2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

1284 published vulnerabilities · page 4 of 13

• CVE-2026-34993MEDIUM 6.4

  AIOHTTP, a popular Python framework for asynchronous HTTP operations, contains a vulnerability in its CookieJar.load() function that could allow code execution when loading untrusted cookie data. The vulnerability exists in versions before 3.14.0. While the risk is moderate, it primarily affects applications that explicitly load cookie files from untrusted sources—a less common pattern than using CookieJar with application-generated data. Upgrading to version 3.14.0 or later eliminates the risk.

• CVE-2026-36612MEDIUM 6.4

  The Mercusys AC12G (EU) router with firmware version AC12G(EU)_V1_200909 ships with Wi-Fi Protected Setup (WPS) enabled by default. WPS is a feature designed to simplify device pairing, but this implementation has a critical weakness: after just 10 failed PIN guesses, the device locks out for only 60 seconds. This short lockout window makes brute-force attacks against the WPS PIN feasible within a reasonable timeframe, potentially allowing an attacker within wireless range to gain administrative access to the router.

• CVE-2026-3722MEDIUM 6.4

  A WordPress plugin called 'Auto Image Attributes From Filename With Bulk Updater' fails to properly clean and display user-supplied data in image metadata fields. This allows authenticated users with Author-level permissions or higher to embed malicious code into image properties. When site visitors view pages containing the injected image, that code runs in their browsers—potentially stealing session cookies, performing actions on their behalf, or redirecting them to malicious sites. The vulnerability affects all versions up to and including 4.9.

• CVE-2026-4080MEDIUM 6.4

  The Easy Cart plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'add_to_cart' shortcode. Attackers with Contributor-level access or above can inject malicious scripts into shortcode parameters that will execute for any user viewing the affected page. The vulnerability stems from incomplete sanitization—while HTML tags are stripped, quotation marks are not escaped, allowing attackers to break out of HTML attribute context and inject event handlers like onclick or onerror. All versions through 1.8 are affected.

• CVE-2026-4081MEDIUM 6.4

  The ZeM STL plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into website pages. When someone visits a page containing the injected script, their browser executes the attacker's code. This happens because the plugin doesn't properly clean or escape user input when processing shortcode parameters like 'url', 'color', and 'bgcolor'. All versions up to 1.0 are affected.

• CVE-2026-41982MEDIUM 6.4

  CVE-2026-41982 is a race condition vulnerability affecting the IPC (inter-process communication) module. An authenticated attacker can exploit this flaw to degrade system availability. The vulnerability requires specific conditions to trigger and is rated MEDIUM severity with a CVSS score of 6.4.

• CVE-2026-4334MEDIUM 6.4

  The Shariff Wrapper plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 4.6.20. Attackers with Contributor-level access or higher can inject malicious scripts through the 'headline' parameter in the [shariff] shortcode. When other users view the affected page, the injected code executes in their browsers, potentially enabling session hijacking, credential theft, or further compromise. The vulnerability stems from the plugin's use of a permissive HTML sanitization routine followed by unsafe string replacement operations that reintroduce dangerous content after the sanitization check.

• CVE-2026-44462MEDIUM 6.4

  Zed is a popular code editor that includes a terminal tool with permission controls meant to restrict which commands can be executed. Prior to version 0.229.0, an attacker could bypass these restrictions by chaining bash variable expansion syntax—specifically the ${var@P} expansion—to execute arbitrary commands even when they appeared to violate the allowed command prefix rules. This requires user interaction (opening a malicious project or terminal configuration) but grants the attacker code execution within the editor's process context.

• CVE-2026-45285MEDIUM 6.4

  Nextcloud inadvertently creates hidden public links when users share folders or files with Teams that include external members (people invited via email without Nextcloud accounts). These links remain invisible in the sharing interface but are emailed to the external recipient and grant full permissions—read, write, delete, reshare, download. An attacker intercepting or receiving one of these links gains unfettered access to all shared data without authentication, and the folder owner cannot see or revoke the link through normal UI controls. Versions 32.0.0–32.0.8 and 33.0.0–33.0.2 are vulnerable; patches are available.

• CVE-2026-50592MEDIUM 6.4

  Znuny, a widely-used open-source helpdesk and ticketing platform, contains a reflected cross-site scripting (XSS) vulnerability in its administrative communication log interface. An authenticated attacker with login credentials can craft a malicious URL containing injected JavaScript that executes in the browser of another administrator viewing the communication logs. This could allow credential theft, session hijacking, or other actions performed on behalf of the compromised administrator. The vulnerability affects Znuny LTS versions before 6.5.21 and Znuny versions before 7.3.3.

• CVE-2026-5714MEDIUM 6.4

  The Enable Media Replace plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Author-level permissions or higher to inject malicious scripts into pages. When other users visit those pages, the injected scripts execute in their browsers, potentially compromising their accounts, stealing session data, or performing actions on their behalf. The vulnerability exists in all versions up to and including 4.1.8 and results from the plugin's failure to properly sanitize and escape the 'location_dir' parameter.

• CVE-2026-6275MEDIUM 6.4

  The StatCounter – Free Real Time Visitor Stats WordPress plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated authors to inject malicious scripts into their posts. When any visitor views a post authored by an attacker, the injected script executes in their browser. The vulnerability exists because the plugin fails to properly escape the author's nickname before outputting it into JavaScript code on every post page.

