2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

1284 published vulnerabilities · page 8 of 13

• CVE-2026-46233MEDIUM 5.5

  A flaw in the Linux kernel's Batman-adv bridge loop avoidance (BLA) subsystem can cause a crash when the system attempts to clean up stale network bridge claims. The issue occurs because the cleanup routine doesn't properly check whether a claim is still valid before trying to access it, potentially leading to a null pointer dereference. An attacker with local access could trigger this condition to cause a denial of service.

• CVE-2026-46235MEDIUM 5.5

  The Linux kernel's saa7164 media driver failed to properly validate whether memory mapping operations succeeded before using the results. When the kernel tries to map I/O memory regions for certain hardware (specifically PCI base address registers 0 and 2), it could receive a null pointer if the operation failed. The driver would then attempt to use these null pointers, causing a system crash. This patch adds defensive checks: if memory mapping fails, the driver now properly cleans up any partially allocated resources and safely reports an error instead of proceeding with unusable pointers.

• CVE-2026-46236MEDIUM 5.5

  A flaw has been identified in the Linux kernel's Xbox remote control driver that mishandles memory buffers used for direct hardware communication (DMA). The driver incorrectly stores DMA buffers as part of the device structure, violating fundamental DMA coherency rules. This misconfiguration can cause the system to become unstable or unresponsive, though it requires local access to trigger. The issue affects systems running vulnerable versions of the Linux kernel with the Xbox remote driver enabled.

• CVE-2026-46239MEDIUM 5.5

  A memory management bug in the Linux kernel's OV5647 camera driver causes system resources to not be properly released when certain camera control operations are performed. Specifically, three control settings—autogain, automatic exposure, and analog gain—skip the cleanup step that tells the system a resource is no longer needed, leaving the system in a degraded state. Repeated use of these controls can exhaust system resources and cause the kernel to become unstable or unresponsive.

• CVE-2026-46245MEDIUM 5.5

  A flaw in the Linux kernel's AMD display driver (amdgpu) can cause a system crash when the driver attempts to initialize Hot Plug Detect (HPD) interrupts for video connectors. The problem occurs because the code checks whether a connector's data structure (dc_link) is valid in one place, but then later uses it without checking again, leading to a null pointer dereference. This vulnerability affects systems with AMD GPUs running vulnerable kernel versions and can be triggered by a local user, resulting in a denial of service.

• CVE-2026-46247MEDIUM 5.5

  This vulnerability affects the Linux kernel's clock management subsystem, specifically the graphics processor (GFX3D) clock driver. A bug in how parent clock information is passed during rate calculations causes the system to crash when the GPU attempts to change its operating frequency. The issue emerged after a code refactoring that changed how clock dividers calculate rates. When the GPU's power management system tries to adjust clock speed—a routine operation during dynamic frequency scaling—the missing parent clock information causes a kernel panic. The vulnerability requires local access and affects systems running vulnerable kernel versions on Qualcomm-based devices.

• CVE-2026-46248MEDIUM 5.5

  This vulnerability affects the Linux kernel's WiFi driver for Qualcomm Atheros ath12k chipsets. When a WiFi interface fails during setup for multi-link operation (MLO), the driver can retain stale data about link mappings. If a new connection attempt reuses the same link ID, the driver triggers a warning and may experience instability. The issue stems from incomplete cleanup during failed initialization—specifically, link deletion code only runs if the interface was fully created, leaving orphaned references behind.

• CVE-2026-46249MEDIUM 5.5

  This Linux kernel vulnerability affects the OcteonTX2 ARM-based System-on-Chip (SoC) driver stack, specifically the Application Firmware (AF) and Physical Function (PF) drivers used in Marvell networking hardware. During a kexec reboot—a fast reboot mechanism that skips the firmware/BIOS phase—hardware state from the previous kernel persists. The bug occurs when AF fails to properly clear its initialization marker before shutdown. When the PF driver loads in the new kernel, it checks this marker to determine if AF is ready. Finding a stale marker, the PF driver incorrectly assumes AF has already initialized and attempts to access hardware that was never properly reset, causing a kernel crash. This is primarily a denial-of-service condition affecting systems performing kexec reboots with modular driver configurations.

• CVE-2026-46252MEDIUM 5.5

  A locking bug exists in the Linux kernel's regulator power management subsystem. When the system attempts to enable a power supply regulator and that operation fails, the error-handling code releases a reference to the regulator object without holding the required lock. This creates a race condition where another part of the system could be accessing the regulator data simultaneously, potentially causing a crash or memory corruption. The fix involves using the correct function call that ensures proper locking during cleanup, and adding additional safeguards to prevent concurrent access while clearing internal pointers.

• CVE-2026-46254MEDIUM 5.5

  A vulnerability in the Linux kernel's AppArmor security module can cause system crashes or hangs when AppArmor processes policy rules containing improperly aligned data structures. The kernel's DFA (Deterministic Finite Automaton) tables used by AppArmor to enforce security policies may originate from either kernel memory or user-supplied configuration, and when these tables aren't properly aligned to 8-byte boundaries, certain CPU architectures trigger unaligned memory access errors. This is a denial-of-service issue—an unprivileged user with the ability to load or modify AppArmor policies could crash the kernel without data loss or privilege escalation.

• CVE-2026-46255MEDIUM 5.5

  The Linux kernel's fsl-edma driver contains a resource management bug where clock handles are being manually disabled during driver removal, even though they were allocated using automatic cleanup functions. This causes the system to attempt disabling clocks that have already been cleaned up by the kernel, generating warnings and potentially destabilizing the driver removal process. The fix is straightforward: remove the redundant manual disable calls and let the automatic cleanup mechanism handle it.

