2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 37 of 41

• CVE-2026-14053MEDIUM 4.3

  A vulnerability in Google Chrome's extension policy enforcement allowed attackers who had already compromised Chrome's renderer process to steal data from websites a user was visiting, bypassing the normal cross-origin protections that keep data private between sites. The flaw required an attacker to first gain control of Chrome's rendering engine—a significant prerequisite—and then trick a user into visiting a malicious webpage. This is a localized threat that affects only users whose Chrome instances have been compromised at a deep level.

• CVE-2026-14054MEDIUM 4.3

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how the browser enforces navigation policies. An attacker can craft a malicious HTML page that, when visited by a user, bypasses restrictions meant to control where the browser can navigate. While the underlying vulnerability is rated Low by Chromium's own assessment, it does carry integrity risk—an attacker could potentially redirect users to unintended pages or manipulate the browser's navigation behavior in ways that undermine trust in the browser's security model.

• CVE-2026-14057MEDIUM 4.3

  A vulnerability in Google Chrome's Federated Credential Management (FedCM) implementation allows attackers to bypass the same-origin policy—a fundamental browser security boundary that prevents malicious websites from accessing data belonging to other sites. An attacker could craft a deceptive HTML page to trick users into visiting it, potentially enabling unauthorized access to credentials or identity information. The vulnerability affects Chrome versions before 150.0.7871.47 and requires user interaction to exploit.

• CVE-2026-14058MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a policy enforcement gap in its HTML parser that allows remote attackers to circumvent Content Security Policy (CSP) protections. An attacker can craft a malicious HTML page that, when visited by a user, bypasses CSP restrictions that would normally prevent inline scripts, external resource loading, or other potentially dangerous content execution. This is a client-side vulnerability requiring user interaction—a victim must visit the attacker's page for the bypass to occur.

• CVE-2026-14066MEDIUM 4.3

  A vulnerability in Google Chrome for iOS allows attackers to bypass navigation restrictions through a specially crafted webpage. An attacker could create a malicious HTML page that, when visited by a user, circumvents Chrome's security controls that normally prevent unwanted navigation. This requires user interaction—the user must visit the malicious page—but does not require the attacker to have special privileges. The impact is limited to integrity concerns rather than data theft or system disruption.

• CVE-2026-14072MEDIUM 4.3

  Google Chrome contains a flaw in how it implements the SplitView feature that allows attackers to trick users by making malicious web content appear as legitimate browser UI elements. An attacker hosting a specially crafted web page can exploit this to perform UI spoofing—essentially overlaying fake buttons, address bars, or other interface elements—potentially deceiving users into taking actions they didn't intend. The vulnerability requires user interaction (visiting a malicious site) to exploit and does not allow data theft or system crashes, but the deception risk is real enough to warrant attention.

• CVE-2026-14073MEDIUM 4.3

  A flaw in Google Chrome's WebXR implementation fails to properly validate user-supplied input before processing navigation commands. An attacker can craft a malicious webpage that, when visited by a user, bypasses Chrome's navigation restrictions—allowing the page to navigate to unexpected URLs or perform unwanted redirects. The vulnerability requires user interaction (clicking or visiting the page) and affects Chrome versions prior to 150.0.7871.47. The issue stems from insufficient input sanitization in the WebXR code path, a component used for virtual and augmented reality experiences in the browser.

• CVE-2026-14075MEDIUM 4.3

  A vulnerability in Chrome for iOS allows attackers to send HTTP requests with referrer information even when a web page has explicitly set a no-referrer policy. An attacker crafts a malicious HTML page that tricks the browser into ignoring this privacy protection, potentially leaking information about which website a user came from. This is a client-side bypass that requires user interaction—the user must visit the attacker's page—but could expose browsing patterns or sensitive context depending on the websites involved.

• CVE-2026-14076MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a weakness in how the browser enforces Content Security Policy (CSP), a security feature that restricts which resources a webpage can load. An attacker could craft a malicious HTML page that tricks the browser into loading content that should have been blocked by CSP rules, potentially allowing injection of unwanted scripts or other resources. The attack requires user interaction—the victim must visit the malicious page—but succeeds against unpatched Chrome installations on Windows, macOS, and Linux.

• CVE-2026-14077MEDIUM 4.3

  Google Chrome on macOS contains a flaw in how it handles the Select element that allows attackers to trick users by making the browser's address bar (Omnibox) display fake URLs. An attacker would craft a malicious webpage that, when visited, could make it appear that the user is on a legitimate site when they're actually somewhere else. This is a spoofing vulnerability that relies on user interaction—the victim must visit the malicious page—but requires no special privileges to exploit.

• CVE-2026-14079MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a policy enforcement weakness that allows an attacker to bypass the same-origin policy—a core browser security boundary designed to prevent malicious websites from stealing data from legitimate ones. An attacker would need to trick a user into visiting a specially crafted webpage to exploit this flaw. Once successful, the attacker could manipulate or access content from other origins in ways the browser normally forbids, potentially enabling credential theft, session hijacking, or unauthorized access to sensitive user data across multiple websites.

• CVE-2026-14080MEDIUM 4.3

  Google Chrome on Android versions before 150.0.7871.47 contain a flaw in the TabSwitcher component that fails to properly validate untrusted network data. An attacker can exploit this to bypass navigation restrictions—essentially forcing users to visit pages they shouldn't be able to reach—by sending specially crafted network traffic. The vulnerability requires user interaction (clicking or tapping) to trigger, but doesn't compromise data confidentiality or system availability.