• CVE-2026-6427MEDIUM 6.4

  The a3 Lazy Load WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions through 2.7.6. An attacker with Contributor-level permissions can craft a malicious video element that exploits a regex parsing bug in the plugin's video filtering logic. When this crafted content is viewed by any site user—including administrators—malicious JavaScript executes in their browser. The vulnerability stems from improper quote handling in HTML attribute processing, combined with unescaped output in the admin interface.

• CVE-2026-7662MEDIUM 6.4

  The ePaperFlip Publisher plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into pages. When other users view those pages, the injected scripts execute in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability affects all versions up to and including version 1 and stems from the plugin failing to properly filter and escape user input in the 'publicationid' shortcode attribute before inserting it into JavaScript code.

• CVE-2026-7795MEDIUM 6.4

  The Click to Chat – WA Widget plugin for WordPress contains a flaw that allows authenticated users with basic contributor permissions to inject malicious code into pages. When someone clicks the WhatsApp chat button on an affected site, the injected code executes in their browser. The vulnerability stems from improper handling of a shortcode parameter: the plugin escapes user input in a way that works for HTML attributes, but that escaping is later decoded by browsers when the value appears inside a JavaScript function call within an event handler. This creates a window for attackers to break out of the intended string context and run arbitrary JavaScript.

• CVE-2026-7796MEDIUM 6.4

  The EmbedPress WordPress plugin, used for embedding PDFs, videos, and other rich media content, contains a stored cross-site scripting (XSS) vulnerability that allows attackers with contributor-level access to inject malicious scripts into pages. When other users visit those pages, the injected scripts execute in their browsers, potentially allowing attackers to steal credentials, perform unauthorized actions, or compromise user sessions. This affects all versions up to and including 4.5.3.

• CVE-2026-8599MEDIUM 6.4

  MailerPress, a popular WordPress plugin for email marketing and automation, contains a vulnerability that allows attackers with author-level or higher permissions to inject malicious scripts into campaign content. These scripts execute when administrators preview the campaigns in the WordPress dashboard. The vulnerability stems from the plugin not properly filtering user input when storing campaign HTML, nor adequately escaping that content when displaying it. The public-facing preview that customers see is protected by security headers, so the risk is primarily to the WordPress site's admin users rather than to recipients of sent emails.

• CVE-2026-8677MEDIUM 6.4

  Prime Elementor Addons, a WordPress plugin for building pages with Elementor, has a stored cross-site scripting (XSS) vulnerability that allows contributors and higher-privileged users to inject malicious scripts into pages. When other users view those pages, the injected scripts execute in their browsers, potentially compromising their sessions or stealing sensitive information. The vulnerability persists through versions up to 1.3.3 because the plugin fails to properly sanitize widget HTML settings before storing them.

• CVE-2026-8841MEDIUM 6.4

  The Extra Settings for RocketChat plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 0.1. A WordPress user with contributor-level permissions or higher can craft a malicious 'title' attribute in the 'rocketchat' shortcode to inject JavaScript code into a page. When other users visit that page, the injected script executes in their browser within the site's context, potentially allowing the attacker to steal credentials, perform actions on their behalf, or deface content.

• CVE-2026-8880MEDIUM 6.4

  The RomanCart Ecommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its shortcode handler. An authenticated user with contributor permissions or higher can inject malicious JavaScript code into pages through the romancart_button shortcode's attributes. Once injected, that code executes for every visitor who views the affected page, potentially leading to session hijacking, credential theft, or defacement. The vulnerability exists in versions 2.0.8 and earlier due to inadequate input validation and output encoding.

• CVE-2026-8882MEDIUM 6.4

  A WordPress plugin called WP ApplicantStack Jobs Display contains a security flaw that allows certain logged-in users to inject malicious code into web pages. When other users visit those pages, the injected code runs in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability affects all versions up to and including 1.1.1 and requires the attacker to have at least contributor-level permissions on the WordPress site.

• CVE-2026-8883MEDIUM 6.4

  The Global Body Mass Index Calculator WordPress plugin contains a stored cross-site scripting (XSS) flaw affecting versions 1.2 and earlier. Attackers with contributor-level access can inject malicious scripts through the plugin's shortcode functionality. These scripts persist in the database and execute whenever site visitors view affected pages, potentially compromising user sessions, stealing credentials, or spreading malware across your WordPress site.

• CVE-2026-8885MEDIUM 6.4

  The DeMomentSomTres Shortcodes plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'callout' shortcode feature. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code through the 'width' and 'align' shortcode parameters. Because the plugin fails to properly sanitize and escape these inputs, the injected code executes whenever any visitor views the affected page. This creates a persistent threat that compromises site visitors, not just the page editor.

• CVE-2026-8893MEDIUM 6.4

  A stored cross-site scripting (XSS) vulnerability exists in the Express Payment For Stripe WordPress plugin up to version 1.28.0. Authenticated users with contributor-level permissions or higher can embed malicious scripts into pages using the [stripe-express] shortcode. These scripts execute in the browsers of anyone viewing the affected page, potentially allowing attackers to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability stems from the plugin failing to properly escape shortcode attribute values before rendering them in HTML.