• CVE-2026-46256MEDIUM 5.5

  A recursion deadlock vulnerability exists in the Linux kernel's NFS LOCALIO feature, which optimizes loopback NFS mounts by bypassing the network when client and server run on the same system. Under memory pressure, the kernel's direct reclaim mechanism can trigger a circular chain: NFS writes → XFS filesystem → back into NFS page cache operations, causing the system to hang. The vulnerability requires local access and affects systems using LOCALIO-enabled NFS mounts. A fix ensures memory allocations in the LOCALIO code path use GFP_NOFS context to prevent this recursion.

• CVE-2026-46257MEDIUM 5.5

  A flaw in the Linux kernel's SP804 timer driver can cause the system to crash when certain timing functions are called on ARM32 platforms. The issue arises when the SP804 timer is configured in a way that leaves a shared clock object uninitialized, but the kernel still tries to read from it. This vulnerability has been fixed by separating the delay timer functionality into its own dedicated clock instance, preventing the kernel from attempting to access uninitialized memory.

• CVE-2026-46258MEDIUM 5.5

  A flaw in the Linux kernel's GPIO character device (cdev) interface causes the system to crash when creating a line handle. The issue occurs because code attempts to use a pointer after it has been intentionally cleared to NULL, leading to a crash when the kernel tries to access memory through that invalid pointer. This is a local issue—an authenticated user on the system would need to trigger it, typically through ioctl calls to the GPIO device.

• CVE-2026-46261MEDIUM 5.5

  A vulnerability in the Linux kernel's SPI WPC flash interface unit driver can cause the system to crash due to a missing safety check. When the driver initializes, it attempts to access memory resources without first verifying they exist, potentially leading to a NULL pointer dereference that brings down the affected process or system. This is a localized denial-of-service issue requiring local system access to trigger.

• CVE-2026-46262MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's audio subsystem (ASoC fsl_xcvr driver) where a recent locking fix introduced the opposite problem: the code attempts to re-acquire a lock that is already held by the calling function, causing the system to hang. When a user adjusts audio control settings through ALSA, the kernel deadlocks instead of safely updating the configuration.

• CVE-2026-46268MEDIUM 5.5

  A logic error in the Linux kernel's PCI peer-to-peer DMA memory allocation code causes a spurious warning to be logged when kernel debug features are enabled. The vulnerability stems from a mismatch between a code assertion and a prior change to how memory pages are initialized—the assertion expects a non-zero reference count, but the pages are now created with a zero count by design. While the actual functionality remains intact, the warning floods kernel logs and can trigger monitoring alerts, degrading system observability and potentially masking other issues.

• CVE-2026-46269MEDIUM 5.5

  A NULL pointer dereference vulnerability exists in the Linux kernel's Canaan K230 pinctrl driver. During device initialization, the driver attempts to access a device structure through an uninitialized pointer, causing the kernel to crash. The issue occurs because the code tries to retrieve the device reference via a control structure that hasn't been set up yet. An attacker with local access could trigger this crash by loading the affected driver or probing the device, leading to a denial of service.

• CVE-2026-46276MEDIUM 5.5

  A Linux kernel bug in AMD's GPU driver causes the system to crash during startup when loading newer AMD Radeon RX 9070 XT graphics cards on RDNA4 hardware. The issue stems from the driver trying to initialize memory regions that don't physically exist on this newer GPU architecture. When the kernel attempts to set up these non-existent resources with zero size, it triggers a safety check that crashes the boot process. This only affects systems where kernel debugging is enabled; most deployments have avoided the crash by accident rather than design.

• CVE-2026-46278MEDIUM 5.5

  A null pointer dereference vulnerability exists in the Linux kernel's Imagination PowerVR graphics driver. When a local user attempts to update ftrace debug settings through a debugfs interface, the driver passes incorrect data to the operation, causing the kernel to crash. This is a stability issue rather than a data breach or privilege escalation risk—an authenticated local user can trigger a denial of service condition.

• CVE-2026-46282MEDIUM 5.5

  A flaw in the Linux kernel's admv1013 frequency driver can cause the system to crash or become unresponsive. The vulnerability occurs when the driver fails to properly read a configuration setting from the device, but then tries to use that uninitialized data anyway, leading to a null pointer dereference. An unprivileged local user with access to the affected system could trigger this condition to cause a denial of service.

• CVE-2026-46283MEDIUM 5.5

  A vulnerability in the Linux kernel's TPM (Trusted Platform Module) driver leaves sensitive cryptographic session keys in freed memory when a TPM device is closed. The driver should zero out this memory before releasing it—a standard security practice it already uses in other code paths—but this particular cleanup path was missed. An attacker with local access could potentially recover these keys from freed memory before it's overwritten by other processes.

• CVE-2026-46284MEDIUM 5.5

  A defect in the Linux kernel's hugepages parameter parsing can cause the system to crash during early boot if certain kernel command-line parameters are malformed. Specifically, if hugepages, hugepagesz, or default_hugepagesz parameters are supplied without an equals sign (e.g., 'hugepages 1G' instead of 'hugepages=1G'), the kernel's early parameter handler passes a NULL pointer to the hugetlb_add_param() function, which then crashes when attempting to measure the string length. The fix validates input before processing and rejects malformed parameters gracefully.

• CVE-2026-46286MEDIUM 5.5

  A vulnerability exists in the Linux kernel's Qualcomm LED driver (qcom-lpg) where a register value intended to select from a predefined array is not properly validated before use. The register can hold values 0–7 (from a 3-bit field), but the array contains only 5 entries. Without bounds checking, out-of-range values cause the code to read uninitialized or incorrect memory, which then gets used to configure LED brightness timing parameters. While actual hardware typically produces valid register values, the lack of defensive checks creates a potential denial-of-service condition if invalid data is encountered.