• CVE-2026-14089MEDIUM 4.3

  A flaw in Google Chrome's popup blocker allowed an attacker who had already gained control of Chrome's renderer process to trick users into seeing fake interface elements. The vulnerability stems from inadequate checking of user-supplied input, making it possible to craft a malicious webpage that displays spoofed UI when opened in the compromised renderer. This is a low-severity issue on Chromium's scale, though the CVSS rating reflects medium risk due to the user interaction required and limited scope of impact.

• CVE-2026-14092MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a privacy flaw that allows attackers positioned on a network path between a user and servers to intercept and expose data that should remain isolated between different websites. An attacker must trick or socially engineer the user into visiting a malicious page, but once that happens, the browser's normal cross-origin protections can be bypassed through crafted network traffic. The issue affects Chrome on Windows, macOS, and Linux.

• CVE-2026-14105MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the Speech API enforces origin policies. An attacker can craft a malicious web page that tricks the browser into allowing cross-origin access to speech functionality when it shouldn't. While the browser's Chromium team rated this as low severity, the impact is integrity-focused—an attacker could manipulate speech data or interactions across origin boundaries, potentially affecting users of web applications that rely on the Speech API.

• CVE-2026-14110MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a vulnerability in the Dark Mode feature that allows an attacker to deceive users through crafted web pages. By manipulating how Dark Mode renders interface elements, an attacker could trick users into believing they are interacting with legitimate browser controls or content when they are not. This is a client-side UI spoofing vulnerability that requires user interaction to exploit.

• CVE-2026-14116MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a vulnerability in the Developer Tools (DevTools) feature that can expose sensitive data across different websites. The flaw occurs because Chrome fails to properly validate user input within DevTools. An attacker can craft a malicious webpage that, if a user interacts with it in a specific way while DevTools is active, could leak information that should remain isolated between different websites. This is a user-interaction attack—the victim must perform deliberate actions for the vulnerability to be exploited.

• CVE-2026-14123MEDIUM 4.3

  Chrome on iOS versions before 150.0.7871.47 contain a flaw in how the browser's address bar (Omnibox) displays security information. An attacker can craft a malicious webpage that tricks the browser into showing a fake URL in the address bar, making it appear as though you're visiting a legitimate site when you're actually on an attacker's domain. This is a spoofing vulnerability that exploits the visual trust signals users rely on to verify they're on the correct website.

• CVE-2026-14126MEDIUM 4.3

  Google Chrome on Android has a flaw in how it displays security information to users. An attacker could create a malicious webpage that tricks users into thinking they're visiting a legitimate website when they're actually on the attacker's site. This happens because Chrome isn't properly validating or displaying domain information in certain scenarios. The vulnerability requires user interaction—specifically clicking a link or visiting a crafted page—but doesn't directly expose sensitive data or break the browser's core security model.

• CVE-2026-14127MEDIUM 4.3

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how the browser handles printing functionality that could allow an attacker to trick users into believing they are interacting with legitimate content when they are not. The vulnerability requires the attacker to have first compromised the Chrome renderer process—the sandboxed component responsible for displaying web content—and then use a specially crafted webpage to create a fake or misleading user interface. While the underlying issue is classified as low severity by the Chromium project, the CVSS scoring reflects the user interaction required and the limited scope of potential impact.

• CVE-2026-14128MEDIUM 4.3

  A flaw in Google Chrome for iOS allows attackers to trick users by making the browser's address bar (Omnibox) display a fake URL. An attacker would craft a malicious web page and trick a user into visiting it; when the user views the address bar, they see a spoofed URL instead of the actual malicious site they're on. This leverages a user interaction requirement—the victim must actively look at the URL bar—which limits the immediate risk, but the deception could enable phishing or social engineering attacks.

• CVE-2026-14130MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in the browser's address bar (Omnibox) security indicators that allows an attacker to deceive users through visual spoofing. When a user visits a malicious webpage, the attacker can craft HTML content that makes the browser's security UI display false information—such as misleading indicators about the site's legitimacy or HTTPS status. The vulnerability requires user interaction (visiting the crafted page) but does not directly compromise data confidentiality or system availability; the primary risk is user deception leading to credential theft or other social engineering attacks.

• CVE-2026-14134MEDIUM 4.3

  Google Chrome on Android has a flaw in its Autofill feature that allows an attacker to trick users with fake interface elements on a malicious webpage. An attacker could craft a page that mimics Chrome's autofill UI to deceive users into entering or confirming sensitive information, but the attack requires user interaction and is limited to Android devices running Chrome versions before 150.0.7871.47. The vulnerability does not involve data theft or system crashes, but focuses on visual deception.

• CVE-2026-14136MEDIUM 4.3

  Google Chrome on iOS versions before 150.0.7871.47 contain a UI spoofing vulnerability that allows attackers to deceive users through a crafted web page. The vulnerability stems from inadequate input validation, enabling malicious actors to manipulate the browser interface in ways that mislead users about the actual content or origin of what they're viewing. While the underlying severity is rated Low by Chromium, the CVSS score of 4.3 reflects the human interaction requirement and limited direct impact—this is primarily a social engineering vector rather than a system compromise threat.

• CVE-2026-14140MEDIUM 4.3

  Google Chrome on Android versions before 150.0.7871.47 contains a vulnerability that allows attackers to deceive users through fake interface elements. An attacker can craft a malicious web page that, when visited, displays misleading UI elements—such as fake prompts, buttons, or address bars—to trick users into performing unintended actions. The vulnerability stems from insufficient validation of user-supplied input and does not require the attacker to have any special privileges or access. However, the user must actively visit a malicious page and interact with it for the attack to succeed.