• CVE-2026-8895MEDIUM 6.4

  A WordPress plugin called 'kk blog card' contains a security flaw that allows contributors and higher-level users to embed malicious scripts into pages. When someone visits a page with the injected code, the script runs automatically in their browser. The vulnerability exists in versions 1.3 and earlier, and stems from the plugin not properly filtering user input before inserting it into HTML code.

• CVE-2026-8900MEDIUM 6.4

  The Simple SEO Slideshow WordPress plugin has a security flaw that allows authenticated users with contributor-level permissions or higher to inject malicious scripts into pages. When someone visits a page containing this injected code, the script executes in their browser—including for administrators. The vulnerability exists because the plugin does not properly filter user input when processing shortcode attributes, even though WordPress has built-in protections that should catch this. All versions through 1.2.8 are affected.

• CVE-2026-8977MEDIUM 6.4

  The WP GDPR Cookie Consent plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with subscriber-level permissions or higher to inject malicious JavaScript code into website pages. When other users visit an affected page, the injected script executes in their browsers, potentially allowing attackers to steal session tokens, redirect visitors, inject malware, or perform other actions on behalf of legitimate users. The vulnerability exists because the plugin fails to properly validate user input and safely display stored configuration settings.

• CVE-2026-9243MEDIUM 6.4

  The Plus Addons for Elementor plugin contains a flaw that allows authenticated WordPress users with contributor-level permissions or higher to inject malicious scripts into website pages. When a victim visits an affected page, the injected script executes in their browser, potentially compromising their session or stealing data. The vulnerability exists in the Carousel Anything widget's handling of the carousel_direction parameter and affects versions up to 6.4.15.

• CVE-2026-9281MEDIUM 6.4

  Master Addons For Elementor, a popular WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with author-level permissions to inject malicious scripts into pages. The vulnerability exists in the Custom JS Extension feature and affects all versions up to 3.1.0. Because the injected scripts persist in the database and execute whenever visitors view the affected pages, this could be used to steal credentials, distribute malware, or redirect users to phishing sites. The core issue is that the plugin fails to properly validate and sanitize user input when saving custom JavaScript code, and the security checks that exist only apply to the visual editor interface, not to direct API calls.

• CVE-2026-9557MEDIUM 6.4

  Mautic's Focus component contains a Server-Side Request Forgery (SSRF) flaw that allows authenticated users to manipulate the application into making HTTP requests on their behalf. An attacker with valid credentials can craft specially-formed URLs to probe the internal network, access services that should only be reachable from within the organization, or force the server to make requests to external systems. The vulnerability requires authentication, which limits the immediate attack surface but still poses a meaningful risk to organizations where user accounts are shared, compromised, or granted to untrusted users.

• CVE-2026-9644MEDIUM 6.4

  A WordPress plugin called LiveSmart Video Chat has a security weakness that allows authenticated users with contributor-level permissions to inject malicious code into pages. When other visitors view those pages, the injected code runs in their browsers, potentially compromising their accounts or data. The vulnerability exists in all versions up to 1.2 and stems from the plugin not properly filtering user input before displaying it on pages.

• CVE-2026-9714MEDIUM 6.4

  A vulnerability in the Simple Divi Shortcode WordPress plugin (versions 1.2 and earlier) allows authenticated users with contributor-level permissions or higher to inject malicious code into pages. When other users view those pages, the injected code executes in their browsers. The vulnerability stems from the plugin failing to properly sanitize user input in the [showmodule] shortcode's 'id' parameter. While this requires authenticated access, the ability to execute arbitrary scripts across users' sessions creates a meaningful security risk for WordPress sites using this plugin.

• CVE-2025-65640MEDIUM 6.3

  Arket Globe Document Intelligence version 5.0.0.559 contains a reflected cross-site scripting (XSS) vulnerability in the "Task in Progress / Recent" page. An authenticated attacker can inject malicious JavaScript into document creation fields that will execute in the browsers of other users viewing that page, potentially allowing session hijacking, credential theft, or other malicious actions performed on behalf of those users.

• CVE-2026-10060MEDIUM 6.3

  TRENDnet's TEW-432BRP wireless router (firmware version 3.10B20) contains a command injection vulnerability in its route configuration interface. An authenticated attacker can manipulate IP, mask, or gateway parameters to inject arbitrary commands on the device. The vulnerability requires valid credentials but poses a direct threat to affected networks. Critically, this product reached end-of-life in 2009—over 15 years ago—and the vendor has stated it cannot replicate or fix vulnerabilities in legacy hardware.

• CVE-2026-10061MEDIUM 6.3

  A command injection vulnerability exists in the TRENDnet TEW-432BRP wireless router (firmware version 3.10B20), discovered in the WPS configuration function. An authenticated attacker can manipulate the peerPin parameter to execute arbitrary commands on the device. The vulnerability is network-accessible and requires valid login credentials. Notably, this router reached end-of-life in 2009—over 15 years ago—and TRENDnet has stated they cannot replicate or provide fixes for vulnerabilities in this legacy hardware. While exploit code is public, the practical risk is limited to organizations still operating this obsolete equipment in production environments.

