2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 35 of 41

• CVE-2025-32748MEDIUM 4.3

  Dell PowerFlex Manager versions before 5.1.0.1 contain a host header injection flaw that allows unauthenticated attackers with network access to craft malicious requests. By manipulating the HTTP Host header, an attacker can cause the application to redirect users to arbitrary external websites, potentially in service of phishing or social engineering campaigns. No authentication is required to trigger the vulnerability, but successful exploitation requires user interaction—the victim must follow the malicious redirect.

• CVE-2025-36319MEDIUM 4.3

  IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 contain a denial-of-service vulnerability accessible to authenticated users. An attacker with valid credentials can send a specially crafted HTTP request that exploits improper resource throttling controls, temporarily disrupting service availability. The vulnerability does not compromise confidentiality or integrity—only availability is at risk.

• CVE-2025-36324MEDIUM 4.3

  IBM watsonx.data intelligence contains a server-side request forgery (SSRF) vulnerability that allows authenticated users to make unauthorized requests from the affected system. An attacker with valid credentials could potentially probe internal network resources, discover services running on the local network, or use the compromised system as a pivot point for further attacks. The vulnerability affects versions 5.2.0 through 5.3.0.

• CVE-2025-36328MEDIUM 4.3

  IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 leak sensitive information through verbose error messages displayed in web browsers. An attacker with valid credentials can trigger these detailed error responses to extract system details that could facilitate further attacks. This is an information disclosure vulnerability requiring authentication to exploit.

• CVE-2025-36333MEDIUM 4.3

  IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 contain a flaw that allows authenticated users to bypass intended workflow restrictions and perform actions they should not be permitted to execute. An attacker with valid credentials could exploit this to make unauthorized changes within the platform, though the vulnerability does not enable data theft or system unavailability. The issue stems from inadequate enforcement of behavioral workflow controls during user action validation.

• CVE-2025-48571MEDIUM 4.3

  A logic error in Android's Bluetooth management code (btm_sec.cc) creates a window where attackers can intercept incoming SMS messages. An attacker on the network could exploit this to read message content without needing special device permissions, but requires user interaction to succeed—for instance, the user must be engaged in a Bluetooth operation when the interception occurs. The vulnerability carries medium severity; while SMS interception is serious, the requirement for user interaction and network proximity limits the attack surface.

• CVE-2025-52606MEDIUM 4.3

  HCL iControl contains a weakness in how it validates user input during its security architecture implementation. The application fails to properly check that incoming data matches the expected type before processing it, allowing an authenticated attacker to submit malformed input that the system does not adequately verify. This can lead to unintended modifications of application state or data.

• CVE-2025-53346MEDIUM 4.3

  CVE-2025-53346 is a missing authorization flaw in ThimPress Thim Core that allows authenticated users to modify data or settings they should not have access to. The vulnerability stems from inadequate access control checks, meaning the application fails to properly verify whether a logged-in user has permission to perform specific actions. While an attacker must already have valid login credentials, the weakness could allow them to escalate privileges or tamper with configuration or content outside their intended scope.

• CVE-2025-59872MEDIUM 4.3

  HCL ZIE for Web contains a file upload vulnerability that allows authenticated users to upload files without proper restrictions. If the server is configured to execute code—a common default in web environments—an attacker could upload a malicious script (web shell) to gain remote command execution. The vulnerability requires an authenticated account and depends on server configuration, which limits its immediate risk but makes it a serious concern in environments where these conditions are met.

• CVE-2025-63078MEDIUM 4.3

  Restaurant Menu by MotoPress versions 2.4.11 and earlier contain a broken access control vulnerability that allows authenticated subscribers to modify menu data they should not have permission to access. An attacker with a subscriber account can change restaurant menu information without proper authorization checks, potentially altering prices, descriptions, or availability of menu items. This is a localized privilege escalation issue affecting the restaurant management functionality of the plugin.

• CVE-2025-63079MEDIUM 4.3

  The Live Copy Paste plugin for Elementor contains an access control flaw that allows contributors—users with limited editing privileges—to perform actions they should not be authorized to perform. The vulnerability affects versions 1.5.3 and earlier. While the impact is limited to information disclosure and does not enable privilege escalation or system compromise, it represents a meaningful security boundary violation in WordPress environments where contributor access is intentionally restricted.

• CVE-2025-71379MEDIUM 4.3

  vLLM, a popular open-source large language model serving framework, contains multiple regular expression parsing flaws that can be exploited to cause denial of service. Versions 0.6.3 through 0.9.0 are affected. An authenticated attacker can craft specially formatted input—containing nested or repeated structures—that causes the regex engine to consume excessive CPU, degrading or halting service availability. The vulnerability exists in multiple code paths: LoRA utility parsing, a phi4mini tool parser, and the OpenAI-compatible chat API endpoint.

• CVE-2026-0140MEDIUM 4.3

  CVE-2026-0140 is a remote information disclosure vulnerability in Android's RTP (Real-time Transport Protocol) packet handling. An integer overflow in the RtpPacket::decodePacket function allows an attacker to read data beyond intended memory boundaries when processing specially crafted RTP packets. The flaw requires user interaction—such as receiving and processing a malicious RTP stream—but does not need special privileges. An attacker could potentially extract sensitive information from device memory without executing code.