• CVE-2026-14141MEDIUM 4.3

  Google Chrome on Android has a flaw in how it displays security information when using the Document Picture-in-Picture feature. An attacker can craft a webpage that tricks users into believing they're visiting a legitimate website when they're actually on a malicious one. This happens because the security indicator that normally shows you the real domain being visited can be hidden or spoofed. The vulnerability affects Chrome versions before 150.0.7871.47 on Android devices.

• CVE-2026-14143MEDIUM 4.3

  Google Chrome on iOS contains a flaw in how it displays password-related security warnings and UI elements. An attacker can craft a malicious webpage that tricks users into thinking they're interacting with legitimate Chrome security prompts when they're actually viewing attacker-controlled content. This UI spoofing could lead users to enter sensitive information or bypass security checks they would otherwise trust. The vulnerability affects Chrome versions before 150.0.7871.47 on Apple iOS devices.

• CVE-2026-14209MEDIUM 4.3

  Keycloak's Admin UI has a permission-bypass flaw in its fine-grained access control system. An administrator restricted to searching for users—without permission to view their full profiles—can exploit a specific search endpoint to retrieve complete user details, including sensitive metadata. The system fails to enforce view-level permissions on this particular code path, creating an unauthorized information disclosure risk for privileged but constrained accounts.

• CVE-2026-14410MEDIUM 4.3

  A flaw in Google Chrome's Skia graphics library (versions before 150.0.7871.46) allows an attacker who has already compromised the browser's rendering engine to trick users with fake UI elements. The attacker crafts a malicious webpage that, once loaded in an already-compromised renderer, displays spoofed interface components—such as fake address bars or security warnings—to deceive users into taking unwanted actions. The attack requires the renderer process to be compromised first, meaning this is a secondary exploitation technique rather than a standalone attack vector.

• CVE-2026-14418MEDIUM 4.3

  A vulnerability in Google Chrome's ANGLE graphics library prior to version 150.0.7871.46 could allow an attacker to leak data from other websites if a user visits a malicious page. The issue stems from uninitialized memory being processed in a way that exposes cross-origin information. While the CVSS score is moderate (4.3), the Chromium team rated it as High severity due to the nature of cross-origin data exposure. An attacker would need to trick a user into visiting a crafted HTML page, but no special privileges are required.

• CVE-2026-14608MEDIUM 4.3

  A vulnerability in SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0 allows authenticated users to bypass authorization controls by manipulating an ID parameter in POST requests to /index.php?action=view_student. An attacker with valid login credentials can access student records they should not be permitted to view. The vulnerability has been publicly disclosed and exploit code may be available.

• CVE-2026-14611MEDIUM 4.3

  DeepMyst Mysti versions up to 0.4.0 contain a flaw in the Per-Project Auto-Memory Handler that allows an authenticated attacker to access sensitive resource information by manipulating the workspace path argument passed to the memory initialization function. The vulnerability requires valid user credentials and network access but does not enable modifications or service disruption.

• CVE-2026-14613MEDIUM 4.3

  Keycloak's administrative interface contains an authorization flaw in its Fine-Grained Admin Permissions v2 system. When this feature is enabled, administrators granted permission to view specific roles can inadvertently see all groups linked to those roles, regardless of whether they have been granted access to those groups. This bypasses intended access controls and exposes group information—including internal identifiers and custom configurations—to administrators who should be restricted from viewing it. The vulnerability requires administrative credentials to exploit, limiting immediate risk, but undermines the security model for organizations using Keycloak to enforce role-based administrative separation.

• CVE-2026-14615MEDIUM 4.3

  A flaw in Keycloak's Fine-Grained Admin Permissions (FGAP) v2 feature allows delegated administrators to view details of child groups they shouldn't have access to. When a delegated admin queries a parent group, the system fails to properly check permissions before revealing information about nested groups—including names, paths, and custom attributes. While this doesn't grant the ability to modify data or crash the system, it represents an unintended information disclosure that could aid attackers in reconnaissance or help malicious insiders map organizational structure.

• CVE-2026-14618MEDIUM 4.3

  A denial-of-service vulnerability exists in Open5GS, an open-source 5G core network implementation, affecting versions up to 2.7.7. The flaw resides in the AMF (Access and Mobility Management Function) component's handler for network function discovery. A remote attacker with valid credentials can trigger a condition that crashes or degrades the availability of the affected AMF service. Public exploit code is available, elevating the practical risk despite the moderate CVSS score.

• CVE-2026-14623MEDIUM 4.3

  A vulnerability in the OMEC Project AMF (Access and Mobility Management Function) component allows authenticated attackers to trigger a denial-of-service condition by manipulating NGAP (NG Application Protocol) messages, specifically those handled by the RRCInactiveTransitionReport function. An attacker with valid network credentials can send crafted messages that destabilize the AMF service, affecting call setup and user mobility. The issue affects versions up to 2.1.1, and exploit code has already been made public.

• CVE-2026-14624MEDIUM 4.3

  A denial-of-service vulnerability exists in the OMEC-project AMF (Access and Mobility Management Function) component affecting versions up to 2.0.2 and 2.1.1. The flaw resides in how the NGSetupRequest handler processes incoming requests, allowing an authenticated attacker to trigger a service disruption. The vulnerability requires user credentials to exploit but can be triggered over the network without user interaction, making it a concern for deployments where internal network access is available to untrusted parties.