• CVE-2026-10064MEDIUM 6.3

  TRENDnet has disclosed a remote stack-based buffer overflow vulnerability in the TEW-432BRP wireless router (firmware version 3.10B20 and earlier). An authenticated attacker can exploit this flaw by sending a specially crafted request to the port forwarding configuration endpoint, potentially allowing code execution or denial of service. The vendor has confirmed this product reached end-of-life in 2009 and will not issue patches. Public exploit code is available, elevating the practical risk despite the device's age.

• CVE-2026-10101MEDIUM 6.3

  ACM/MCE (Advanced Cluster Management / Multicluster Engine) inadvertently exposes container registry credentials in InfraEnv status messages when pull-secret validation fails. A user with read-only namespace access can view InfraEnv objects and extract the full `.dockerconfigjson` payload—including usernames, passwords, and base64-encoded authentication tokens—despite having no direct permission to read Secrets. This circumvents Kubernetes RBAC controls designed to keep registry credentials confidential.

• CVE-2026-10127MEDIUM 6.3

  A command injection vulnerability exists in Edimax BR-6478AC wireless routers running firmware version 1.23. An authenticated attacker can send a specially crafted web request to the device's configuration interface that tricks it into executing arbitrary system commands. The vulnerability stems from improper validation of the 'rootAPmac' parameter in the device's wireless driver setup function. Because proof-of-concept code has been publicly released, there is a meaningful risk that attackers will attempt to exploit this flaw in active environments.

• CVE-2026-10152MEDIUM 6.3

  A flaw in TaleLin's lin-cms-spring-boot framework (version 0.2.1 and earlier) allows authenticated users to bypass access controls on the book endpoint. An attacker with valid login credentials can manipulate requests to perform actions they should not be permitted to execute, such as viewing, modifying, or deleting book records without proper authorization checks. Proof-of-concept code is publicly available, increasing the risk of active exploitation.

• CVE-2026-10166MEDIUM 6.3

  A command injection vulnerability exists in Edimax BR-6478AC version 1.23 that allows an authenticated attacker to execute arbitrary commands on the device. The flaw is in the web interface's wireless settings handler, where the rootAPmac parameter is not properly sanitized before being used in system commands. An attacker with valid login credentials can manipulate this parameter to inject malicious commands, potentially compromising router configuration, data, or availability. Public exploit details are available, increasing real-world risk.

• CVE-2026-10168MEDIUM 6.3

  A vulnerability in OUSL-GROUP-BrinaryBrains School Student Management System allows authenticated users to manipulate resource identifiers through the marks function in the Parents.php controller, potentially exposing or modifying student data. An attacker with login credentials can exploit this remotely by injecting malicious parameters, affecting the confidentiality and integrity of educational records. Public disclosure has occurred, increasing real-world exploitation risk.

• CVE-2026-10170MEDIUM 6.3

  A SQL injection vulnerability exists in code-projects Visitor Management System version 1.0. An authenticated attacker can manipulate the 'phone' parameter in the /vms/php/phone_0.php file to inject malicious SQL commands. This allows the attacker to read, modify, or delete database contents without special privileges. The vulnerability requires valid login credentials to exploit and has a published proof-of-concept.

• CVE-2026-10172MEDIUM 6.3

  Bdtask Multi-Store Inventory Management System version 1.0 contains a file upload vulnerability that allows authenticated users to upload arbitrary files to the server without validation. An attacker with valid login credentials can exploit this flaw to upload malicious files, potentially leading to remote code execution or other attacks. Public exploit code is available, increasing the risk of widespread exploitation.

• CVE-2026-10174MEDIUM 6.3

  Aider-AI's Aider version 0.86.3 contains a flaw in how it processes pre-commit hook arguments. An attacker with valid credentials can manipulate the git-commit-verify argument to bypass security protections that normally prevent unauthorized code commits. The vulnerability requires network access and prior authentication, making it a concern primarily for development teams using Aider in shared or untrusted environments. Public exploit code exists, increasing the practical risk.

• CVE-2026-10175MEDIUM 6.3

  A code injection vulnerability exists in Aider-AI Aider version 0.86.3 within the Architect Mode feature. An authenticated user can manipulate the editor_coder.run function in auth.py to inject and execute arbitrary code on the system. The flaw requires valid credentials to exploit but no additional user interaction, making it a direct threat to organizations using this development assistance tool. Public exploit code is already available.

• CVE-2026-10176MEDIUM 6.3

  Aider-AI's Aider version 0.86.3 contains a SQL injection vulnerability in its code generation workflow that can be exploited by authenticated users to manipulate database queries. While the vulnerability requires login credentials to trigger, an attacker with access can extract, modify, or delete sensitive data. Public exploit information is available, increasing the near-term risk of active exploitation.

• CVE-2026-10177MEDIUM 6.3

  Aider-AI's Aider version 0.86.3 contains a server-side request forgery (SSRF) vulnerability in its AWS EC2 metadata endpoint handling. An authenticated attacker can exploit the requests.get function in api_docs.py to make the application fetch resources from arbitrary locations, potentially accessing sensitive internal services or metadata. The vulnerability is remotely exploitable and public disclosure has already occurred.

• CVE-2026-10180MEDIUM 6.3

  A command injection vulnerability exists in the TRENDnet TEW-432BRP router (firmware version 3.10B20) that allows authenticated users to execute arbitrary system commands through the formSysCmd web interface parameter. The vulnerability is in the /goform/formSysCmd endpoint and can be exploited remotely by anyone with network access and valid credentials. TRENDnet has not patched this issue because the router reached end-of-life in 2009 and is no longer supported.