• CVE-2026-0141MEDIUM 4.3

  A flaw in Android's RTCP application packet handling allows an authenticated attacker to read sensitive data from device memory without triggering a system crash or requiring user interaction. An attacker with network access and valid credentials can craft a malformed packet that bypasses a bounds check, exposing information that could be used in further attacks. This is a classic information disclosure vulnerability—the attacker cannot modify or delete data, but they can peek at what should remain hidden.

• CVE-2026-0155MEDIUM 4.3

  CVE-2026-0155 is a memory reading vulnerability in Google Android's ImsMediaBitReader component. An attacker with basic login access can trigger the code to read data outside intended memory boundaries, potentially exposing sensitive information. This does not require the victim to take any action and does not allow attackers to modify or crash the system—only to peek at unauthorized data in memory.

• CVE-2026-0157MEDIUM 4.3

  CVE-2026-0157 is a memory safety issue in Android's RTCP header processing that allows a logged-in attacker to read sensitive data from device memory without user action. The flaw exists in the RtcpHeader::decodeRtcpHeader function, which fails to validate data boundaries before reading, potentially exposing information like session keys, media content, or other in-memory secrets to a remote attacker with network access and valid credentials.

• CVE-2026-10023MEDIUM 4.3

  The Dokan multivendor marketplace plugin for WordPress contains a flaw that allows vendor-level users to manipulate orders they don't own. An authenticated vendor can change order statuses, inject fake notes and shipping tracking, or modify product download permissions on any marketplace order by reusing a valid security token from their own dashboard. This works because the plugin fails to verify that the vendor actually owns the order before performing the action.

• CVE-2026-10028MEDIUM 4.3

  CVE-2026-10028 is a denial-of-service vulnerability in glib-networking that can be triggered when an attacker presents a maliciously crafted certificate chain containing circular issuer relationships. When an application using glib-networking with GnuTLS backend processes such a chain, the certificate verification logic enters an infinite loop, consuming CPU resources until the process becomes unresponsive. The attack requires user interaction (such as visiting a malicious website or accepting a connection) and affects only the targeted process, not the wider system.

• CVE-2026-10038MEDIUM 4.3

  The Charitable donation plugin for WordPress contains a flaw that allows authenticated users with basic subscriber permissions to delete any attachment from a site's Media Library. The vulnerability exploits a two-step process: attackers first poison the stored avatar metadata with a target attachment ID, then trigger normal avatar upload functionality to delete it. While this requires login access, the low privilege level needed and straightforward execution method make it a practical risk for any WordPress site running this plugin where subscriber-level registration is enabled.

• CVE-2026-10096MEDIUM 4.3

  The Qi Blocks WordPress plugin contains a flaw that allows authenticated users with author-level permissions to modify styling and appearance of posts, pages, and site-wide templates they don't own. An author could deface content, hide text, or alter the visual presentation of any page on a WordPress site without owning or having permission to edit that content. The vulnerability stems from the plugin failing to verify that a user actually owns the post before allowing style changes.

• CVE-2026-10113MEDIUM 4.3

  Open5GS, an open-source 5G core network software suite, contains a vulnerability in its Shared NF-profile Parser component that can be exploited to disrupt service availability. An attacker with network access and valid authentication credentials can trigger a denial of service condition by manipulating the NF-profile parsing logic. The vulnerability affects Open5GS versions up to 2.7.7, and public exploit information is available, increasing the risk of active exploitation.

• CVE-2026-10114MEDIUM 4.3

  Open5GS versions up to 2.7.7 contain a flaw in how they parse shared NF profile information. When processing certain malformed input, the application writes data beyond the intended memory boundary, potentially crashing the service. While an attacker must have valid network credentials to exploit this, the vulnerability has been publicly disclosed, increasing the likelihood it will be weaponized.

• CVE-2026-10115MEDIUM 4.3

  Open5GS, an open-source 5G core network implementation, contains a flaw in how it parses network function profiles. An authenticated attacker can send a specially crafted request that causes the affected service to become unresponsive, disrupting normal operations. The vulnerability requires valid credentials to exploit and does not lead to data theft or unauthorized access—only temporary unavailability. Versions up to 2.7.7 are affected.

• CVE-2026-10116MEDIUM 4.3

  A vulnerability in Open5GS, a popular open-source 5G core network implementation, allows authenticated users to trigger a denial-of-service condition by manipulating the UE authentication endpoint. The flaw resides in timer transaction handling code and can be exploited remotely by anyone with legitimate access to the authentication service. Public exploit code is available, increasing the practical risk of abuse.

• CVE-2026-10117MEDIUM 4.3

  Open5GS, an open-source 5G core network implementation, contains a vulnerability in its HTTP/2 server library that can be exploited to cause a denial of service. An attacker with valid credentials can remotely trigger the issue by manipulating specific inputs to the pool allocation function, causing the application to become unresponsive or crash. Versions up to 2.7.7 are affected. Public exploit code exists, increasing the risk of opportunistic attacks.