• CVE-2026-14626MEDIUM 4.3

  NousResearch's hermes-agent product contains a flaw in its HTTP API that allows authenticated users to trigger a denial of service condition. By manipulating a specific input parameter called 'todos' in the conversation function, an attacker can crash or hang the service, making it unavailable to legitimate users. The vulnerability affects versions up to 2026.4.30 and requires login credentials to exploit, limiting its blast radius to environments where attacker access is already possible.

• CVE-2026-14629MEDIUM 4.3

  RT-Thread versions up to 5.2.2 contain a flaw in the parameter handling system that can crash the service. An authenticated attacker can manipulate certain system operations to trigger a divide-by-zero error, causing a denial of service. Because the flaw requires existing user access and does not enable data theft or unauthorized access, the impact is limited to availability.

• CVE-2026-14632MEDIUM 4.3

  An open redirect vulnerability has been discovered in kirilkirkov's Ecommerce-CodeIgniter-Bootstrap project. The vulnerability exists in the setReferrer function of the backend controller interface, where user-controlled redirect parameters are not properly validated. An attacker can craft a malicious link that appears legitimate but redirects users to an external website after they interact with the application. While this requires user interaction and does not directly compromise the affected system, it can be leveraged in phishing campaigns or to redirect authenticated users to malicious sites. The vendor has released a patch that should be deployed promptly.

• CVE-2026-14633MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap project's hidden REST API endpoint at /index.php/api/product/set. An attacker can inject malicious scripts via the title or description parameters, which are then reflected back to users. This requires a user to interact with a crafted link or request, but once exploited, it allows arbitrary JavaScript execution in the victim's browser context. The vulnerability has been publicly disclosed, and the affected codebase uses a rolling release model, meaning patch deployment is version-agnostic.

• CVE-2026-14634MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap project affecting the Subscribed Emails Admin Page. An attacker can manipulate the User-Agent header to inject malicious scripts that execute in the context of an administrator's browser session. The vulnerability requires user interaction (an admin must visit a page with the malicious header present) and does not allow unauthorized data access or system availability impact, but could enable account compromise or administrative action abuse. Proof-of-concept code is publicly available, elevating the practical risk despite the CVSS medium rating.

• CVE-2026-14647MEDIUM 4.3

  A flaw in ONNX Runtime versions up to 1.21.x allows an authenticated attacker to read memory beyond intended boundaries when processing certain neural network model operations. An attacker with login credentials can send a specially crafted model file to trigger an out-of-bounds read, potentially exposing sensitive data. The vulnerability resides in shape inference logic for pooling operations and can be exploited remotely without user interaction.

• CVE-2026-14656MEDIUM 4.3

  A stored or reflected cross-site scripting (XSS) vulnerability exists in code-projects Assessment Management version 1.0, specifically in the user removal functionality at /admin/remove-user.php. An attacker can inject malicious JavaScript through the ID parameter, which executes in the browser of any admin who clicks a crafted link. This does not require the attacker to authenticate, but does require user interaction—typically clicking a malicious link. The vulnerability has been publicly disclosed, increasing exposure risk.

• CVE-2026-14704MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in stephen-kruger bluebox through version 4.5.12. An attacker can manipulate the 'code' argument to inject malicious scripts that execute in a victim's browser. The attack requires user interaction (such as clicking a link) but can be launched remotely. Public exploits are available, increasing the risk of active exploitation.

• CVE-2026-14783MEDIUM 4.3

  NousResearch's hermes-agent version 2026.5.29.2 contains a path traversal vulnerability in its skills tool. An authenticated attacker can manipulate the 'Name' argument to the skill_view function, allowing them to read files outside the intended directory. The vulnerability requires valid credentials but can be exploited remotely. A patch is available and should be applied promptly.

• CVE-2026-14793MEDIUM 4.3

  Craft CMS versions up to 4.18.0.1 contain an authorization bypass vulnerability in the global sets reordering functionality. An authenticated attacker can manipulate requests to the reorder-sets endpoint to perform actions they should not be authorized to perform. The vulnerability requires valid user credentials but does not require any special privileges or user interaction. Upgrading to version 4.18.1 eliminates the issue.

• CVE-2026-14794MEDIUM 4.3

  Craft CMS versions up to 4.18.0.1 contain an authorization bypass in the Charts Endpoint. An authenticated user can manipulate the userGroupId parameter in the actionGetNewUsersData function to access data they should not be permitted to view. The vulnerability requires an active login but allows remote exploitation with no further user interaction needed. Craft CMS 4.18.1 and later patch this issue.

• CVE-2026-14800MEDIUM 4.3

  A cross-site request forgery (CSRF) flaw has been discovered in imhamzaazam ecommerceFlask, an open-source e-commerce framework. The vulnerability allows an attacker to trick authenticated users into performing unintended actions—such as modifying orders, changing account settings, or making purchases—without their knowledge. The flaw resides in an unspecified function and requires user interaction (clicking a malicious link or visiting a compromised site) to exploit. Public exploit code is available, elevating the practical risk of opportunistic attacks.

• CVE-2026-15026MEDIUM 4.3

  A WordPress plugin called 'Import and export users and customers' exposes sensitive post content to low-privilege attackers. Any authenticated user, even with basic subscriber access, can read the full text and titles of any post on the site—including drafts, private posts, password-protected content, and data from non-public areas like WooCommerce orders or internal CRM records—by simply guessing post IDs. The vulnerability exists because a security token is carelessly exposed in page source code, and the plugin fails to properly restrict access to sensitive data retrieval functions.