• CVE-2026-10182MEDIUM 6.3

  A remote command injection vulnerability exists in the TRENDnet TEW-432BRP wireless router running firmware version 3.10B20. An authenticated attacker can exploit the WLAN setup function by manipulating the 'enrollee' parameter to execute arbitrary commands on the device. The vulnerability has been publicly disclosed. However, this router reached end-of-life in 2009—over 15 years ago—and the vendor has stated they cannot replicate or fix vulnerabilities in products no longer supported. Organizations still operating this hardware face unpatched exposure.

• CVE-2026-10193MEDIUM 6.3

  OFCMS versions up to 1.1.3 contain a SQL injection vulnerability in the ComnController component. An authenticated attacker can manipulate the 'system.user.query' parameter to inject malicious SQL commands, potentially accessing, modifying, or deleting database records. The vulnerability has been publicly disclosed and exploit code is available, making active exploitation a realistic threat.

• CVE-2026-10194MEDIUM 6.3

  A heap-based buffer overflow exists in OFFIS DCMTK 3.7.0 within the query/retrieve service component (dcmqrscp). An authenticated attacker can trigger this flaw remotely by sending specially crafted requests to the image deletion function, potentially causing memory corruption, data loss, or service disruption. The vulnerability requires valid credentials to exploit but poses moderate risk in networked medical imaging environments where DCMTK is deployed.

• CVE-2026-10202MEDIUM 6.3

  A SQL injection vulnerability exists in OFCMS version 1.1.3 affecting the JSON Query Interface within the SystemDictController component. An authenticated attacker can send specially crafted queries to manipulate SQL commands executed by the application, potentially reading, modifying, or deleting database records. The vulnerability requires valid user credentials but can be exploited over the network without user interaction. Exploit code is publicly available, increasing the risk of active exploitation.

• CVE-2026-10203MEDIUM 6.3

  A SQL injection vulnerability exists in OFCMS 1.1.3 within the Query function of the SystemParamController component. The flaw allows authenticated attackers to inject malicious SQL commands through the JSON Query Interface, potentially compromising database integrity and confidentiality. Public exploit code is available, increasing active exploitation risk.

• CVE-2026-10204MEDIUM 6.3

  A SQL injection vulnerability has been discovered in OFCMS version 1.1.3, specifically in the JSON Query Interface of the user management controller. An authenticated attacker can submit specially crafted queries to execute arbitrary SQL commands against the application's database. This could allow them to read, modify, or delete sensitive data. The vulnerability is not currently on the CISA Known Exploited Vulnerabilities (KEV) catalog, but exploit code has been publicly released, increasing the practical risk of attacks.

• CVE-2026-10205MEDIUM 6.3

  Metasoft MetaCRM version 6.4.0 contains an unrestricted file upload vulnerability in its logo upload functionality. An authenticated attacker can upload arbitrary files to the server, potentially leading to code execution or system compromise. The vulnerability affects a JSP file handling logo uploads and requires valid user credentials to exploit. Public exploit code exists for this issue.

• CVE-2026-10209MEDIUM 6.3

  A SQL injection vulnerability exists in the Online Hospital Management System version 1.0, specifically in the appointment booking functionality. An authenticated attacker can manipulate the 'editid' parameter in the appointmentdetail.php file to inject malicious SQL commands. This allows an attacker with valid credentials to read, modify, or delete sensitive appointment and patient data without additional authorization. Since the exploit has been publicly disclosed, the risk of active exploitation is elevated.

• CVE-2026-10210MEDIUM 6.3

  AstrBot version 4.23.6 contains a vulnerability in its skill management system that allows authenticated users to inject malicious code through the prompt description field. An attacker with login credentials can manipulate how skill prompts are processed, potentially leading to unauthorized data access, system modification, or service disruption. The vulnerability has been publicly disclosed, and exploit code is available, though the vendor has not engaged with disclosure efforts.

• CVE-2026-10211MEDIUM 6.3

  AstrBot version 4.23.6 contains a flaw in how it validates file system paths, allowing authenticated users to bypass access restrictions and read, modify, or delete files they shouldn't be able to access. An attacker with valid credentials can exploit this remotely without user interaction. The vulnerability has already been disclosed publicly, and exploit code may be available.

• CVE-2026-10212MEDIUM 6.3

  A flaw in AstrBot version 4.24.2 allows an authenticated attacker to manipulate the session_id parameter in the astr_main_agent function, bypassing authorization checks. This means a logged-in user could potentially access or modify resources belonging to other users or perform actions they should not be permitted to perform. The vulnerability is remotely exploitable and public exploits are available.

• CVE-2026-10217MEDIUM 6.3

  A privilege management flaw exists in nextlevelbuilder GoClaw versions up to 3.11.3 that allows authenticated users to escalate their access or perform unauthorized actions. The vulnerability affects the RoleAdmin Gateway component, specifically in how it handles configuration saves. An attacker with valid credentials can exploit this remotely to gain elevated permissions or manipulate role-based access controls, potentially affecting data confidentiality, integrity, and availability.