• CVE-2026-10153MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability has been identified in westboy CicadasCMS. The flaw exists in the Search function and can be exploited by manipulating a specific argument to inject malicious scripts. An attacker can send a crafted request to a vulnerable instance to execute arbitrary JavaScript in the context of other users' browsers, potentially stealing session data, credentials, or performing actions on their behalf. Exploitation requires user interaction (such as clicking a malicious link) but does not require authentication. A proof-of-concept has already been published, increasing practical risk.

• CVE-2026-10154MEDIUM 4.3

  Dolibarr ERP CRM versions 23.0.0, 23.0.1, and 23.0.2 contain an authorization bypass vulnerability in the user messaging module. An authenticated attacker can manipulate the ID parameter in htdocs/user/messaging.php to access or view information they should not have permission to see. The vulnerability requires valid login credentials but allows a logged-in user to circumvent access controls. Upgrading to version 23.0.3 resolves the issue.

• CVE-2026-10156MEDIUM 4.3

  Open5GS, a popular open-source 5G core network implementation, contains a denial-of-service vulnerability in versions up to 2.7.7. An authenticated attacker can manipulate how the system manages network function instance information, causing the application to consume excessive resources and become unresponsive. The vulnerability has been publicly disclosed, but a patch is already available. This is a moderate-severity issue requiring prioritization for 5G infrastructure operators and anyone running affected Open5GS deployments.

• CVE-2026-10173MEDIUM 4.3

  Orthanc Explorer 2 versions up to 1.12.0 contain a reflected cross-site scripting (XSS) vulnerability in the StudyList component. An attacker can craft a malicious URL with a specially crafted 'remote-source' parameter that, when visited by a user, executes arbitrary JavaScript in their browser within the context of the Orthanc application. This allows theft of session tokens, modification of data, or unauthorized actions performed on behalf of the victim. The vulnerability requires user interaction—a victim must click a malicious link—but can be exploited remotely without authentication.

• CVE-2026-10215MEDIUM 4.3

  A flaw in Dolibarr ERP CRM's Leave Request REST API fails to properly check whether users have permission to access specific leave request objects. An authenticated attacker can remotely exploit this to view leave data they should not be able to see. The vulnerability affects versions up to 23.0.1, and Dolibarr has released version 23.0.2 as a fix. Because the exploit has been publicly disclosed, this poses an active risk despite its moderate CVSS score.

• CVE-2026-10282MEDIUM 4.3

  Bottelet DaybydayCRM versions up to 2.2.1 contain an authorization flaw in the Documents controller that allows authenticated users to access files they shouldn't be able to view. An attacker with valid login credentials can exploit this remotely to read sensitive documents beyond their intended access scope. The vulnerability is rated MEDIUM severity and requires patching.

• CVE-2026-10289MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in Hotel and Tourism Reservation System version 1.0. An attacker can inject malicious scripts by manipulating parameters in the reservation form—specifically the name, email, people count, or booking number fields in the /ht/tour.php file. When a victim visits a crafted link or page, the injected script executes in their browser, potentially allowing session hijacking, credential theft, or defacement. Public exploits are available, increasing active exploitation risk.

• CVE-2026-10291MEDIUM 4.3

  Enderfga's claw-orchestrator contains a flaw in how it validates regular expressions in the Session Grep Endpoint. An authenticated attacker can supply a maliciously crafted regex pattern that forces excessive CPU consumption, potentially slowing or freezing the service. This is a medium-severity issue affecting versions up to 3.7.0 and is remedied by upgrading to 3.7.1.

• CVE-2026-10294MEDIUM 4.3

  PackageKit, a system library for package management on Linux, contains an authorization bypass vulnerability in versions up to 1.3.5. An authenticated attacker can manipulate the frontend-socket parameter in the API to gain unauthorized access to sensitive information. The vulnerability requires an existing user account to exploit but does not require user interaction. While the attack surface is somewhat limited by authentication requirements, the unauthorized information disclosure poses a real security concern for systems relying on PackageKit.

• CVE-2026-10301MEDIUM 4.3

  A reflected cross-site scripting (XSS) vulnerability exists in itsourcecode Fees Management System version 1.0. An attacker can craft a malicious URL containing JavaScript code in the 'page' parameter of index.php. When a user visits this link, the script executes in their browser, potentially allowing theft of session cookies, credential capture, or malware redirection. The vulnerability requires user interaction (clicking a link) but poses a meaningful risk to organizations running this system, especially those handling sensitive fee or financial data.

• CVE-2026-10552MEDIUM 4.3

  The Blue Captcha WordPress plugin, through version 2.0.1, is vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious link or webpage that, when clicked by a site administrator, silently uninstalls the plugin, deletes security audit logs, removes IP addresses from the Hall of Shame blocklist, or adds arbitrary IPs to the banned list—all without the administrator's knowledge or consent. The vulnerability exists because the plugin does not properly validate that requests originate from the legitimate administrator and are intentional.

• CVE-2026-10553MEDIUM 4.3

  The jQuery Hover Footnotes plugin for WordPress contains a flaw that allows attackers to trick site administrators into unknowingly changing plugin settings. When an admin clicks a malicious link, the attacker can alter how the plugin displays content—including injecting malicious code that affects every visitor to the site. The vulnerability chains two separate weaknesses: the ability to forge requests without verification, followed by the ability to inject unescaped code into pages.