• CVE-2026-46287MEDIUM 5.5

  The Linux kernel's txgbe network driver has a defect in how it disconnects from external PHY (Physical Layer transceiver) devices when the driver module is unloaded. When users remove the txgbe module, the driver attempts to disconnect the PHY without first acquiring the RTNL (Real-Time Netlink) lock, which is required by the kernel's phylink subsystem. This causes a kernel assertion failure and warning message, though it does not directly compromise system security or data. The fix involves wrapping the disconnect call with proper locking.

• CVE-2026-46290MEDIUM 5.5

  A Linux kernel bug affects how the system handles page faults during firmware calls on x86/EFI systems. Recent changes to improve cryptographic performance modified how the kernel manages floating-point unit access, inadvertently causing the page fault handler to always bail out when firmware triggers a fault. On systems with buggy firmware that generates page faults during runtime calls, this escalates to a system panic and hard freeze instead of gracefully recovering. The fix changes the fault detection logic to properly distinguish between real interrupt contexts and the FPU management code path.

• CVE-2026-46291MEDIUM 5.5

  A flaw in the Linux kernel's cryptographic subsystem can expose sensitive HMAC key material through debug output when certain debugging configurations are enabled. The vulnerability exists in the hash_digest_key function of the CAAM (Cryptographic Acceleration and Assurance Module) driver, which was inadvertently dumping key bytes in plaintext during kernel logging. An attacker with local access could potentially read these keys from kernel logs or memory if dynamic debugging is active, compromising cryptographic operations that depend on key secrecy.

• CVE-2026-46292MEDIUM 5.5

  A Linux kernel vulnerability in the power domain management (genpd) subsystem leaves virtual devices with runtime PM incorrectly enabled after detachment. When drivers use genpd_dev_pm_attach_by_id() to register virtual devices, the kernel enables runtime PM for them but fails to disable it when those devices detach. This leaves the system in an inconsistent state that can trigger NULL pointer dereferences or cause the kernel to unnecessarily vote for higher performance states. The fix adds a missing pm_runtime_disable() call during device detachment to restore proper state management.

• CVE-2026-46295MEDIUM 5.5

  A race condition in the Linux kernel's KVM hypervisor can cause the system to incorrectly report whether virtual CPUs have pending interrupts. When one virtual CPU sends an interrupt to another while the receiving CPU is simultaneously checking for pending interrupts, a timing gap allows the system to think an interrupt has arrived when it hasn't actually been delivered yet. While the interrupt itself isn't lost—it remains queued internally—the false reporting triggers a warning message and wastes CPU cycles with unnecessary virtual machine context switches. This affects systems running KVM hypervisor on x86 processors, particularly in nested virtualization scenarios under heavy load.

• CVE-2026-46296MEDIUM 5.5

  A bug in the Linux kernel's SPI driver for Samsung S3C64xx controllers can crash the system when the driver is unloaded. The issue stems from incomplete refactoring: code that allocates DMA channels was moved from initialization to a later setup phase, but the corresponding cleanup code was not removed from the driver shutdown process. When the driver unloads, it tries to release DMA resources that were never allocated, triggering a NULL-pointer crash.

• CVE-2026-46297MEDIUM 5.5

  A vulnerability in the Linux kernel's libwx networking driver incorrectly uses a threaded interrupt handler setup with missing threaded handler logic, triggering kernel warnings and potential system instability. The issue affects virtual function (VF) miscellaneous interrupt handling. The fix involves switching to the standard non-threaded interrupt request function and removing an unnecessary flag that doesn't apply to non-threaded handlers.

• CVE-2026-46302MEDIUM 5.5

  A Linux kernel vulnerability allows a single process to monopolize read access to the SELinux security policy file, preventing other processes from retrieving critical security configuration. This denial-of-service condition stems from an overly restrictive locking mechanism that was originally intended to prevent memory exhaustion and inconsistent policy views, but achieves neither goal effectively. The issue is resolved by allowing concurrent reads of the policy file while maintaining data integrity through refined locking.

• CVE-2026-46305MEDIUM 5.5

  A flaw in the Linux kernel's rtl8723bs WiFi driver can cause the system to crash if memory allocation fails during buffer initialization. When the driver attempts to create a buffer, it doesn't properly check whether the memory allocation succeeded before trying to use it. If the allocation fails—a condition that may occur under memory pressure—the code will attempt to access a NULL pointer, causing a denial of service. This is a localized driver issue affecting WiFi functionality rather than a system-wide kernel compromise.

• CVE-2026-46310MEDIUM 5.5

  A flaw in the Linux kernel's Renesas VSP1 media driver causes a system crash when the module is unloaded on certain hardware generations. The bug stems from cleanup code calling the wrong function variant, leaving a dangling pointer that triggers a crash. This affects local users with module unload privileges and requires a kernel patch to resolve.

• CVE-2026-46312MEDIUM 5.5

  A flaw in the Linux kernel's video buffer management can trigger a kernel warning when memory-mapped video buffers from certain capture drivers are accessed through the graphics subsystem. While the warning itself doesn't cause data loss or direct compromise, it indicates improperly configured memory protections that should have been set. This affects primarily developers and systems running specialized camera capture software on affected kernels.

• CVE-2026-46313MEDIUM 5.5

  A flaw exists in the Linux kernel's Intel IPU6 media driver where an error-handling code path incorrectly dereferences a pointer that has been marked as invalid (an error pointer). When the driver encounters certain initialization failures during PCI device probing, it attempts to clean up resources but doesn't properly null-check a pointer before using it, leading to a kernel crash. This is a local denial-of-service issue affecting systems running vulnerable kernel versions with the Intel IPU6 driver enabled.