• CVE-2026-15034MEDIUM 4.3

  A cross-site request forgery (CSRF) vulnerability exists in Flask-MonitoringDashboard versions up to 5.0.2. An attacker can craft a malicious web page that, when visited by an authenticated user, performs unwanted actions within the dashboard without the user's knowledge or consent. The vulnerability requires user interaction—the victim must visit the attacker's page while logged into the dashboard—but no special privileges are needed to exploit it. Public disclosure has already occurred, increasing the risk of active exploitation.

• CVE-2026-15036MEDIUM 4.3

  Harness versions up to 2.28.2 contain an authorization bypass vulnerability in the gitspaces endpoint that allows authenticated users to access workspace data they should not be able to see. An attacker with valid Harness credentials can manipulate requests to the getAuthorizedSpaces function to view information about spaces belonging to other users or teams. This is a remote attack requiring only network access and valid login credentials. Public exploit details are available, increasing the practical risk.

• CVE-2026-15108MEDIUM 4.3

  Google Chrome contains an integer overflow vulnerability in its Extensions API that could allow an attacker to read memory outside intended bounds. The vulnerability requires social engineering—an attacker must convince a user to install a malicious extension. Once installed, the crafted extension can exploit the flaw to access sensitive data from Chrome's memory. This is a client-side attack with medium severity, as successful exploitation depends on user interaction and results in information disclosure rather than code execution.

• CVE-2026-15124MEDIUM 4.3

  Google Chrome versions before 150.0.7871.115 contain a weakness in how the browser enforces the same-origin policy, a critical security boundary that prevents websites from accessing data belonging to other websites. An attacker can craft a malicious HTML page that, when visited by a user, exploits this weakness to read sensitive information—such as passwords or authentication tokens—from other websites you're logged into. The attack requires user interaction (visiting the malicious page) but doesn't need any special privileges or complex technical setup.

• CVE-2026-15130MEDIUM 4.3

  Google Chrome versions before 150.0.7871.115 contain a flaw in how the browser enforces navigation policies that could allow an attacker to bypass the site isolation security feature. Site isolation is a critical Chrome security boundary that prevents malicious websites from accessing data belonging to other sites. An attacker could exploit this by crafting a malicious HTML page and tricking a user into visiting it, potentially allowing unauthorized access to sensitive information from other websites the user is logged into.

• CVE-2026-15131MEDIUM 4.3

  Google Chrome versions before 150.0.7871.115 contain a flaw in how the browser handles navigation that allows an attacker to bypass site isolation, a core security boundary in Chrome. By crafting a malicious HTML page, a remote attacker can trick a user into visiting it, potentially allowing unauthorized access to data from other websites the user has open. The attack requires user interaction but no special privileges. Google rates this as Medium severity.

• CVE-2026-15187MEDIUM 4.3

  A prototype pollution vulnerability exists in enquirer, a Node.js package for interactive command-line prompts, affecting versions up to 2.4.1. The flaw allows an authenticated attacker to manipulate object prototypes through the question.name parameter when using the Enquirer.set method, potentially modifying application behavior. The vulnerability requires authenticated access and does not directly expose sensitive data, but could enable privilege escalation or unintended state changes within applications that rely on enquirer. Public exploit code is available.

• CVE-2026-15202MEDIUM 4.3

  YzmCMS versions up to 7.5 contain a cross-site scripting (XSS) vulnerability in the header handling component that allows attackers to inject malicious scripts into web pages. The flaw exists in the `get_url` function within `/yzmphp/yzmphp.php`, where the HTTP_HOST parameter is not properly sanitized before being used. An attacker can craft a malicious link that, when clicked by a user, executes arbitrary JavaScript in their browser—potentially stealing session data, credentials, or redirecting them to malicious sites. The vulnerability requires user interaction (clicking a link) but can be exploited remotely without authentication.

• CVE-2026-15286MEDIUM 4.3

  A WordPress plugin called Gutenberg Blocks with AI by Kadence WP contains a flaw that allows contributors—users with limited publishing rights—to bypass the approval process and publish posts immediately without administrator review. The vulnerability exists in a REST API endpoint used for processing patterns, where the permission check was not properly configured. This affects all versions up to and including 3.5.32.

• CVE-2026-15329MEDIUM 4.3

  CowAgent, an open-source AI agent framework, contains a vulnerability in its Browser Tool component that can leak sensitive information to authenticated users. The flaw exists in the navigation function and requires an attacker to already have login credentials. While the technical bar to exploit this is low and a proof-of-concept has been publicly released, the impact is limited to information disclosure affecting only the confidentiality of data, not its integrity or availability.

• CVE-2026-15375MEDIUM 4.3

  Eleveo Call Recording Software version 9.7.0 contains an authorization flaw in its LDAP user management interface that allows authenticated users to access or view information they shouldn't be permitted to see. The vulnerability is accessible over the network and requires valid credentials to exploit. Public details about this vulnerability are available, increasing the risk of opportunistic attacks against unpatched installations.

• CVE-2026-15377MEDIUM 4.3

  Eleveo Call Recording Software version 9.7.0 contains an authorization bypass vulnerability affecting the /callrec/sendlogfile endpoint. An authenticated user can exploit this flaw to access information they shouldn't be able to read, though they cannot modify or delete data. The vulnerability has been publicly disclosed, and exploit code is available. The vendor has not responded to early disclosure attempts.