• CVE-2026-10616MEDIUM 4.3

  GoClaw, a component of nextlevelbuilder, contains a flaw in how it validates permissions when completing team tasks. An authenticated attacker can manipulate the Team Task Completion Handler to bypass authorization checks, potentially modifying task records they shouldn't have access to. The vulnerability requires a valid login and network access, and affects versions up to 3.11.3. While the issue carries a medium risk profile, the public availability of exploit details increases practical attack likelihood.

• CVE-2026-10623MEDIUM 4.3

  A WordPress plugin used for creating quizzes and exams has a flaw that lets teachers with higher access levels modify or delete quiz rules set up by other teachers without permission. The vulnerability requires someone to be logged into WordPress with instructor-level access or above, so it's not an external threat, but it does enable insider abuse or lateral privilege misuse within an educational institution using the plugin.

• CVE-2026-10624MEDIUM 4.3

  CVE-2026-10624 is a moderate-severity vulnerability in SourceCodester Human Resource Management version 1.0 that allows authenticated users to access employee information they should not be able to view. The flaw exists in the Employee View Page component and stems from improper handling of the 'employeeid' parameter, which an attacker can manipulate to bypass access controls. Because exploit code has been publicly disclosed, this vulnerability poses a realistic risk to organizations running affected systems.

• CVE-2026-10661MEDIUM 4.3

  A vulnerability in the blender-mcp project allows an authenticated attacker to inject malicious input through the input_image_url parameter in the Open function of src/blender_mcp/server.py. Because authentication is required and the vulnerability only exposes limited information (not enabling code execution or system availability impact), the overall risk is moderate. However, the public disclosure means exploitation techniques are now accessible to threat actors.

• CVE-2026-10691MEDIUM 4.3

  A vulnerability in wonderwhy-er DesktopCommanderMCP through version 0.2.38 allows an authenticated user to trigger a denial-of-service condition by crafting malicious search result data that causes inefficient regular expression processing. The flaw is in the search-manager component and can be exploited remotely by any logged-in user. The vendor has released version 0.2.39 with a fix.

• CVE-2026-10692MEDIUM 4.3

  A flaw exists in code-index-mcp versions up to 2.14.0 that allows authenticated users to cause performance degradation through specially crafted regular expressions. By submitting a malicious regex pattern to the search_code_advanced function, an attacker can trigger inefficient regex processing that consumes excessive CPU resources, leading to application slowdown or unresponsiveness. This is a denial-of-service weakness that requires login credentials to exploit but does not compromise confidentiality or data integrity.

• CVE-2026-10702MEDIUM 4.3

  A flaw in Firefox's JavaScript Just-In-Time (JIT) compiler can cause it to miscompile code in certain circumstances. When a user visits a malicious website, the affected browser may crash or become unstable due to incorrect code generation during compilation. This is not a memory corruption issue and does not allow attackers to steal data or take control of the system, but it does impact availability and user experience.

• CVE-2026-10733MEDIUM 4.3

  GitLab CE and EE versions up to 18.10.7, 18.11.4, and 19.0.1 contain a flaw that allows authenticated users to crash the CI/CD Catalog page. An attacker with valid GitLab credentials can trigger improper input handling in the Catalog interface, causing the service to become temporarily unavailable for users accessing that feature. The vulnerability requires authentication, so external attackers cannot exploit it directly, but it poses a localized availability risk within your GitLab instance.

• CVE-2026-10779MEDIUM 4.3

  A vulnerability in the Classified Listing WordPress plugin (up to version 5.4.2) allows authenticated users with basic subscriber access to change the featured image of classified listings they don't own. The plugin fails to verify that a user actually owns a listing before accepting AJAX requests to update its featured image, relying instead on a nonce token that is publicly visible to all logged-in users. This enables attackers to deface or manipulate listings operated by other users, potentially damaging reputation or misleading potential buyers.

• CVE-2026-10780MEDIUM 4.3

  The Static Block plugin for WordPress has a flaw that allows authenticated contributors and higher-level users to read private and draft posts they shouldn't have access to. An attacker with a contributor account can craft a shortcode that retrieves any post by its ID and preview it, bypassing WordPress's normal permission checks. This affects all versions of the plugin through 2.2.

• CVE-2026-10787MEDIUM 4.3

  Devolutions Server contains a flaw in its API for managing deleted user groups that fails to properly check permissions. An authenticated user with low-level access can craft specific API requests to view metadata about deleted user groups they should not be able to see. The vulnerability requires an attacker to already have valid credentials, limiting the attack surface, but it does represent a breach of data compartmentalization within the system.

• CVE-2026-10802MEDIUM 4.3

  A resource consumption vulnerability exists in KeystoneJS, an open-source headless CMS and GraphQL API framework. The flaw resides in the GraphQL API endpoint handler and can be exploited by authenticated users to exhaust server resources, potentially causing a denial-of-service condition. The vulnerability affects KeystoneJS versions up to March 19, 2026. Exploitation requires valid credentials but can be performed remotely over the network.

• CVE-2026-10810MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in itsourcecode Fees Management System version 1.0 and earlier. The flaw is located in the /navbar.php file, where unsanitized input in the 'page' parameter allows an attacker to inject malicious scripts. An attacker can craft a malicious URL and trick a user into clicking it, causing the injected script to execute in the victim's browser. This could lead to session hijacking, credential theft, or malware distribution. Public exploit code is available, increasing the risk of opportunistic attacks.