• CVE-2026-46314MEDIUM 5.5

  A flaw in the Linux kernel's DRM v3d driver allows a local user to trigger an infinite loop by submitting a maliciously crafted system call with a self-referential extension structure containing zero synchronization counts. This causes the kernel to hang indefinitely, consuming CPU resources and freezing the affected process. An attacker with local access can exploit this to perform a denial-of-service attack on systems running vulnerable kernel versions.

• CVE-2026-46315MEDIUM 5.5

  A vulnerability in the Linux kernel's io_uring subsystem can leak uninitialized kernel memory to userspace when using the IOURING_OP_WAITID operation. When a wait operation completes without reporting child process events, the kernel fails to zero-initialize its result buffer before copying it to user applications, exposing stale data that was previously stored in the same kernel memory. This is a local information disclosure issue affecting users who can invoke io_uring operations on systems where they have access.

• CVE-2026-46318MEDIUM 5.5

  A vulnerability in the Linux kernel's hugetlbfs memory management subsystem can cause a memory leak when virtual memory area (VMA) lock allocation fails during the memory mapping preparation stage. The issue stems from an earlier patch that attempted to optimize how hugetlb mappings are set up, but inadvertently created a window where a failed lock allocation could leave resources unreleased. A local user with standard privileges can trigger this condition, leading to denial of service through memory exhaustion.

• CVE-2026-46329MEDIUM 5.5

  A flaw in the Linux kernel's EROFS (Enhanced Read-Only File System) implementation fails to properly handle I/O requests that extend beyond the filesystem boundary when the filesystem is mounted from a file. Instead of safely zeroing out the requested data (as loopback devices and the kernel's expected behavior dictate), the kernel may access invalid memory or return uninitialized data. This can lead to a denial of service or potential information disclosure on systems using file-backed EROFS mounts.

• CVE-2026-47326MEDIUM 5.5

  Ubuntu Linux versions 6.8, 6.17, and 7.0 contain a memory leak flaw in how the kernel handles large responses from AppArmor (the mandatory access control framework). An unprivileged local user can trigger this leak repeatedly, causing the system to exhaust available memory and potentially become unstable or unresponsive. The vulnerability requires local access and does not compromise data confidentiality or integrity, but can degrade or deny service to legitimate users.

• CVE-2026-47332MEDIUM 5.5

  Ubuntu Linux versions 6.8, 6.17, and 7.0 contain a flaw in their AppArmor security module patches that allows unprivileged local users to read sensitive data from kernel memory. The vulnerability stems from incorrect validation of an internal data structure size during notification processing. An attacker with local user privileges can exploit this to leak information from adjacent memory regions (kernel slab objects), potentially exposing cryptographic keys, session tokens, or other sensitive kernel data.

• CVE-2026-47334MEDIUM 5.5

  Ubuntu Linux kernels 6.8, 6.17, and 7.0 contain a bug in AppArmor notification handling code that can be triggered by any unprivileged local user to crash the kernel or cause it to hang. The issue stems from code that incorrectly sleeps while holding a spinlock—a low-level synchronization primitive—creating a condition where the system becomes unresponsive or fails entirely. An attacker with basic local access can reliably exploit this without special privileges or user interaction.

• CVE-2026-47335MEDIUM 5.5

  Ubuntu Linux kernel version 6.8 contains a defect in how it handles AppArmor security notifications. An unprivileged local user can trigger a NULL pointer dereference—a programming error where the kernel tries to access memory that doesn't exist—causing the entire system to crash. This is a local denial-of-service vulnerability; it does not allow data theft or privilege escalation, but it can disrupt service availability.

• CVE-2026-48155MEDIUM 5.5

  pypdf, a popular open-source PDF processing library, contains a denial-of-service vulnerability affecting versions prior to 6.12.0. An attacker can craft a malicious PDF file that, when processed by pypdf's text extraction feature in layout mode, triggers excessive memory consumption. This occurs specifically when the PDF contains large character offsets. The flaw does not compromise data confidentiality or integrity, but can render systems unresponsive or crash applications that depend on pypdf for PDF handling.

• CVE-2026-48735MEDIUM 5.5

  pypdf, a popular open-source Python library for PDF processing, contains a memory exhaustion flaw that allows attackers to craft malicious PDF files triggering excessive memory consumption. The issue stems from how the library parses XMP (Extensible Metadata Platform) metadata within PDFs—an attacker can embed large or unnecessarily complex metadata structures that force the parser to allocate abnormal amounts of RAM. This can degrade system performance or crash applications relying on pypdf to process untrusted PDF documents. The vulnerability affects versions prior to 6.12.1.

• CVE-2026-50262MEDIUM 5.5

  CVE-2026-50262 is an information disclosure vulnerability in the X.Org X server and Xwayland components. A flawed validation check in the ChangeDrawableAttributes function allows an authenticated local attacker to read beyond the intended buffer boundaries, potentially exposing sensitive data from memory. The vulnerability is limited to information disclosure on standard configurations; a write variant exists but is disabled by default in most deployments.

• CVE-2026-50263MEDIUM 5.5

  CVE-2026-50263 is a use-after-free memory vulnerability in X.Org's X server and Xwayland components that can leak sensitive information from system memory. When a client manipulates window attributes and triggers the screen saver, the CreateSaverWindow() function accesses memory that has already been freed, allowing the attacker to read data that should no longer be accessible. The vulnerability requires local access and low privileges but can expose confidential information without crashing the system.