• CVE-2026-1606MEDIUM 4.3

  GitLab has patched a vulnerability affecting its Community Edition and Enterprise Edition that allowed authenticated users to hide content within Snippets through improper input validation. An attacker with valid GitLab credentials could exploit this to conceal code or text in a Snippet, potentially obscuring malicious or sensitive content from other users who view it. The vulnerability requires authentication and carries a CVSS score of 4.3 (MEDIUM severity), indicating moderate risk that warrants timely patching but does not represent an emergency threat.

• CVE-2026-1946MEDIUM 4.3

  The GW AI Website Builder plugin for WordPress has a security flaw that allows low-level user accounts (Subscriber and above) to disconnect the plugin from its GravityWrite integration without authorization. An attacker with basic WordPress access can exploit this via a single AJAX request, disrupting the plugin's functionality and potentially affecting site operations that depend on that integration.

• CVE-2026-20178MEDIUM 4.3

  A vulnerability in Cisco's browser-based Webex App could allow attackers to trick users into visiting malicious websites. The flaw involves inadequate validation of URL parameters, meaning a crafted link sent to a user could redirect them elsewhere if clicked. Cisco has already patched the issue, and users do not need to take action—the fix is applied server-side or through automatic updates.

• CVE-2026-20260MEDIUM 4.3

  A flaw in Splunk SOAR (prior to version 8.5.0) allows an attacker without authentication to insert special control codes into application log files by crafting malicious URLs. If a system administrator later views those logs in a terminal, the codes could cause unexpected behavior—such as hiding text, changing colors, or executing terminal commands. This is a log injection vulnerability that bridges the gap between the attacker's network access and a human's interactive terminal session.

• CVE-2026-20265MEDIUM 4.3

  Splunk AI Toolkit versions before 5.7.4 contain a flaw that allows low-privileged users—those without admin or power roles—to redirect the toolkit's outbound requests to attacker-controlled servers over unencrypted HTTP. This happens because the toolkit fails to properly validate which external domains it communicates with, creating a path for sensitive data to be stolen. An attacker with knowledge of a target organization's Splunk deployment could exploit this without needing elevated privileges.

• CVE-2026-24618MEDIUM 4.3

  CVE-2026-24618 is a medium-severity information disclosure vulnerability affecting HashThemes Hash Elements plugin versions up to 1.5.4. An authenticated attacker can retrieve sensitive system information that should remain hidden from unauthorized users. The vulnerability requires valid user credentials to exploit, limiting its attack surface, but the exposure of system details could facilitate further attacks or reconnaissance.

• CVE-2026-2470MEDIUM 4.3

  The Pagelayer WordPress page builder plugin contains an authorization flaw that allows contributors and above to secretly configure contact form email templates by exploiting a mismatch between how the plugin saves settings and how it uses them. A low-level authenticated user can inject malicious form templates via the plugin's settings API, then those templates get processed by the public-facing contact form endpoint without checking who set them up or whether the post is actually published. This enables attackers to manipulate how contact form emails are sent, which becomes especially dangerous if chained with other vulnerabilities.

• CVE-2026-24756MEDIUM 4.3

  Kiteworks, a platform for secure data sharing and management, contains a flaw that allows authenticated users to modify data belonging to other users. The vulnerability stems from the application failing to properly verify that a user should have access to resources they're attempting to change. An attacker with valid credentials could exploit this to alter forms, templates, or other shared resources without authorization. The fix requires upgrading to version 9.3.0 or later.

• CVE-2026-25714MEDIUM 4.3

  Gitea, a self-hosted Git service, has a vulnerability in how it filters access tokens for organization-related API calls. Even though Gitea released a fix for a previous token-leakage issue (CVE-2025-68941), this new vulnerability reveals that the fix was incomplete. An authenticated user can still see tokens they shouldn't have access to through the organization API, potentially exposing sensitive authentication credentials.

• CVE-2026-27761MEDIUM 4.3

  Gitea, a self-hosted Git platform, contains a flaw in how it validates API permissions on feed endpoints. Specifically, the RSS and Atom feed features for repositories do not properly enforce token scope restrictions. This means a token that lacks permission to access a private repository can still retrieve sensitive commit information by accessing the feed endpoints directly. The issue affects Gitea versions up to 1.26.2.

• CVE-2026-27783MEDIUM 4.3

  Gitea, a self-hosted Git service, has a flaw in how it validates permissions on its issue-template API endpoints. An authenticated user who should not have access to a repository's issue templates can retrieve or view them because the API does not properly check repository-level permissions. This is a read-only exposure—the attacker cannot modify templates or perform destructive actions—but sensitive template configurations could be disclosed to unauthorized users.

• CVE-2026-27956MEDIUM 4.3

  Coolify, an open-source platform for managing servers and applications, contains a flaw that allows any authenticated user to discover domain names of applications controlled by other teams. When a specific optional parameter is added to a particular API call, the system fails to properly restrict access based on team membership, exposing this sensitive infrastructure information. The vulnerability affects versions before 4.0.0-beta.464 and is considered moderate in severity.

• CVE-2026-28511MEDIUM 4.3

  eLabFTW, an open-source electronic lab notebook platform, contains an information disclosure vulnerability affecting versions before 5.4.2. When an authenticated user performs a numeric search or reference lookup, the system may return resource titles that the user should not have access to view. The actual content of those resources remains protected—only the titles are exposed. This is particularly concerning because titles may contain sensitive information such as project names, patient identifiers, or regulated data that could constitute unauthorized disclosure.

• CVE-2026-32250MEDIUM 4.3

  NamelessMC, a website platform used for Minecraft server management, contains a reflected cross-site scripting (XSS) vulnerability in version 2.2.4. The flaw exists in how the application handles the `id` parameter on the user queries endpoint. An attacker can embed malicious JavaScript in a specially crafted URL; when a user clicks that link, the script runs in their browser with access to the site's session and data. This could enable attackers to steal session cookies, redirect users to phishing pages, or modify page content to deceive users.