• CVE-2026-10223MEDIUM 6.3

  NousResearch's hermes-agent software contains an injection vulnerability in its memory scanning tool that allows authenticated users to inject malicious input. An attacker with valid credentials can exploit this flaw remotely to manipulate the application's memory handling logic. The vulnerability affects all versions up to 2026.4.30, and exploit code has already been publicly disclosed, raising the practical risk despite a moderate CVSS score.

• CVE-2026-10235MEDIUM 6.3

  CodeAstro Ingredients Stock Management System version 1.0 contains a SQL injection vulnerability in its stock manager component. An authenticated attacker can manipulate the txt_search_category parameter in the /Ingredients-Stock/stock_manager.php file to execute arbitrary SQL queries. This allows unauthorized data access, modification, or deletion within the application's database. The vulnerability requires valid login credentials but can be exploited over the network without user interaction.

• CVE-2026-10239MEDIUM 6.3

  JeecgBoot, an open-source low-code application development platform, contains a server-side request forgery (SSRF) vulnerability in its word document editing module. Specifically, the `WordUtil.addImage` function in the `/airag/word/edit` endpoint fails to properly validate image URLs, allowing an authenticated attacker to manipulate the application into making arbitrary HTTP requests on behalf of the server. This could expose internal resources, bypass firewalls, or facilitate lateral movement within a network. The vulnerability affects JeecgBoot versions up to and including 3.9.2 and has been publicly disclosed.

• CVE-2026-10240MEDIUM 6.3

  JeecgBoot versions up to 3.9.2 contain a server-side request forgery (SSRF) vulnerability in the /airag/airagModel/test endpoint. An authenticated attacker can manipulate the baseUrl parameter to make the server perform unintended HTTP requests to internal or external systems. The vulnerability requires login credentials but does not require user interaction, and can be exploited over the network. A fix is planned for an upcoming release.

• CVE-2026-10241MEDIUM 6.3

  JimuReport (jeecgboot) versions up to 3.9.1 contain a server-side request forgery (SSRF) vulnerability in a file download function exposed via a debug endpoint. An authenticated attacker can manipulate the application into making arbitrary network requests on behalf of the server, potentially accessing internal resources, cloud metadata, or other services not directly exposed to the internet. The vulnerability is reachable over the network and exploit code is publicly available.

• CVE-2026-10242MEDIUM 6.3

  itsourcecode Content Management System version 1.0 contains a SQL injection vulnerability in the /instructions.php file. An attacker with user-level access can manipulate the topic_id parameter to execute unauthorized database queries, potentially reading, modifying, or deleting sensitive data. The vulnerability is remotely exploitable and public exploit code is available.

• CVE-2026-10256MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Content Management System version 1.0 affecting the comment-saving functionality. An authenticated attacker can manipulate the Name parameter in /save_comment.php to execute arbitrary SQL queries, potentially reading, modifying, or deleting database contents. The vulnerability requires valid user credentials but does not require user interaction to exploit. Public exploit code is available, elevating the practical risk despite the MEDIUM CVSS score.

• CVE-2026-10257MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Content Management System version 1.0, specifically in the admin update functionality. An authenticated user can inject malicious SQL commands through the topic_id parameter when uploading images, potentially reading, modifying, or deleting database contents. Public exploit code is available, increasing near-term risk.

• CVE-2026-10258MEDIUM 6.3

  itsourcecode Content Management System version 1.0 contains a SQL injection vulnerability in its administrative interface. An authenticated attacker can manipulate the topic_id parameter in the /admin/add_sub_topic.php file to inject malicious SQL commands, potentially allowing unauthorized access to, modification of, or deletion of database records. The vulnerability requires valid login credentials but can be exploited over the network without additional user interaction.

• CVE-2026-10265MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Content Management System version 1.0 that allows authenticated users to manipulate the topic_id parameter in the /admin/edit_topic.php file to execute arbitrary SQL queries. An attacker with valid admin credentials can exploit this to read, modify, or delete database records. Public exploits are available, elevating operational risk.

• CVE-2026-10269MEDIUM 6.3

  A vulnerability in decolua 9router allows an authenticated user to bypass authorization controls by manipulating the Host HTTP header. The flaw exists in the authentication logic of the dashboard guard component and can be exploited remotely by someone with valid login credentials. Affected versions up to 0.4.0 should be updated immediately to 0.4.1.

• CVE-2026-10271MEDIUM 6.3

  A flaw in a4m4 Student-Management-System allows an attacker to manipulate a parameter in the admin endpoint, causing the application to execute code after a redirect. The vulnerability requires user interaction but can be triggered remotely. An exploit has already been published publicly, increasing risk. The vendor uses rolling releases without traditional version numbers, making tracking more difficult for defenders.

• CVE-2026-10274MEDIUM 6.3

  A server-side request forgery (SSRF) vulnerability exists in the aem-mcp-server project maintained by indrasishbanerjee. The flaw is in the getAssetMetadata function, which processes an assetPath parameter without proper validation. An authenticated attacker can manipulate this parameter to cause the server to make unintended HTTP requests to internal or external systems, potentially accessing sensitive data or interacting with restricted resources. The vulnerability is publicly known and exploit code may be in circulation.

• CVE-2026-10276MEDIUM 6.3

  A server-side request forgery (SSRF) vulnerability exists in Jenkins-server-mcp version 0.1.0, a Jenkins integration tool. An authenticated attacker can manipulate the jobPath parameter in build status, log retrieval, or build trigger operations to make the server issue malicious requests to internal or external systems. The vulnerability requires valid login credentials but no user interaction, and the exploit code has already been made public.