• CVE-2026-52904MEDIUM 5.5

  A memory leak exists in the Linux kernel's Nouveau graphics driver. During the device initialization process, if a specific system configuration check fails, the driver fails to properly clean up an allocated device object, leaving resources dangling in kernel memory. This is a kernel-level resource exhaustion issue that can be triggered by unprivileged users on affected systems.

• CVE-2026-52905MEDIUM 5.5

  A bug in the Linux kernel's DAMON (Data Access Monitoring) subsystem allows administrators or local users to configure memory monitoring settings with invalid parameters, potentially causing system instability or denial of service. The vulnerability stems from incomplete validation of the minimum region size parameter—it must be a power of two, but the DAMON sysfs interface can accept non-power-of-two values, leading to unaligned memory address ranges that violate kernel assumptions. This creates conditions for crashes or hangs during memory access monitoring operations.

• CVE-2026-8643MEDIUM 5.5

  pip, the Python package installer, has a path traversal vulnerability that can cause entry point scripts to be installed in unintended locations outside the target installation directory. When a package specifies console or GUI scripts without proper path sanitization, an attacker could craft a malicious package that installs executable scripts to arbitrary filesystem locations—potentially system directories or locations with higher privilege—allowing code execution with the privileges of the installing user.

• CVE-2018-25384MEDIUM 5.4

  Wikidforum 2.20 has a stored cross-site scripting (XSS) flaw that lets authenticated users inject malicious JavaScript into forum replies. When other users view those compromised posts through the rpc.php endpoint, the injected code executes in their browsers, potentially stealing session cookies, redirecting to phishing pages, or performing unauthorized actions on their behalf.

• CVE-2019-25739MEDIUM 5.4

  GigToDo version 1.3 is vulnerable to a stored cross-site scripting (XSS) attack. An authenticated user can inject malicious JavaScript or HTML code into a proposal description field. When other users—particularly administrators—view that proposal, the attacker's code executes in their browser, potentially stealing session cookies or redirecting them to malicious sites. The vulnerability requires an attacker to already have valid login credentials, but the impact affects anyone who later views the compromised proposal.

• CVE-2019-25742MEDIUM 5.4

  The Zoner Real Estate WordPress theme version 4.1.1 has a stored cross-site scripting (XSS) flaw in its property creation form. Authenticated real estate agents can inject malicious JavaScript into the property's address field, and that script will execute when site administrators review the property for approval. This could allow attackers to steal admin session cookies or hijack their accounts.

• CVE-2019-25743MEDIUM 5.4

  WordPress Soliloquy Lite version 2.5.6 contains a stored cross-site scripting (XSS) vulnerability in its post editing functionality. An authenticated attacker can inject malicious JavaScript code into a post's title field, which persists in the WordPress database. When other users—particularly administrators or editors—preview that post, the injected script executes in their browser, potentially compromising their session or enabling further attacks. The vulnerability requires an attacker to have valid WordPress credentials but does not require tricking users into clicking malicious links, making it a genuine persistence risk in multi-user WordPress environments.

• CVE-2019-25744MEDIUM 5.4

  WordPress Popup Builder version 3.49 contains a stored cross-site scripting (XSS) flaw that allows authenticated users to inject malicious JavaScript into posts or pages. An attacker with WordPress login credentials can craft a specially formatted post title containing script code that breaks out of HTML option tags, causing the malicious script to execute in the browsers of site visitors viewing popup selections. This is a persistence vulnerability—the injected code remains in the database and executes repeatedly.

• CVE-2026-10213MEDIUM 5.4

  AstrBot version 4.23.6 contains a path traversal vulnerability in its API endpoint that handles skill deletion. An authenticated attacker can manipulate the Name parameter to traverse the file system and read or modify files outside the intended directory structure. The vulnerability is network-accessible and does not require user interaction beyond the attacker having valid credentials. Public exploit code is available, increasing the risk of active exploitation.

• CVE-2026-10218MEDIUM 5.4

  A security flaw exists in nextlevelbuilder GoClaw versions up to 3.11.3 that allows authenticated users to perform actions they shouldn't be authorized to perform. The vulnerability resides in the authentication logic of the application and can be exploited remotely by someone with valid login credentials. Because the flaw has been publicly disclosed, there's elevated risk that attackers may attempt to exploit it.

• CVE-2026-10284MEDIUM 5.4

  A security flaw in DevaslanPHP project-management versions up to 2.0.0-beta1 allows authenticated users to bypass authorization controls when editing or deleting comments in ticket management workflows. An attacker with login credentials can manipulate comment-related functions to perform actions they shouldn't be authorized to perform, such as deleting or modifying comments belonging to other users. The issue resides in the Livewire handler component and can be exploited remotely without requiring additional user interaction.

• CVE-2026-10285MEDIUM 5.4

  DevaslanPHP project-management versions up to 2.0.0-beta1 contain an authorization flaw in the ticket handler component. An authenticated user can manipulate ticket records in ways they should not be permitted to perform, potentially modifying or deleting ticket data without proper access controls. The vulnerability requires an existing login but can be exploited remotely over the network.

• CVE-2026-10984MEDIUM 5.4

  Google Chrome on Android contains a flaw in how it handles accessibility features that allows attackers to trick users with a fake interface. By hosting a malicious webpage, an attacker can make Chrome display misleading or fraudulent content that mimics legitimate UI elements, potentially deceiving users into performing unintended actions. The vulnerability requires user interaction—specifically, a user must visit the crafted page—but does not require special privileges or complex setup.