• CVE-2026-32906MEDIUM 4.3

  OpenClaw versions prior to 2026.5.12 contain a privilege escalation flaw in their Slack plugin approval system. Users who hold limited exec approval permissions can manipulate the approval workflow to bypass intended authorization checks, allowing them to approve plugin actions that should require additional oversight or operator configuration. The vulnerability requires an authenticated user to exploit, reducing but not eliminating risk in environments with permissive access controls.

• CVE-2026-33799MEDIUM 4.3

  Juniper Networks Junos OS and Junos OS Evolved contain a memory management flaw in their SNMP daemon that can be triggered by authenticated attackers. By sending specially crafted SNMPv3 queries, an attacker can cause the snmpd process to leak memory. Over time, repeated exploitation exhausts available memory, forcing the process to crash and restart. This disrupts SNMP-based system monitoring until the process recovers. The vulnerability requires network access and valid SNMP credentials to exploit.

• CVE-2026-34170MEDIUM 4.3

  Coolify, a self-hosted deployment and infrastructure management platform, contains a server-side request forgery (SSRF) vulnerability in its GitHub App integration. When an authenticated user configures a GitHub App source, Coolify fails to validate the api_url parameter, allowing that URL to point to internal services or cloud metadata endpoints instead of GitHub. An attacker with legitimate access to Coolify can exploit this to probe internal networks, access cloud provider metadata, or interact with services that should remain isolated from external requests. The vulnerability is limited to authenticated users and does not provide write capabilities, but the information disclosure risk warrants prompt patching.

• CVE-2026-34193MEDIUM 4.3

  CVE-2026-34193 describes a logic error in GPU memory address translation that allows a compromised kernel running inside a virtual machine to send malformed commands to the GPU firmware, causing it to write data to unintended locations in firmware memory. The vulnerability requires local access and an already-compromised kernel to exploit, but once triggered, it can corrupt GPU firmware state without authorization.

• CVE-2026-3433MEDIUM 4.3

  Mattermost's websocket service inadvertently broadcasts permission change notifications to all authenticated users, including guest-level accounts, even when those users lack membership in the affected team or channel. An attacker with guest credentials can observe role and permission updates for private teams they should have no visibility into, revealing information about organizational access controls. This is a confidentiality issue requiring authentication to exploit but affecting teams that rely on Mattermost's role-based access controls to maintain information barriers between guest and member populations.

• CVE-2026-34912MEDIUM 4.3

  Revive Adserver contains a flaw that allows users with basic system access to improperly link advertising banners or campaigns to advertising zones they don't own. Specifically, a low-privileged user can modify zone-include.php or use the API to associate their zones with banners or campaigns managed by other user accounts on the same server. This breaks the expected ownership model, potentially allowing unauthorized modification of advertising relationships across accounts. The vendor has added validation logic to prevent this cross-account linking.

• CVE-2026-34913MEDIUM 4.3

  Revive Adserver versions 6.0.6 and earlier contain a flaw that allows account users with limited permissions to improperly link tracking tools to advertising campaigns they do not own. The vulnerability stems from inadequate permission checks in the campaign-trackers.php file. An attacker with basic user credentials could reassign trackers across different advertiser accounts, creating ownership confusion and potentially manipulating reporting or tracking data. Patched versions validate that campaigns can only be associated with trackers belonging to the same advertiser, restoring proper access boundaries.

• CVE-2026-34917MEDIUM 4.3

  A vulnerability in how session identifiers are managed allows attackers with low-privilege access to the web admin console to reuse their session tokens to authenticate against the XML-RPC API, which normally requires full admin permissions. By exploiting this session confusion, an attacker could gain unauthorized API access and potentially chain this into further exploitation. The fix involves tracking the session context (whether a session originated from the web interface or API) to prevent tokens from being valid across different authentication boundaries.

• CVE-2026-35162MEDIUM 4.3

  Dell PowerFlex Manager versions before 5.1.0.1 have an access control flaw that allows low-privilege remote users to trigger denial-of-service conditions. While the attacker needs valid credentials, the barrier to exploitation is relatively low, and the impact centers on service availability rather than data compromise.

• CVE-2026-36602MEDIUM 4.3

  A Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909 has a flaw in its UPnP service that exposes internal kernel memory addresses to anyone on the same network segment. An attacker can query the router's UPnP interface to extract a raw MIPS kernel pointer, effectively creating a roadmap of how the router's operating system is laid out in memory. While this doesn't directly compromise the device, it removes a significant barrier to follow-up attacks by revealing memory layout details that are normally hidden.

• CVE-2026-36613MEDIUM 4.3

  Mercusys AC12G (EU) V1 routers running firmware AC12G(EU)_V1_200909 leak sensitive internal memory to unauthenticated attackers on the same network. When an attacker sends HTTP POST requests to non-existent paths on the router's web interface, the device inadvertently returns 128 bytes of uninitialized buffer memory. This exposed data may contain router state information, configuration details, or other sensitive runtime values. The vulnerability requires physical or network adjacency—an attacker must be on the same local network segment—but no authentication or user interaction is needed to trigger it.

• CVE-2026-36615MEDIUM 4.3

  The Mercusys AC12G (EU) router running firmware version AC12G(EU)_V1_200909 contains an unauthenticated information disclosure vulnerability. An attacker on the same local network can access a hidden endpoint (/agileconfigreset) that leaks internal buffer contents without requiring any credentials or user interaction. This information could be used to further compromise the device or the network it serves.

