVE-2026-45460MEDIUM 4.7

  A buffer over-read vulnerability in Microsoft Office could allow an attacker to read sensitive information from a user's computer. The attacker would need to trick a user into opening a specially crafted Office document, but once triggered, the flaw could expose data in memory that shouldn't be accessible. This is a local-only issue affecting the person using the Office application, not a remote attack vector.

• CVE-2026-45614MEDIUM 4.7

  OP-TEE, a Trusted Execution Environment for Arm systems, fails to validate that ECDH public keys lie on the correct elliptic curve before deriving shared secrets. An attacker with local access can craft approximately 30-40 malformed public keys and submit them through TEE_DeriveKey calls to leak fragments of the private key. By collecting these leaks and applying the Chinese Remainder Theorem, the attacker can reconstruct the full private key. This breaks the confidentiality of ECDH operations and affects systems relying on OP-TEE for cryptographic operations prior to version 4.11.0.

• CVE-2026-46159MEDIUM 4.7

  A race condition in the Linux kernel's btrfs filesystem driver can leak uninitialized kernel memory to unprivileged local users. The vulnerability exists in the ioctl handler that reports storage space information. When block groups are concurrently removed by the system during the space query operation, the kernel copies more data to userspace than it actually wrote, exposing sensitive kernel memory. An attacker with local access can exploit this timing window to read information that should not be accessible.

• CVE-2026-46187MEDIUM 4.7

  The Linux kernel's RSI wireless driver has a race condition in how it shuts down worker threads. The driver uses two different methods to stop these threads: a self-terminating approach and an external stop command. When the self-terminating method completes first and then the external stop is called, the code tries to access a thread that has already been freed from memory—a use-after-free vulnerability. This affects local users with moderate privileges and can cause a system crash or unexpected behavior.

• CVE-2026-46194MEDIUM 4.7

  A race condition exists in the Linux kernel's F2FS file system implementation that can cause a kernel crash. When an inode is being dropped from memory, the extent node destruction process does not properly signal that no new extent nodes should be added. Meanwhile, concurrent write-back operations may attempt to insert new extent nodes, creating a collision that triggers a kernel bug check. The vulnerability affects systems using F2FS, particularly in multi-threaded I/O scenarios where inode cleanup and write-back operations overlap.

• CVE-2026-46272MEDIUM 4.7

  CVE-2026-46272 is a race condition in the Linux kernel's CoreSight Trace Memory Controller (TMC) Embedded Trace Receiver (ETR) driver. When a system attempts to run both performance tracing (perf) and sysfs-based hardware tracing simultaneously, a timing gap between buffer allocation and hardware enablement in sysfs mode allows the perf mode to initialize its own buffer state. This causes sysfs mode to later detect the unexpected state and trigger a kernel warning, resulting in denial of service through system instability. The vulnerability exists because the sysfs enablement process was split across two separate locking regions, creating a window where perf mode could intervene.

• CVE-2026-46298MEDIUM 4.7

  A race condition exists in the Linux kernel's PAPR HVPIPE driver that can cause a system deadlock. The vulnerability occurs when an interrupt fires on the same CPU while the driver's ioctl or release handlers are executing. If both try to acquire the same lock simultaneously, the system can become unresponsive. The issue is resolved by using interrupt-safe lock primitives that prevent interrupts from firing during critical sections, eliminating the deadlock scenario. This is primarily a local denial of service affecting systems running vulnerable kernel versions.

• CVE-2026-46772MEDIUM 4.7

  Oracle's Application Development Framework (ADF), a core component of Fusion Middleware, contains a privilege-escalation vulnerability affecting versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with high-level administrative access and direct infrastructure access could exploit insufficient privilege controls to read sensitive application data or modify certain records. The attack is not trivial—it requires both elevated credentials and specific configuration conditions—but poses meaningful risk to organizations running vulnerable ADF instances, particularly those handling sensitive business data through ADF-based applications.

• CVE-2026-48733MEDIUM 4.7

  ImageMagick, widely used for image editing and manipulation across web applications and server environments, contains a flaw that can trigger an infinite loop when processing specially crafted images during subimage-search operations. An attacker who tricks a user into opening a malicious image file can cause the application to hang indefinitely, disrupting availability. This is not a memory corruption or data theft vulnerability, but a denial-of-service condition that freezes the process.