• CVE-2026-10277MEDIUM 6.3

  A security flaw exists in the MCP Google Workspace integration's Gmail tool that allows authenticated users to bypass access controls and manipulate file storage operations. An attacker with valid login credentials can remotely exploit this vulnerability to gain unauthorized access to data or perform unintended modifications. The vulnerability affects the component up to commit 831790e7d5c2663325733d9f5579cc339a267c4c, and a patch has been released.

• CVE-2026-10278MEDIUM 6.3

  A path traversal vulnerability exists in the excel-mcp project (versions up to 1.0.2) that allows authenticated users to access files and directories outside the intended scope by manipulating file path parameters. An attacker with valid credentials can read or write files on the affected system by crafting malicious file path arguments, potentially exposing sensitive data or modifying system files. The vulnerability has been publicly disclosed, increasing the risk of active exploitation.

• CVE-2026-10279MEDIUM 6.3

  A remote command injection vulnerability exists in wezterm-mcp version 0.1.0, a WezTerm terminal multiplexer control plane component. An authenticated attacker can manipulate the pane_id parameter in requests to the switch_pane/write_to_specific_pane function to inject arbitrary operating system commands. The vulnerability requires valid credentials to exploit but poses a meaningful risk in environments where WezTerm MCP is exposed to untrusted users or networked clients.

• CVE-2026-10283MEDIUM 6.3

  Bottelet DaybydayCRM contains an authentication bypass vulnerability in its Settings Handler component. An authenticated attacker can manipulate application settings to gain unauthorized access to functionality they should not have, potentially viewing sensitive data, modifying records, or disrupting service availability. The vulnerability affects versions up to 2.2.1 and requires an attacker to already have valid login credentials to exploit it.

• CVE-2026-10286MEDIUM 6.3

  CodeAstro Payroll System version 1.0 contains a SQL injection vulnerability in its employee home page functionality. An authenticated attacker can inject malicious SQL commands through the emp_id parameter, allowing them to read, modify, or delete database records. This vulnerability requires valid login credentials and is reachable over the network. Public exploit information is available, increasing the immediate risk of exploitation.

• CVE-2026-10296MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Fees Management System version 1.0 that allows authenticated users to manipulate the Username parameter in the /ajax.php endpoint to execute arbitrary SQL queries. An attacker with valid login credentials can exploit this flaw to read, modify, or delete database contents. The vulnerability requires authentication but is otherwise straightforward to exploit and has been publicly disclosed.

• CVE-2026-10297MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Fees Management System version 1.0 within the course management functionality. An authenticated attacker can manipulate the ID parameter in the /manage_course.php endpoint to execute arbitrary SQL queries against the underlying database. The vulnerability requires valid login credentials but can be exploited over the network without additional interaction. Exploit code is publicly available, elevating the practical risk.

• CVE-2026-10302MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Fees Management System version 1.0 within the /manage_fee.php file. An authenticated attacker can manipulate the ID parameter to inject malicious SQL commands, potentially allowing unauthorized access to, modification of, or deletion of database records. The vulnerability requires valid user credentials to exploit but can be triggered remotely over the network.

• CVE-2026-10550MEDIUM 6.3

  A command injection vulnerability exists in elunez eladmin versions up to 2.7 within the Application Deployment Module. An authenticated user can manipulate the uploadPath argument to inject arbitrary commands, leading to remote code execution on the affected system. The vulnerability requires valid credentials to exploit but does not need user interaction once authenticated. Public exploit code is available, increasing the risk of active exploitation.

• CVE-2026-10558MEDIUM 6.3

  SourceCodester Pizzafy Ecommerce System version 1.0 contains a file inclusion vulnerability in its administrative interface. An attacker with valid login credentials can manipulate the 'page' parameter in /admin/index.php to include and execute arbitrary files on the server. This allows an authenticated attacker to read sensitive files, modify system behavior, or potentially execute code. The vulnerability is publicly known and proof-of-concept code is available.

• CVE-2026-10559MEDIUM 6.3

  SourceCodester Pizzafy Ecommerce System version 1.0 contains a file inclusion vulnerability in its index.php file. An authenticated attacker can manipulate the 'page' parameter to include arbitrary files, potentially exposing sensitive data or executing unintended code. The vulnerability requires valid credentials but can be exploited over the network without user interaction.

• CVE-2026-10568MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Fees Management System version 1.0. An authenticated attacker can manipulate the ID parameter in the /manage_payment.php file to execute arbitrary SQL queries against the backend database. This vulnerability requires valid login credentials to exploit, but can lead to unauthorized data access, modification, or deletion. Public exploit code is available, increasing the practical risk of exploitation.

• CVE-2026-10581MEDIUM 6.3

  DedeCMS 5.7.88 contains a server-side request forgery (SSRF) vulnerability in its download functionality. An authenticated attacker can manipulate the Link parameter passed to the base64_decode function in /plus/download.php to cause the server to make unintended requests to internal or external systems. This allows an attacker with login credentials to potentially access restricted resources, exfiltrate data, or pivot to other systems on the network.