• CVE-2026-10854MEDIUM 4.3

  CVE-2026-10854 is a visibility control flaw in MISP's event template creation feature that allowed unauthorized users to see private galaxy data from other organizations. When creating an event template, the system listed all enabled galaxies without checking whether the user's organization owned them or whether they were marked private. This exposed sensitive metadata like galaxy type and description to users who shouldn't have access. The vulnerability requires authentication to exploit and affects only information disclosure—no data modification or denial of service is possible. MISP has patched the issue by filtering galaxy visibility based on organization ownership and distribution settings.

• CVE-2026-10855MEDIUM 4.3

  MISP, a threat intelligence platform, contained an authorization flaw in its event template import feature. When an authenticated user attempted to overwrite an existing event template, the system verified that a template with that name existed but failed to check whether the importing user's organization actually owned it. This allowed users from one organization to forcibly overwrite event templates belonging to other organizations. The flaw only affected non-administrator users; site administrators retained the ability to manage templates across organizational boundaries by design. The vulnerability has been remediated by adding an ownership verification step before permitting any template overwrite operation.

• CVE-2026-10864MEDIUM 4.3

  A flaw in MISP's dashboard widgets allows authenticated users with low-level access to bypass field restrictions and view sensitive information they shouldn't have access to. By manipulating which data fields the New Users and New Organisations widgets display, attackers can circumvent settings designed to hide user email addresses and other restricted organization metadata. The vulnerability stems from how the application processes field filtering—if redaction leaves the field list empty, it falls back to returning unfiltered data instead of enforcing safe defaults.

• CVE-2026-11031MEDIUM 4.3

  Google Chrome's Password Manager fails to properly validate input from network traffic before displaying it to users. An attacker can craft malicious network data that tricks the Password Manager interface into showing fake or misleading information—for example, a phishing prompt that looks legitimate. This affects Chrome versions before 149.0.7827.53 on Windows, macOS, and Linux.

• CVE-2026-11062MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how it enforces policies on browser extensions. An attacker could create a malicious extension that, if installed by a user, would be able to inject malicious scripts or HTML code into sensitive browser pages. While the technical barrier is relatively low (it requires social engineering to trick a user into installing the extension), the impact is limited to tampering with page content rather than stealing data or causing system crashes.

• CVE-2026-11107MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles the Downloads feature that allows an attacker to trick users with a deceptive webpage. Specifically, an attacker could craft a malicious HTML page that, when viewed in an affected Chrome browser, would display fake or misleading interface elements to deceive users—a technique called UI spoofing. The vulnerability requires user interaction (visiting the malicious page) but does not compromise confidentiality or system availability; the primary risk is deception around the integrity of what the user sees on their screen.

• CVE-2026-11126MEDIUM 4.3

  A flaw in Google Chrome's Developer Tools (DevTools) allows an attacker to access data from different websites if they can trick a user into installing a malicious browser extension. The vulnerability has a CVSS score of 4.3 (Medium severity) and requires user interaction—specifically, the user must be convinced to install the malicious extension. Once installed, the crafted extension can exploit improper input validation in DevTools to leak cross-origin data that should normally be protected by browser security policies.

• CVE-2026-11155MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how CSS is processed that could allow an attacker to trick a user into visiting a malicious website where sensitive data from other sites (cross-origin data) could be leaked. The attack requires user interaction—specifically clicking a link or visiting a crafted page—but does not require the attacker to have special permissions or bypass other security controls. The leaked information would be visible only to the attacker, not modified or destroyed.

• CVE-2026-11156MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how it handles CSS styling rules that can allow an attacker to extract data from other websites you have open in your browser. An attacker would need to trick you into visiting a malicious webpage, and if successful could read sensitive information from other tabs or windows—such as content from your email, banking site, or other services—that you're simultaneously visiting. This is a cross-origin data leak vulnerability affecting the browser's CSS implementation.

• CVE-2026-11159MEDIUM 4.3

  A memory safety issue in Google Chrome's Skia graphics library allows attackers to steal data from websites you visit. By crafting a malicious HTML page, an attacker could trick your browser into exposing information that should remain private to other websites—a cross-origin data leak. The vulnerability requires user interaction (clicking or viewing the page) but doesn't require special browser settings or authentication. Google patched this in Chrome 149.0.7827.53 and later versions.

• CVE-2026-11161MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how it handles cross-origin data transfers. An attacker can craft a malicious HTML page that, when visited by a user, leaks sensitive information from websites the user is logged into or has visited. The vulnerability requires user interaction (clicking or visiting the page) but does not require special browser permissions or user sophistication to exploit.

• CVE-2026-11162MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how the browser handles CSS that can allow attackers to steal data from other websites. An attacker would need to trick a user into visiting a malicious webpage, but once there, the flawed CSS implementation could expose sensitive information from pages the user has open in other tabs or windows. The risk is limited to information disclosure—the vulnerability does not allow attackers to modify data or crash the browser.