• CVE-2026-48984MEDIUM 4.7

  pam_usb is a Linux authentication tool that uses removable media (like USB drives) as a hardware security key. A flaw in versions 0.9.1 and earlier leaves sensitive authentication data—specifically one-time pad values—sitting in freed memory instead of securely erasing it. If an attacker gains local access and can inspect heap memory (either through a use-after-free bug or memory inspection tools), they could potentially recover these pad values and bypass authentication. The issue affects the central memory deallocation function, which should be clearing sensitive buffers before releasing them.

• CVE-2026-48986MEDIUM 4.7

  pam_usb is a Linux authentication module that lets users log in using USB devices as hardware tokens. A bug in version 0.9.1 and earlier can cause the authentication process to hang indefinitely if a parent process terminates during login. When this happens, the sudo, sshd, or login process becomes unresponsive and must be manually killed. This is a denial-of-service vulnerability that affects systems using pam_usb for authentication. The issue stems from improper error handling in the code that walks up the process tree to verify the authenticating process. Upgrading to version 0.9.2 or later resolves the problem.

• CVE-2026-49043MEDIUM 4.7

  WP Migrate Lite, a WordPress plugin for site migration tasks, contains a CSRF vulnerability affecting versions 2.7.8 and earlier. The flaw allows attackers to trick authenticated WordPress users into performing unintended actions without their knowledge or consent—such as initiating a migration, modifying plugin settings, or exporting site data. The attacker crafts a malicious webpage or email and waits for an admin or privileged user to visit it while logged into their WordPress site. No direct attack on the website itself is required; the vulnerability exploits the trust relationship between the user and the WordPress site.

• CVE-2026-50267MEDIUM 4.7

  Steeltoe, a .NET library for building cloud-native applications, inadvertently exposes database credentials to other processes on the same Linux container. When applications configure MySQL or PostgreSQL connections through Cloud Foundry service bindings, Steeltoe temporarily stores TLS client credentials in world-readable files in the system temp directory. These files are never cleaned up, leaving sensitive key material accessible to any other user or process on the same machine. The vulnerability affects Steeltoe.Configuration.Abstractions versions 4.0.0 through 4.1.0 and is resolved in version 4.2.0.

• CVE-2026-52902MEDIUM 4.7

  CVE-2026-52902 is a path traversal flaw in awxkit, the command-line interface for Red Hat's AWX automation platform. When a user imports a specially crafted YAML configuration file using the "awx --conf.format yaml import" command, an attacker can trick awxkit into reading arbitrary YAML files from the victim's local system. The vulnerability stems from insufficient validation of file paths in the YAML !include directive. This is fundamentally a client-side attack requiring the user to knowingly or unknowingly process a malicious YAML file, making social engineering a prerequisite for exploitation.

• CVE-2026-53008MEDIUM 4.7

  A race condition exists in the Linux kernel's ice driver that can cause a system crash when one CPU is cleaning up TX timestamp resources while another CPU is actively using them. The vulnerability occurs because pointer cleanup and flag clearing happen in the wrong order, allowing a concurrent operation to dereference a NULL pointer. The impact is limited to systems with the ice driver loaded and TX timestamping enabled, and requires local access to trigger.

• CVE-2026-53108MEDIUM 4.7

  A race condition exists in the Linux kernel's memory management on PowerPC 64-bit systems that can trigger a kernel crash (panic) when two processes simultaneously attempt incompatible operations on the same memory pages. Specifically, when one process moves memory pages between NUMA nodes using move_pages() while another process unmaps that memory via munmap(), the kernel can encounter an assertion failure. The vulnerability requires local access and moderate effort to trigger, but results in a denial of service affecting system availability.

• CVE-2026-53352MEDIUM 4.7

  CVE-2026-53352 is a race condition in the Linux kernel's signal handling code. When a multi-threaded process receives a stop signal and one thread calls execve() simultaneously, the kernel fails to properly clean up job control flags on the calling thread. This leaves stale signal state that causes the thread to attempt an invalid operation when returning to user mode, triggering a kernel warning. The vulnerability requires local access and specific timing, but can crash or destabilize the kernel.

• CVE-2026-54106MEDIUM 4.7

  The U.S. Government Accountability Office (GAO) operates two critical federal docketing systems—the Electronic Protest Docketing System (EPDS) and the Civilian Board of Contract Appeals Electronic Docketing System (EDS)—that process sensitive government contract disputes. Both systems fail to properly validate the X-Forwarded-For HTTP header, a field that applications often use to identify the true client IP address in proxy or load-balancer scenarios. An attacker who has already compromised administrator credentials can abuse this validation gap to bypass network-level access controls and successfully authenticate. This is a privilege abuse scenario rather than an unauthenticated attack: the adversary needs valid admin credentials but can then circumvent IP-based restrictions that might otherwise limit where those credentials can be used.