• CVE-2026-11157MEDIUM 5.4

  A script injection vulnerability in Google Chrome's accessibility features allows attackers to inject arbitrary scripts and HTML into web pages if a user installs a malicious extension. The vulnerability, tracked as CVE-2026-11157, requires user interaction (installing an extension) to exploit, making it a social engineering vector rather than a network-based attack. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-11232MEDIUM 5.4

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the TabGroups feature handles network input, allowing attackers to deceive users through fake or misleading visual elements in the browser interface. An attacker would need to trick a user into visiting a malicious website or intercepting network traffic, but the actual attack surface is relatively narrow—the vulnerability requires user interaction and does not enable data theft or system crashes on its own.

• CVE-2026-11243MEDIUM 5.4

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles downloads that allows an attacker to bypass navigation restrictions by serving a specially crafted web page. When a user visits the malicious page, the browser's normal safeguards that prevent unwanted navigation can be circumvented, potentially allowing redirection to unintended destinations or other restricted actions. The vulnerability requires user interaction (clicking or visiting a page) and affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11466MEDIUM 5.4

  Zilliz's deep-searcher library contains an access control vulnerability in its collection routing logic. An authenticated attacker can manipulate function arguments to bypass intended restrictions, gaining unauthorized read access to data or causing service disruption. The issue affects versions up to 0.0.2, and exploit code is now publicly available, raising the risk of opportunistic attacks.

• CVE-2026-11467MEDIUM 5.4

  A path traversal vulnerability exists in jishenghua jshERP versions up to 3.6. An authenticated attacker can manipulate the fileName parameter in the addAccountHeadAndDetail endpoint to write or access files outside the intended directory. Because the vulnerability requires valid credentials to exploit, the immediate risk is constrained to insider threats or compromised accounts. However, the public disclosure of the issue increases the likelihood of exploitation attempts.

• CVE-2026-11533MEDIUM 5.4

  A vulnerability in the imvks786 student_management_system allows an authenticated user to bypass authorization controls on the student deletion function. By manipulating a parameter called 'del' in the /see.php endpoint, an attacker with login credentials can perform unauthorized deletions of student records. The vulnerability requires valid authentication but does not need special privileges, meaning any logged-in user—including those with limited access—could exploit it. Public disclosure has occurred, increasing the likelihood of active exploitation.

• CVE-2026-11569MEDIUM 5.4

  Quay, a container image registry platform, contains a vulnerability in its file upload endpoint that fails to properly validate file types. An authenticated user with write access to a repository can exploit this to upload a malicious SVG file containing embedded JavaScript code. Because the file is stored and then served inline by the CDN without proper content-type restrictions, any user visiting the archive URL will have that JavaScript execute in their browser—a stored cross-site scripting attack. The vulnerability requires an attacker to already have repository write permissions and the victim to click a link, which limits but does not eliminate risk in collaborative development environments.

• CVE-2026-11666MEDIUM 5.4

  Google Chrome versions prior to 149.0.7827.103 contain a flaw where the browser fails to properly validate user-supplied input in certain UI elements. An attacker can exploit this by crafting a malicious HTML page that, when visited, displays fake browser UI components or dialogs—a technique known as UI spoofing. This could trick users into believing they're interacting with legitimate Chrome interface elements, potentially leading to credential theft, social engineering attacks, or other user-directed compromise. The vulnerability requires user interaction (visiting the crafted page) but no special privileges, making it a concern for general web browsing.

• CVE-2026-11701MEDIUM 5.4

  Google Chrome versions before 149.0.7827.103 contain a flaw in how the Guest View feature handles crafted HTML pages, allowing attackers to trick users with fake or misleading interface elements. An attacker would need to host a malicious webpage and convince a user to visit it while Chrome's Guest View is active. The vulnerability does not allow data theft or system compromise on its own, but the spoofed interface could be used to deceive users into taking actions they wouldn't otherwise take.

• CVE-2026-24754MEDIUM 5.4

  Kiteworks, a private data network platform used for secure file sharing and collaboration, contains a stored cross-site scripting (XSS) vulnerability in its Secure Data Forms feature. An authenticated user with legitimate access could craft malicious input that persists in the application and executes in other users' browsers when they view the affected form. This allows the attacker to steal session tokens, perform actions on behalf of victims, or harvest sensitive data passing through their sessions. The vulnerability requires prior authentication and user interaction (clicking a link or viewing a page), limiting but not eliminating its risk. Kiteworks versions before 9.3.0 are affected; upgrading resolves the issue.

• CVE-2026-24755MEDIUM 5.4

  Kiteworks, a platform for secure data sharing and management, contains a flaw in its Secure Data Forms feature that allows logged-in users to change permissions on files and folders belonging to other users. The vulnerability stems from the system not properly verifying whether a user actually owns or has authority over a resource before allowing permission changes. An attacker with valid credentials could exploit this to gain access to, or revoke access from, other users' sensitive data without authorization.

• CVE-2026-26378MEDIUM 5.4

  Koha, an open-source library management system, contains a cross-site scripting (XSS) vulnerability in its Invoice feature file upload functionality. An authenticated attacker can craft a malicious file upload that executes arbitrary code in the browsers of users who interact with the uploaded invoice. The vulnerability affects Koha version 25.11 and earlier. Exploitation requires an attacker to have valid library system credentials and user interaction—typically a staff member viewing or processing the invoice.

• CVE-2026-27351MEDIUM 5.4

  Sekander Badsha Crew HRM contains a missing authorization vulnerability that allows authenticated users to perform actions they should not be permitted to perform due to incorrectly configured access controls. An attacker with valid login credentials can exploit weak permission checks to modify data or disrupt availability, even if their role should restrict such access.