• CVE-2026-36618MEDIUM 4.3

  The Mercusys AC12G (EU) router with firmware version AC12G(EU)_V1_200909 has a configuration issue that allows anyone on the local network to discover which version of the DNS resolver software (unbound 1.22.0) is running on the device. An attacker can query the router for this information and use it to identify known vulnerabilities affecting that specific DNS software version, making targeted attacks easier. This is a local network exposure only—an attacker would need network access to the router or its subnet to exploit it.

• CVE-2026-4058MEDIUM 4.3

  A WordPress plugin used for user management and registration has a security gap that allows any logged-in user with basic Subscriber permissions to cancel subscription plans belonging to other users—including site administrators. This missing permission check means a low-privilege attacker could disrupt subscriptions, affect billing relationships, and potentially lock administrators out of paid features. The vulnerability exists in all versions up to 4.3.2.

• CVE-2026-4071MEDIUM 4.3

  The BirdSeed WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to change the plugin's authentication token without the site administrator's knowledge. An attacker can craft a malicious link or webpage that, when clicked by an admin, silently modifies the BirdSeed token stored in the site's database. This breaks the trust chain between your WordPress site and the BirdSeed service. The vulnerability affects all versions up to and including 2.2.0 and requires social engineering—tricking an administrator into clicking a link—but no authentication or special privileges are needed from the attacker's side.

• CVE-2026-40914MEDIUM 4.3

  Apache Artemis has a flaw in how it enforces permissions when users communicate via the STOMP protocol. A user with permission to send or receive messages on a particular address can trick the system into accepting messages with a message routing-type that the address doesn't normally support. This bypasses an important security boundary: only administrators with explicit createAddress permission should be able to change an address's routing-type capabilities. An attacker could exploit this to send or consume messages in ways that violate the intended security policy, even though their basic send/consume permissions are legitimate.

• CVE-2026-41014MEDIUM 4.3

  Apache Airflow contains an authorization bypass in its UI that allows authenticated users to view information about data pipeline runs (DAGs) they shouldn't have access to. Specifically, a user with broad asset-level read permissions can see partition run states, scheduling details, and data connections for DAGs restricted to other teams or users. This affects only deployments that intentionally segment DAG access by user or role while granting wider asset visibility. The vulnerability requires an existing user account and network access to the Airflow UI or API.

• CVE-2026-41115MEDIUM 4.3

  Apache Kafka contains an authorization mismatch in its consumer group metadata API. The CONSUMER_GROUP_DESCRIBE operation checks for DESCRIBE permission on groups, but Kafka's documentation and the relevant design specification (KIP-848) incorrectly state it should check for READ permission. This inconsistency between code behavior and documentation can lead to misconfigured access controls—either granting unintended READ access to users who only have DESCRIBE permissions, or blocking legitimate access for users who rely on documentation-based ACL configurations. The vulnerability is not a code flaw but a documentation gap that can cause real-world security postures to diverge from intent.

• CVE-2026-41123MEDIUM 4.3

  Dell PowerProtect Data Domain contains a flaw in its role-based access control (RBAC) system that allows a low-privileged remote user to modify or tamper with information they shouldn't be able to access. While an attacker cannot read sensitive data or disrupt service availability through this vulnerability, the ability to alter information represents a meaningful integrity risk—particularly critical for a backup and data protection appliance where data trustworthiness is paramount.

• CVE-2026-41160MEDIUM 4.3

  EspoCRM contains a logic flaw that allows lower-privileged users to pin notes they don't have permission to edit. The vulnerability stems from a timing issue in the API backend: the system modifies the note in the database before checking whether the user is actually authorized to do so. Even though the server returns an error message afterward, the damage is already done—the note remains pinned. This affects EspoCRM versions before 9.3.5.

• CVE-2026-41983MEDIUM 4.3

  A denial-of-service vulnerability exists in a browser kernel component that can be triggered through user interaction. An attacker can craft malicious content that, when encountered by a user, causes the browser to become unresponsive or crash. The vulnerability requires user action (clicking a link, viewing a page) and does not allow attackers to steal data or modify system content—only to disrupt availability.

• CVE-2026-42005MEDIUM 4.3

  CVE-2026-42005 is a denial-of-service vulnerability affecting an internal web server component. An attacker with valid credentials can send a specially crafted web request that triggers unbounded memory allocation, exhausting system memory and causing service interruption. The risk is naturally contained by the fact that this internal web server is disabled by default in most deployments, meaning organizations must have explicitly enabled it to be vulnerable.

• CVE-2026-42540MEDIUM 4.3

  IRIS is a collaborative web platform used by incident response teams to share and document technical details during security investigations. A vulnerability in versions before 2.4.28 allows authenticated users to modify database records through specially crafted API requests, potentially corrupting or altering incident investigation data. The issue requires valid login credentials to exploit and affects data integrity rather than confidentiality.

• CVE-2026-42543MEDIUM 4.3

  IRIS, a web-based platform used by incident responders to collaborate and share technical details during investigations, contains a cross-site request forgery (CSRF) vulnerability in versions prior to 2.4.28. The vulnerability exists because the platform uses HTTP GET requests to perform state-changing actions on the server—a design flaw that allows an attacker to trick authenticated users into unknowingly executing unwanted actions. An attacker could craft a malicious link or webpage that, when visited by an IRIS user, silently modifies data or settings without the user's knowledge or consent.