• CVE-2026-54344MEDIUM 4.7

  ToolJet is an open-source low-code platform used to build internal business tools. A vulnerability in versions prior to 3.20.180 allows unauthorized command execution on CI/CD runners through GitHub pull request comments. Any user with the ability to comment on an open pull request can inject shell commands by crafting a comment with a deploy command, potentially extracting sensitive deployment credentials stored in the CI environment. The flaw stems from unsafe interpolation of user-controlled input directly into bash conditionals without sanitization.

• CVE-2026-55595MEDIUM 4.7

  ImageMagick, a widely used image processing tool, contains a flaw that causes it to enter an infinite loop when given malformed input to its connected-components feature. An attacker could exploit this by crafting a specially formed image file or command that triggers the loop, effectively freezing the application and making it unavailable until forcibly stopped. The issue affects ImageMagick versions prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch).

• CVE-2026-56117MEDIUM 4.7

  dhcpcd, a widely deployed DHCP client daemon, contains a memory safety bug that can crash the service when privilege separation is disabled. A local user on the same system can exploit this by sending a specially crafted command to dhcpcd's control socket, causing the daemon to reference memory it has already freed. While the vulnerability requires local access and a specific configuration, it represents a denial-of-service risk in environments where dhcpcd runs with privilege separation turned off—a configuration sometimes found in embedded systems or minimal deployments.

• CVE-2026-56332MEDIUM 4.7

  Capgo before version 12.128.2 contains a flaw that allows attackers to redirect users to malicious websites during the signup confirmation process. An attacker can craft a deceptive confirmation link that appears legitimate but directs victims to an attacker-controlled site, where they might be tricked into entering credentials or downloading malware. The vulnerability requires user interaction—victims must click the malicious link—but poses a real phishing risk, especially if distributed through email or messaging channels.

• CVE-2026-57031MEDIUM 4.7

  Juniper Networks has disclosed a vulnerability in Junos OS that affects MX Series routers when subscribers are configured on static interfaces. The issue causes the packet forwarding engine to skip security checks on incoming traffic, meaning configured firewall filters don't work as intended. This creates a window where adjacent network subscribers—those directly connected to the affected device—can send traffic that bypasses the firewall rules you've put in place. The vulnerability does not provide confidentiality risk, but allows policy violation through integrity compromise, and affects multiple recent versions of Junos OS across several hardware variants.

• CVE-2026-57957MEDIUM 4.7

  Papermark versions through 0.22.0 have a cross-origin request forgery (CSRF) vulnerability in their file upload endpoint. The vulnerability stems from improper handling of cross-origin requests: the application reflects whatever origin a request claims to come from and allows credentialed requests from that origin. This means an attacker can trick authenticated Papermark users into visiting a malicious webpage that silently uploads files into the victim's datarooms or extracts sensitive information—all without the victim's knowledge or consent. The attacker never needs valid credentials themselves; they exploit the victim's existing session.

• CVE-2026-59883MEDIUM 4.7

  Guzzle, a widely-used PHP HTTP client library, contains a cookie-handling flaw that can allow attackers to leak cookies between different hosts or inject cookies into requests. The vulnerability exists in how Guzzle's CookieJar component validates which domains a cookie belongs to. When a cookie is scoped to an IP address (like 192.168.0.1 or ::1) or a bare numeric value, Guzzle incorrectly applies standard domain suffix matching rules instead of requiring an exact match. This means a cookie set for one IP could be sent to a different IP on the same network, or a cookie meant for one host could be injected into requests to another. The issue affects Guzzle versions prior to 7.12.3 and requires user interaction to exploit (such as visiting a malicious page), but can impact any application using vulnerable Guzzle versions.

• CVE-2026-59947MEDIUM 4.7

  Composer, PHP's widely-used package manager, leaks authentication credentials in debug output under specific circumstances. When developers run Composer with the highest verbosity flag (-vvv), credentials embedded in repository URLs—such as GitHub Personal Access Tokens—can be exposed in logs or terminal output. This happens because Composer's credential sanitization functions fail to strip credentials from certain URL formats, specifically when the token appears in the username portion of the URL. The vulnerability affects Composer versions prior to 2.2.29 and 2.10.2.