• CVE-2026-33113MEDIUM 5.4

  Microsoft Office SharePoint contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. When a user visits a compromised SharePoint page, the injected code executes in their browser, potentially allowing the attacker to steal session tokens, redirect users to phishing sites, or perform actions on behalf of the victim. This is a reflected or stored XSS flaw—the vulnerability itself requires user interaction to trigger, but the impact can be significant for organizations relying on SharePoint for document collaboration and intranet services.

• CVE-2026-33244MEDIUM 5.4

  React Router versions 7.5.1 through 7.13.1 contain a cross-site scripting (XSS) vulnerability when used in Framework Mode with pre-rendering. If your application redirects users to untrusted URLs and generates static HTML files during build time, attackers can inject malicious scripts into those pre-rendered pages. This vulnerability does not affect applications using the more common Declarative Mode or Data Mode routing approaches. The issue has been fixed in version 7.13.2.

• CVE-2026-34033MEDIUM 5.4

  Apache Answer contains a cross-site scripting (XSS) vulnerability in its notification email system. When authenticated users include content in certain fields, that content reaches other users' inboxes without proper HTML escaping, potentially allowing injection of malicious scripts. An attacker with valid credentials could craft messages designed to execute code when recipients open their emails or click embedded links. This affects Apache Answer versions through 2.0.0.

• CVE-2026-34460MEDIUM 5.4

  NamelessMC, a website platform for Minecraft servers, contains a vulnerability in how it handles OAuth authentication callbacks. When a user logs in via OAuth (a third-party authentication method), the application fails to verify a security token called a 'state parameter' before accepting the login. An attacker can exploit this by crafting a malicious link that tricks a victim into logging in with the attacker's own account credentials. Once clicked, the victim's session becomes authenticated as the attacker, potentially granting unauthorized access to the victim's account on that NamelessMC instance. The vulnerability affects NamelessMC versions 2.2.4 and earlier.

• CVE-2026-34507MEDIUM 5.4

  OpenClaw versions before 2026.4.29 contain a flaw that allows authenticated users to bypass security policies protecting sensitive admin commands. Specifically, attackers can circumvent message delivery restrictions (DM-only policy) and sender authorization checks (allowFrom policy), enabling them to execute administrative functions from contexts or senders that should be blocked. The vulnerability requires an attacker to already have authentication credentials, limiting its blast radius but creating insider risk and account compromise scenarios.

• CVE-2026-34692MEDIUM 5.4

  Adobe Experience Manager contains a cross-site scripting (XSS) flaw that allows attackers to inject and execute malicious JavaScript in a user's browser. The attack requires tricking a victim into visiting a specially crafted webpage while authenticated to AEM. Once executed, the attacker can steal session data, modify page content, or perform actions on behalf of the victim within the AEM interface.

• CVE-2026-40930MEDIUM 5.4

  A parsing flaw in libpng 1.8.0's APNG (Animated PNG) handler can cause specially crafted image data to be misinterpreted. When the parser encounters certain frame chunks in an APNG file, it clears internal state flags but fails to skip over the actual chunk data and checksum. On the next data processing call, bytes from the ignored chunk can masquerade as a new chunk header, potentially leading to integrity violations or denial of service. An attacker needs user interaction—typically opening a malicious PNG file—to trigger the issue.

• CVE-2026-41972MEDIUM 5.4

  CVE-2026-41972 is a path traversal vulnerability in an SMS application that could allow an attacker to manipulate file paths and disrupt service availability. The vulnerability requires user interaction (such as clicking a malicious link) but does not require authentication, making it accessible to remote attackers. While the flaw does not compromise confidentiality or enable data theft, it can degrade or interrupt the SMS app's normal operation.

• CVE-2026-42547MEDIUM 5.4

  IRIS, a web platform used by incident response teams to collaborate and share investigation details, contains an authorization flaw in versions before 2.4.28 that allows users to create alerts falsely attributed to customers they don't manage. When combined with cross-site scripting vulnerabilities, attackers can also steal alerts belonging to other customers. This means a low-privileged user could pollute another team's alert stream with fraudulent incidents or harvest sensitive investigation data.

• CVE-2026-42951MEDIUM 5.4

  A vulnerability in Danelec MacGregor Voyage Data Recorder (VDR) devices allows authenticated users to download a complete backup file that exposes sensitive account credentials and password hashes. While an attacker must already have valid user credentials to exploit this issue, successful exploitation grants access to password material that could enable lateral movement or privilege escalation within maritime network environments. The vulnerability is classified as medium severity due to the authentication requirement, though the disclosure of password hashes represents a meaningful step toward further compromise.

• CVE-2026-44611MEDIUM 5.4

  Danelec MacGregor's Voyage Data Recorder (VDR) uses a weak password hashing method that restricts password length and is vulnerable to brute force attacks. An authenticated attacker with local network access could potentially crack stored passwords to gain unauthorized access to the device or escalate privileges. This is a medium-severity issue affecting maritime safety and navigation systems.

• CVE-2026-44794MEDIUM 5.4

  Nautobot, a network automation platform, contains a permission bypass vulnerability in its REST API that affects how it validates references between database objects. When users create or update records that link to other objects in the system, the API fails to properly check whether the user has permission to view those referenced objects. This means an authenticated user could potentially reference objects they shouldn't have access to, leading to information disclosure or unintended modifications. The issue affects Nautobot versions before 2.4.33 and 3.1.2.

• CVE-2026-45023MEDIUM 5.4

  AutoGPT versions before 0.6.59 contain a flaw in their API implementation that allows authenticated users to execute workflow blocks without consuming credits from their account balance. The vulnerability stems from an API endpoint that bypasses the credit-checking logic present elsewhere in the system, enabling users to run unlimited blocks at no cost. This is a business model violation rather than a critical system compromise, but it undermines the platform's monetization and resource management controls.