• CVE-2026-11178MEDIUM 4.3

  A security gap in Chrome's WebView component on Android devices allows attackers to steal sensitive information from websites you visit. By tricking a user into opening a malicious webpage, an attacker can bypass Chrome's normal protections and read data that should be restricted to other websites. This affects Chrome versions before 149.0.7827.53. The vulnerability requires user interaction—someone must click a link or open a malicious page—but doesn't require special privileges or advanced technical setup.

• CVE-2026-11192MEDIUM 4.3

  Google Chrome's password manager has a flaw that fails to properly check information coming from the network. An attacker can exploit this by sending crafted network traffic to trick the browser's UI into displaying fake or misleading content—for example, mimicking legitimate login prompts or security warnings. The attacker cannot steal data or crash the browser, but they can manipulate what users see, potentially leading to credential theft or social engineering attacks if the spoofed interface convinces users to enter sensitive information.

• CVE-2026-11212MEDIUM 4.3

  A vulnerability in Google Chrome's developer tools (DevTools) fails to properly enforce security policies that should prevent extensions from accessing data across different websites. An attacker could trick a user into installing a malicious Chrome extension, which could then exploit this flaw to steal sensitive information from websites the user visits. The issue affects Chrome versions before 149.0.7827.53.

• CVE-2026-11216MEDIUM 4.3

  Google Chrome contains a flaw in how it displays security warnings for file input operations. An attacker can craft a malicious webpage that tricks users into performing specific mouse or keyboard actions—such as clicking or dragging—that trigger the file picker dialog. By manipulating the visual presentation of this dialog, the attacker can deceive the user about what action they're performing, potentially leading them to upload sensitive files or authorize unintended operations. This is a user-interaction vulnerability: it requires the attacker to convince the user to engage in the specific gestures, but once they do, the spoofed UI can create false impression of legitimacy.

• CVE-2026-11219MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser implements navigation controls. An attacker can craft a malicious HTML page that, when visited, bypasses intended navigation restrictions—essentially allowing the page to navigate the browser or access certain destinations in ways it shouldn't be able to. The attack requires user interaction (clicking or visiting the page), but no special browser privileges. While Chromium rates this as Low severity internally, the CVSS scoring reflects Medium severity due to the potential for integrity compromise through navigation spoofing.

• CVE-2026-11221MEDIUM 4.3

  A weakness in Google Chrome's PointerLock feature allows a threat actor who has already gained control of the browser's renderer process to deceive users through fake on-screen elements. The attacker would craft a malicious HTML page that tricks the browser into displaying misleading UI, potentially impersonating legitimate interface elements. This requires the renderer process to be compromised first, making it a secondary attack that typically follows another successful exploit.

• CVE-2026-11228MEDIUM 4.3

  Google Chrome before version 149.0.7827.53 contains a flaw in how it handles file input operations that allows attackers to deceive users through visual manipulation. If an attacker can trick a user into performing specific clicks or interactions on a malicious webpage, they can spoof the browser interface—making fake buttons, dialogs, or other UI elements appear legitimate. This is a social engineering attack that relies on user interaction; the vulnerability itself is in Chrome's file input implementation.

• CVE-2026-11234MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in the FoldableAPIs feature that allows a remote attacker to bypass site isolation—Chrome's core security boundary that separates web pages from each other—if the attacker has already compromised the renderer process. Site isolation is one of Chrome's strongest defenses against malicious websites stealing data from other tabs or extensions. This vulnerability requires both a compromised renderer and user interaction, limiting the immediate threat but warranting timely patching.

• CVE-2026-11245MEDIUM 4.3

  CVE-2026-11245 is a user interface spoofing vulnerability in Google Chrome's payment handling system. An attacker can craft a deceptive HTML page that tricks users into believing they are interacting with legitimate payment dialogs or security prompts, potentially leading to credential theft, social engineering, or other forms of user deception. The vulnerability requires user interaction (clicking or engaging with the malicious page) to be exploited, limiting its scope but not eliminating risk in realistic phishing or drive-by attack scenarios.

• CVE-2026-11252MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it enforces content policies that could allow an attacker to bypass certain access controls through a specially crafted web page. The vulnerability requires user interaction—an attacker would need to trick someone into visiting a malicious page—but does not leak sensitive data or crash the browser. Instead, it could allow unauthorized modification of content or settings the user intended to protect.

• CVE-2026-11253MEDIUM 4.3

  Google Chrome contained a flaw in how it handled permissions that could allow an attacker to trick users into visiting a specially crafted web page and leak data from other websites the user was visiting. The vulnerability requires user interaction (clicking or viewing a malicious page) and only affects data confidentiality, not system availability or integrity. Google has patched this in Chrome 149.0.7827.53 and later.

• CVE-2026-11254MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.53 contain a UI spoofing vulnerability in its permissions implementation. An attacker can craft a malicious HTML page that, when visited by a user, displays fake permission prompts or other interface elements to deceive users into granting access or performing unintended actions. The attack requires user interaction—specifically, the victim must visit the attacker's page—but does not require any special browser configuration or privilege level.