• CVE-2022-44630MEDIUM 4.6

  A cross-site request forgery (CSRF) vulnerability exists in the YITH WooCommerce Product Slider Carousel plugin for WordPress. The flaw allows an attacker to trick an authenticated administrator into performing unwanted actions on the plugin without their knowledge—such as modifying carousel settings or configurations—by embedding malicious requests in a webpage the admin visits. The vulnerability affects all versions through 1.16.0.

• CVE-2026-10642MEDIUM 4.6

  The Zephyr RTOS PL011 UART driver contains a loop that can spin indefinitely when hardware flow control (CTS) is enabled and the connected device stops asserting the CTS signal during data transmission. When this happens, the thread attempting to send data hangs, freezing the entire execution context and breaking serial communication—typically affecting Bluetooth HCI and other serial-dependent subsystems. An attacker with physical or adjacent access to the CTS line (such as by controlling an external Bluetooth module) can trigger this denial of service. Versions 4.1.0 through 4.4.0 are affected; patched releases address the issue by checking CTS status and using the modem-status interrupt to resume when CTS recovers.

• CVE-2026-10656MEDIUM 4.6

  A USB device driver in Zephyr crashes when a USB host performs a legitimate control-transfer abort. The MAX32 USB device controller driver fails to check whether a buffer exists before trying to use it in interrupt handlers. A USB host can trigger this by sending a new SETUP packet to interrupt an in-flight control transfer—standard USB behavior. The result is a device crash (denial of service). No special privileges or authentication are required; physical USB bus access is sufficient. The flaw affects Zephyr v4.4.0 and later versions of the MAX32 UDC driver until patched.

• CVE-2026-10834MEDIUM 4.6

  The WP Travel Engine WordPress plugin contains a vulnerability in versions before 6.8.1 that allows logged-in users with basic subscriber permissions to move any file from the WordPress media library into their profile image directory. When a file is moved this way, it disappears from its original location, potentially breaking content that depends on it—such as images in blog posts, pages, or other media-dependent features. The vulnerability requires user interaction (a click or action by the attacker) and only affects the integrity and availability of media files, not confidentiality.

• CVE-2026-11443MEDIUM 4.6

  Allegra contains a cross-site scripting (XSS) vulnerability in its downloadAttachment method that allows attackers to inject malicious scripts. An authenticated user must be tricked into visiting a malicious page or opening a malicious file to trigger the attack. Once executed, the injected script runs with the privileges of the logged-in user, potentially allowing access to sensitive information or account compromise.

• CVE-2026-13808MEDIUM 4.6

  Google Chrome on iOS versions before 150.0.7871.47 contain a flaw in how the browser validates user-supplied data, allowing someone with physical access to an iOS device to extract sensitive information from the browser's memory. This is a local-only attack that requires hands-on device access, but the potential exposure of sensitive data makes it worth patching promptly.

• CVE-2026-33462MEDIUM 4.6

  A path traversal flaw in Kibana's dashboard management allows an authenticated user with basic permissions to craft a malicious dashboard identifier. When an administrator deletes this dashboard, the deletion request bypasses security controls and targets unintended internal endpoints—potentially destroying user accounts or other critical resources. The vulnerability requires an administrator to take action on the malicious object, making it a privilege-escalation path rather than a self-executing exploit.

• CVE-2026-34096MEDIUM 4.6

  CVE-2026-34096 is a reflected cross-site scripting (XSS) vulnerability in Guardian's language-system component. The flaw exists in the designer.php file, where user-supplied input via the 'name' GET parameter is inserted directly into an HTML input field without proper sanitization. An authenticated user can exploit this by crafting a malicious URL containing script tags; when a victim visits that URL, the injected script executes in their browser within the security context of their authenticated session. This allows an attacker to steal session tokens, modify page content, or perform actions on behalf of the victim.

• CVE-2026-34097MEDIUM 4.6

  Guardian language-system contains a cross-site scripting (XSS) vulnerability in its text_file.php component where user-controlled input is not properly validated before being placed into HTML form attributes. An authenticated user can manipulate the 'id' parameter to inject malicious scripts that execute within another user's browser session, potentially compromising their account or session data.

• CVE-2026-34098MEDIUM 4.6

  CVE-2026-34098 is a stored cross-site scripting (XSS) vulnerability in Guardian language-system's media.php file. An authenticated user can inject malicious script code through the 'id' GET parameter, which gets embedded directly into the HTML page without proper sanitization. When another user visits the crafted URL, the injected script executes in their browser with their session privileges. This requires an attacker to already have login credentials and victim interaction (clicking a malicious link), limiting the attack surface but posing a real risk in multi-user environments.