• CVE-2026-10662MEDIUM 6.3

  A server-side request forgery (SSRF) vulnerability exists in ahujasid blender-mcp, a tool that handles ZIP file operations. An authenticated attacker can manipulate the ZIP file URL parameter to force the server to make HTTP requests to arbitrary internal or external systems. This could allow an attacker to access sensitive internal services, exfiltrate data, or pivot deeper into a network. The vulnerability affects versions up to commit 7636d13, and a patch is available.

• CVE-2026-10690MEDIUM 6.3

  A server-side request forgery (SSRF) vulnerability exists in DesktopCommanderMCP version 0.2.37. The flaw allows authenticated attackers to manipulate URL parameters passed to the read_file function, enabling the server to make arbitrary HTTP requests on behalf of the attacker. This could expose internal services, exfiltrate data, or compromise systems that trust the affected server.

• CVE-2026-10693MEDIUM 6.3

  SourceCodester Online Boat Reservation System version 1.0 contains a flaw in its administrative endpoints that fails to properly verify user permissions. An authenticated attacker can exploit this improper authorization to access or modify administrative functions they shouldn't have access to. The vulnerability requires an existing user account but can be exploited over the network without user interaction. The flaw affects multiple administrative endpoints, and exploit details have been publicly disclosed.

• CVE-2026-10703MEDIUM 6.3

  A use-after-free memory safety flaw exists in EIPStackGroup OpENer versions up to 2.3.0 within the SendRRData request handler. An authenticated attacker can remotely trigger memory corruption by crafting malicious messages, potentially leading to information disclosure or service disruption. The vulnerability has been publicly disclosed but the vendor has not yet acknowledged or released a patch.

• CVE-2026-10806MEDIUM 6.3

  CVE-2026-10806 is a medium-severity file upload vulnerability in mjperpinosa stumasy affecting the add_post.php component. An authenticated attacker can manipulate the up_file_to_post parameter to upload files without proper restrictions, potentially allowing arbitrary file placement on the server. The vulnerability requires valid login credentials but can be exploited over the network. Exploit code has been publicly disclosed, increasing practical risk.

• CVE-2026-10807MEDIUM 6.3

  A file upload vulnerability exists in mjperpinosa stumasy that allows authenticated users to upload files without proper validation. By manipulating the profile image upload parameter in the application's profile management component, an attacker with login credentials can bypass upload restrictions and place arbitrary files on the server. The vulnerability requires authentication but poses meaningful risk to confidentiality, integrity, and availability of the affected system.

• CVE-2026-10808MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Fees Management System version 1.0 that allows authenticated users to manipulate the ID parameter in the /manage_student.php file, potentially enabling unauthorized data access, modification, or deletion. The vulnerability requires valid login credentials but can be exploited remotely over the network. Public exploit code is available, elevating the risk of active attack.

• CVE-2026-10809MEDIUM 6.3

  CVE-2026-10809 is a SQL injection vulnerability in itsourcecode Fees Management System version 1.0. An authenticated attacker can manipulate the ID parameter in the /manage_user.php file to inject malicious SQL commands, potentially reading, modifying, or deleting database records. The flaw requires valid login credentials but can be exploited over the network without user interaction. Public exploit code is available, elevating the practical risk despite the medium CVSS score.

• CVE-2026-10811MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Fees Management System version 1.0. The flaw resides in the /receipt.php file, specifically in how the application processes the ef_id parameter. An authenticated attacker can manipulate this parameter to inject malicious SQL commands, potentially allowing them to read, modify, or delete database records. Public disclosure of this vulnerability means exploitation techniques are already available, elevating the practical risk.

• CVE-2026-10815MEDIUM 6.3

  A missing authorization vulnerability was discovered in the Hostel Management System PHP application, specifically in the Admin Dashboard Page's index.php file. An authenticated attacker can manipulate the ID parameter to bypass authorization checks, potentially gaining unauthorized access to sensitive administrative functions. The vulnerability requires valid login credentials but does not require user interaction once authenticated. Public exploit code is available, increasing the practical risk.

• CVE-2026-10874MEDIUM 6.3

  A SQL injection vulnerability exists in projectworlds Online Art Gallery Shop Project version 1.0 affecting the admin dashboard. An authenticated attacker can manipulate the 'social_insta' parameter in the /admin/adminHome.php file to inject malicious SQL commands. This allows unauthorized access to sensitive database information, modification of data, or potential system disruption. The vulnerability requires valid login credentials but has no other technical barriers to exploitation.

• CVE-2026-10875MEDIUM 6.3

  A SQL injection vulnerability exists in projectworlds Online Art Gallery Shop Project version 1.0 that allows authenticated users to inject malicious SQL commands through the social_twitter parameter in the admin panel. An attacker with login credentials can exploit this flaw to read, modify, or delete database records. Public exploit code has been released, increasing the risk of active exploitation.

• CVE-2026-10876MEDIUM 6.3

  SourceCodester Ship Ferry Ticket Reservation System version 1.0 contains an authorization bypass vulnerability affecting its admin panel. An authenticated user can manipulate the 'page' parameter in requests to /admin/ to access functions they should not be permitted to use. This vulnerability requires valid login credentials to exploit, but once authenticated, an attacker can view, modify, or delete unauthorized data. The vulnerability has been publicly disclosed with working exploits available, increasing active risk.