• CVE-2026-45453MEDIUM 5.4

  CVE-2026-45453 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows attackers to inject malicious scripts into web pages. When a user visits a compromised page, the attacker's script executes in their browser, enabling spoofing attacks—such as stealing credentials, impersonating legitimate content, or redirecting users to phishing sites. The vulnerability requires user interaction (clicking a malicious link or visiting a crafted URL) but does not require authentication to exploit.

• CVE-2026-45464MEDIUM 5.4

  CVE-2026-45464 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows attackers to inject malicious scripts into web pages. An attacker can trick users into visiting a crafted SharePoint page, causing their browser to execute the injected code. This enables spoofing attacks where legitimate content or UI elements can be forged to deceive users into divulging credentials, transferring funds, or trusting false information. The vulnerability requires user interaction—a person must click a malicious link or visit a compromised page—but the attacker does not need authentication to craft the attack.

• CVE-2026-45465MEDIUM 5.4

  CVE-2026-45465 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an attacker to inject malicious code into web pages generated by the application. When a user visits a compromised page, the injected script executes in their browser, potentially stealing session tokens, credentials, or performing actions on behalf of the victim. The vulnerability requires user interaction—someone must click a malicious link or visit a booby-trapped SharePoint page—but no special privileges are needed to launch the attack. This is a spoofing risk, meaning attackers could impersonate legitimate SharePoint content or trusted users.

• CVE-2026-45580MEDIUM 5.4

  WWBN AVideo, an open-source video streaming platform, contains a stored cross-site scripting (XSS) vulnerability in its Live plugin. A user with streaming permissions can inject malicious JavaScript into the stream configuration, which then executes in the browsers of anyone—logged-in or anonymous—who views that live stream. The vulnerability persists because user-controlled input (the stream key) is inserted directly into an HTML class attribute without proper sanitization.

• CVE-2026-45595MEDIUM 5.4

  Windows Mark of the Web (MOTW) is a security feature that warns users when they open files downloaded from the internet. CVE-2026-45595 is a flaw that allows attackers to bypass this warning through network-based attacks. An attacker could craft a malicious file that appears safe to the operating system, potentially tricking users into executing it without the usual security prompts. While the vulnerability requires user interaction to be exploited, it undermines a foundational defense mechanism in Windows.

• CVE-2026-45660MEDIUM 5.4

  Statamic is a content management system built on Laravel that includes an image proxy feature called Glide. A flaw in how this proxy validates URLs allows attackers to bypass security checks by using alternate IP address formats that aren't properly normalized before validation. An unauthenticated attacker could exploit this to make the server fetch content from internal addresses—such as localhost, private networks, or cloud metadata services—potentially exposing sensitive information. The vulnerability only affects Statamic versions before 5.73.22 and 6.18.1, and does not impact deployments running PHP 8.3 or later.

• CVE-2026-45778MEDIUM 5.4

  OpenXDMoD, an open-source HPC (High Performance Computing) metrics collection and analysis framework, contains a stored cross-site scripting (XSS) vulnerability in user profiles combined with a password reset abuse vector. An authenticated attacker can inject malicious JavaScript into their profile, then weaponize the password reset feature to send victims a crafted link. When a victim clicks the link, the attacker's payload executes in their browser, enabling credential theft and account hijacking. All versions prior to 11.0.3 are affected.

• CVE-2026-47636MEDIUM 5.4

  CVE-2026-47636 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows attackers to inject malicious scripts into web pages. When a user visits a specially crafted SharePoint page, the injected code executes in their browser with their privileges, enabling attackers to impersonate users, steal session data, or perform actions on their behalf. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require authentication to exploit.

• CVE-2026-47639MEDIUM 5.4

  CVE-2026-47639 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an attacker to inject malicious scripts into web pages. When a user visits a compromised page, the attacker's script executes in their browser, potentially stealing credentials, session tokens, or sensitive data, or redirecting users to fraudulent sites. Exploitation requires user interaction—the victim must click a link or visit a crafted page—but no authentication is needed from the attacker's side.

• CVE-2026-47694MEDIUM 5.4

  WWBN AVideo, an open-source video platform, contains a stored cross-site scripting (XSS) vulnerability in how it handles category descriptions. Any user with permission to create or modify video categories can inject malicious JavaScript code into the description field. This code then executes in the browsers of other users who view that category's gallery page. Unlike previously patched XSS issues affecting video titles or comments, this flaw specifically targets the category description rendering pipeline.

• CVE-2026-47935MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) flaw that allows an attacker to inject malicious JavaScript code into a victim's browser session. The vulnerability affects multiple versions up to 6.5.24, LTS SP1, and 2026.04. An attacker must trick a user into visiting a specially crafted webpage to trigger the exploit, but once executed, the malicious script runs with the victim's privileges and can access or modify sensitive data within the AEM application context across different origin boundaries.

• CVE-2026-47936MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw that allows attackers with basic user permissions to embed malicious code into form fields. When other users view those pages, the attacker's JavaScript runs in their browsers. This is particularly concerning because the injected script can affect other domains or applications (indicated by the changed scope), potentially compromising session tokens or sensitive data from multiple contexts.

• CVE-2026-47939MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting (XSS) vulnerability that allows low-privileged users to inject malicious JavaScript into form fields. When other users view pages containing these compromised fields, the injected scripts execute in their browsers. This is a persistence threat—the malicious payload remains in the system until remediated, affecting anyone who accesses the affected content.