• CVE-2026-36174MEDIUM 4.6

  GNCC GP5 devices running version 7.1.76 transmit sensitive wireless network credentials in readable form to the serial console during normal operation. An attacker with physical access to the device's serial port can intercept these credentials, compromising network security. This is a localized but consequential exposure for organizations operating these devices in shared or less-controlled physical environments.

• CVE-2026-36178MEDIUM 4.6

  A flaw in the factory reset process of GNCC GP5 v7.1.76 leaves sensitive cryptographic keys and related data intact on the device's storage partition even after a factory reset is performed. An attacker with physical access to the device could potentially recover this material and use it to decrypt or impersonate the original user's configuration and encrypted content.

• CVE-2026-36180MEDIUM 4.6

  GNCC GP5 version 7.1.76 has a security weakness that allows an attacker with physical access to the machine to temporarily modify read-only system files and binaries during a single boot session. The vulnerability exploits bind-mount mechanisms—a Linux/Unix filesystem technique—to circumvent protections meant to keep critical system files locked down. While the attacker needs to be physically present and the changes only persist until reboot, this represents a meaningful integrity risk for systems in shared, controlled, or potentially hostile physical environments.

• CVE-2026-38571MEDIUM 4.6

  The Tenda N300 F3 router (V603 firmware) stores Wi-Fi security passwords in plain text and allows anyone with physical access to the device's serial port to read them without any authentication. The same serial console also permits attackers to read or write data directly to the device's memory, potentially compromising the router's operation or extracting additional sensitive information. This is a physically proximate attack—the attacker must be able to connect a cable to the device—but requires no special knowledge or authentication once connected.

• CVE-2026-45106MEDIUM 4.6

  Weblate, a collaborative localization and translation platform, contains a stored cross-site scripting (XSS) vulnerability in its live search preview feature. Before version 2026.5, the tool failed to sanitize HTML and CSS content entered into source fields and context fields by contributors. When another user performs a search that matches this malicious content, the unescaped HTML and CSS executes in their browser within the authenticated Weblate editor environment. Any authenticated user can inject this payload, making it a contributor-level threat that persists and affects all users who trigger the matching search.

• CVE-2026-45153MEDIUM 4.6

  Nextcloud Files app on Android has a PIN bypass vulnerability affecting versions 33.0.0 through 33.0.x. An attacker with physical access to an unlocked Android device can use the back button to circumvent the app's PIN protection and gain unauthorized access to files stored in the Nextcloud app. This is a local attack requiring the device to already be unlocked, but it effectively neutralizes the app-level security control that would normally protect sensitive files even if the phone falls into the wrong hands.

• CVE-2026-45284MEDIUM 4.6

  Nextcloud's OIDC (OpenID Connect) user authentication module contains a flaw that allows deleted LDAP users to continue authenticating to the system. When an organization uses both LDAP and OIDC for user management, deletion of a user from LDAP does not properly prevent that user from logging in via OIDC. This creates an unintended persistence of access for users who should no longer have system privileges. The issue affects Nextcloud versions 1.3.6 through 8.3.x and has been resolved in version 8.4.0.

• CVE-2026-45462MEDIUM 4.6

  CVE-2026-45462 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an authorized user to inject malicious scripts into web pages. When other users view the affected page, the script executes in their browser, potentially allowing the attacker to steal session data, redirect users, or impersonate trusted content. The vulnerability requires an authenticated attacker and user interaction (such as clicking a link), limiting its blast radius but making it a meaningful concern for organizations where SharePoint access is broadly distributed.

• CVE-2026-45467MEDIUM 4.6

  CVE-2026-45467 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint that allows an authenticated user to inject malicious scripts into web pages. When another user views the compromised page, the script executes in their browser, potentially allowing the attacker to steal credentials, manipulate content they see, or impersonate the attacker. The vulnerability requires an authorized SharePoint user to set it up and a victim to click or view the malicious content, limiting its reach but making it effective in insider threat scenarios.

• CVE-2026-45468MEDIUM 4.6

  CVE-2026-45468 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an authenticated user to inject malicious scripts into web pages. When a victim views the compromised page, the attacker can steal sensitive information or impersonate the victim within SharePoint. The vulnerability requires an authorized account to exploit and user interaction to trigger, making it moderate in severity but still a genuine risk in environments where SharePoint users have elevated privileges or access to sensitive data.