• CVE-2026-11257MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser implements navigation controls. An attacker can craft a malicious HTML page that, when visited by a user, bypasses the browser's built-in restrictions on where a page can navigate. This allows the attacker to redirect the user to unintended destinations or perform unwanted navigation actions, potentially leading to phishing, credential harvesting, or distribution of malware. The vulnerability requires user interaction (clicking or visiting the page) and affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11259MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Cast feature validates user-supplied input. This allows an attacker to craft a malicious webpage that, when visited, can bypass Chrome's same-origin policy—a critical security boundary that prevents websites from accessing data belonging to other sites. The attack requires user interaction (visiting the page) but requires no special privileges. While Chromium rates the underlying severity as Low, the ability to circumvent same-origin policy elevates practical risk.

• CVE-2026-11260MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles permissions that allows attackers to bypass the browser's Content Security Policy (CSP) protections via a specially crafted webpage. While the underlying browser vulnerability severity is rated as low, the CVSS assessment elevates this to medium risk because it requires user interaction but could enable an attacker to execute unintended behavior or inject content that CSP should block. The issue affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11261MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles PDF rendering that could allow an attacker to trick users into believing they're viewing legitimate content when they're not. If an attacker has already compromised Chrome's rendering engine (the component that displays web pages), they can craft a specially designed HTML page to perform UI spoofing—making fake buttons, warnings, or other interface elements appear authentic. This is a medium-severity issue because it requires both a prior compromise of the renderer process and user interaction to be exploited.

• CVE-2026-11264MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how Content Security Policy (CSP) is enforced. An attacker can craft a malicious HTML page that, when visited by a user, bypasses the browser's CSP protections. This allows the attacker to inject or execute content that the website owner intended to block, potentially leading to credential theft, session hijacking, or other attacks that degrade site security. The vulnerability requires user interaction—the victim must visit the malicious page—and does not directly compromise the browser itself or enable data exfiltration.

• CVE-2026-11266MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in the Safe Browsing feature that allows a remote attacker to bypass its protections by delivering a specially crafted file. An attacker would need to trick a user into opening or interacting with the malicious file, but if successful, the user's safety checks could be circumvented, potentially allowing access to sites or content that Safe Browsing would normally block.

• CVE-2026-11267MEDIUM 4.3

  A vulnerability in Google Chrome's extension framework allows a malicious extension to bypass content security policy (CSP) protections if a user installs it. The issue stems from insufficient policy enforcement mechanisms that fail to properly validate extension behavior. While the underlying Chromium severity is rated as Low, the CVSS assessment elevates it to Medium due to the user interaction requirement combined with potential integrity impact. An attacker would need to socially engineer a user into installing a compromised extension—a realistic but not trivial attack vector.

• CVE-2026-11274MEDIUM 4.3

  A flaw in Google Chrome's DOM Distiller component on iOS allows attackers to bypass navigation restrictions through a specially crafted web page. The vulnerability requires user interaction to trigger—specifically, the victim must visit or interact with a malicious page. The impact is limited to breaking navigation boundaries; no data theft or system crashes are involved. Chrome versions prior to 149.0.7827.53 on iOS are affected.

• CVE-2026-11277MEDIUM 4.3

  A vulnerability in Chrome for iOS allows an attacker to bypass certain access controls through a specially crafted HTML page. The issue stems from insufficient enforcement of security policies in the iOS version of Chrome. An attacker would need to trick a user into visiting a malicious webpage, but no special user privileges are required and the attack is straightforward to execute. The primary risk is unauthorized modification of data or application behavior—not data theft or system crashes.

• CVE-2026-11280MEDIUM 4.3

  A flaw in Google Chrome's sign-in interface on iOS allows an attacker to trick users with a fake login screen. By crafting a malicious web page, an attacker could make it appear that a legitimate Chrome sign-in prompt is appearing, potentially deceiving users into entering credentials or sensitive information. The vulnerability requires user interaction—visiting a crafted page—but does not require authentication or special privileges to attempt. While Google classifies this at low severity internally, the CVSS score reflects medium risk due to the integrity impact of potential credential theft or trust erosion.

• CVE-2026-11285MEDIUM 4.3

  Google Chrome on iOS versions before 149.0.7827.53 contain a flaw that allows attackers to trick users with fake, spoofed user interface elements embedded in malicious web pages. An attacker would need to convince a user to visit a crafted HTML page, but no special privileges are required and the attack can be delivered over the network. The vulnerability does not compromise data confidentiality or availability, but could deceive users about what they are viewing or interacting with.

• CVE-2026-11286MEDIUM 4.3

  A flaw in Google Chrome's Wallet component allows attackers who have already compromised a browser's renderer process to trick users with fake UI elements displayed on a web page. This requires the attacker to first gain control of the renderer—the part of the browser that displays web content—which is a significant prerequisite but not impossible in real-world scenarios where other vulnerabilities or social engineering may be chained together.

• CVE-2026-11291MEDIUM 4.3

  A flaw in how Google Chrome handles autofill on Android devices allows an attacker to craft a malicious webpage that can bypass the browser's same-origin policy protections. By tricking a user into visiting their page, an attacker could potentially manipulate how Chrome autofills data in unexpected ways. Google rates this as low severity internally, though the CVSS score reflects it as medium risk due to the user interaction required and limited scope of potential impact.

• CVE-2026-11292MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in the Blink rendering engine that allows attackers to bypass Content Security Policy (CSP) protections through a specially crafted webpage. An attacker would need to trick a user into visiting a malicious site, where the weakness could enable injection of unintended content or scripts that CSP was supposed to prevent. While Chromium rates this as low severity, the CVSS score reflects moderate impact potential because CSP bypass can lead to unauthorized modifications of page behavior.

• CVE-2026-11294MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in password handling that allows attackers to create fake or misleading login screens through specially crafted web pages. An attacker would need to trick a user into visiting a malicious website, but once there, the browser's UI protections don't adequately prevent visual deception. This is not an authentication bypass—it's a user interface trick that could mislead people about whether they're interacting with legitimate Chrome UI or attacker-controlled content.

• CVE-2026-11298MEDIUM 4.3

  A vulnerability in Google Chrome for iOS allows attackers to bypass the same-origin policy—a critical security boundary that prevents websites from accessing data belonging to other sites—by tricking users into visiting a specially crafted webpage. The flaw affects Chrome versions before 149.0.7827.53 on iPhones and iPads. While the Chromium project rated this as low severity, the CVSS score reflects a medium severity due to the potential for information disclosure or unauthorized content modification in cross-origin contexts.

• CVE-2026-11300MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles permissions that allows an attacker to trick users with a specially crafted web page. The attack doesn't steal data or crash the browser—instead, it displays fake permission dialogs or UI elements that might convince a user to grant access they shouldn't. The attacker needs the victim to visit the malicious page, but no special user configuration is required beforehand.

• CVE-2026-11302MEDIUM 4.3

  A security flaw in Google Chrome for iOS allows attackers to bypass access controls through a specially crafted web page. The vulnerability requires user interaction—a person must visit the malicious page—but does not require any special privileges or system access to attempt exploitation. While Chromium's internal assessment classified this as low severity, the CVSS score of 4.3 reflects moderate concern, primarily because it can lead to unauthorized actions or changes within the browser's trust model, though it does not expose sensitive data or crash the application.

• CVE-2026-11309MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser enforces policies for the History feature. An attacker can craft a deceptive webpage that tricks users into believing they're interacting with legitimate browser UI elements or content. While the vulnerability requires user interaction and doesn't directly expose sensitive data or crash the browser, the spoofing capability could be weaponized in social engineering campaigns to steal credentials or manipulate user behavior.

• CVE-2026-11337MEDIUM 4.3

  A reflected cross-site scripting (XSS) vulnerability exists in tittuvarghese CollegeManagementSystem affecting the fetch.php endpoint. An attacker can inject malicious scripts through the department_name parameter, which are then executed in a victim's browser when they interact with a crafted link. The attack requires user interaction but no authentication, making it a practical threat in educational environments where students and staff may click on shared links. Public exploit code is available, increasing the likelihood of opportunistic attacks.

• CVE-2026-11357MEDIUM 4.3

  The Kadence Blocks page builder plugin for WordPress exposes sensitive credentials to unauthorized viewing. When a site administrator connects a Kadence account license, the full credential set—including license keys, email addresses, and API tokens—becomes readable by any contributor-level user directly through the browser console. No complex attack is needed; the credentials are simply sitting in client-side JavaScript variables.

• CVE-2026-11359MEDIUM 4.3

  The Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin contains a security gap that allows low-privilege WordPress users (those with Subscriber access or higher) to remotely install and activate the ProfileGrid plugin without authorization. The vulnerability stems from two missing security controls: capability verification and request validation tokens. An attacker with even the most basic user account on a vulnerable WordPress site could exploit this to extend their privileges or introduce malicious functionality.

• CVE-2026-11364MEDIUM 4.3

  The Product Specifications for WooCommerce plugin contains a flaw that allows lower-level users—even those with basic Subscriber access—to create, modify, and delete product specification groups and attributes without proper permission checks. An attacker exploiting this can corrupt your product catalog data and break how specifications display on your store's frontend. The vulnerability exists in versions up to 0.8.9 and requires authentication, meaning the attacker must have a user account on your WordPress site.

• CVE-2026-11436MEDIUM 4.3

  Mage AI versions up to 0.9.79 contain a reflected cross-site scripting (XSS) vulnerability in the sign-in flow. An attacker can craft a malicious URL with a manipulated redirect parameter that, when clicked by a user, executes JavaScript in the victim's browser within the context of the Mage AI application. The vulnerability requires user interaction—someone must click the malicious link—but no authentication is needed to trigger it. Public exploit details are now available.

• CVE-2026-11477MEDIUM 4.3

  CVE-2026-11477 is an open redirect vulnerability in the OAuth2 Client component of hsweb-framework versions up to 5.0.1. An attacker can craft a malicious URL that tricks users into being redirected to an external website after authenticating through your application's OAuth2 flow. This could be used for phishing or credential harvesting attacks. The vulnerability requires user interaction (clicking a link) but can be exploited over the network without authentication. Public exploit code is already available.

• CVE-2026-11492MEDIUM 4.3

  A vulnerability in the D-Link DIR-823G router (firmware version 1.0.2B05) allows an authenticated attacker to modify the vsftpd configuration file in a way that violates least privilege protections. The flaw can be exploited remotely by someone with valid login credentials. While the barrier to entry requires authentication, the impact is a privilege escalation that could allow an attacker to exceed their intended access level on the device.