2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 9 of 41

• CVE-2026-56646MEDIUM 6.5

  Microsoft Edge (Chromium-based) contains a flaw that exposes sensitive information to unauthorized actors, enabling spoofing attacks over the network. An attacker can trick users into visiting malicious content, then leverage the exposed data to impersonate trusted entities or websites. This is a medium-severity issue that requires user interaction to trigger.

• CVE-2026-56695MEDIUM 6.5

  OpenHarness ohmo gateway contains a configuration flaw where two slash commands—/resume and /summary—treat all authenticated users as capable of invoking remote operations by default. An attacker with legitimate access to a shared gateway channel can exploit this to discover and retrieve session snapshots belonging to other users simply by guessing or enumerating snapshot IDs. These snapshots may contain sensitive information such as system prompts, stored credentials, tool execution results, and internal file paths.

• CVE-2026-56701MEDIUM 6.5

  Grav, a flat-file CMS, contains a vulnerability in how it processes SVG file uploads. An authenticated user can upload a specially crafted SVG file containing XML external entity (XXE) instructions. When the application parses this file, it reads and exfiltrates sensitive files from the server—such as configuration files, credentials, or other confidential data—without proper access controls. The flaw stems from the use of PHP's simplexml_load_string function without disabling external entity expansion, a well-known XML parsing pitfall.

• CVE-2026-56783MEDIUM 6.5

  Parseable versions before 2.9.2 leak sensitive credentials and internal URLs to any authenticated user who has permission to view alerts. The vulnerability exists in the notification configuration API, which exposes webhook tokens and basic authentication passwords in plain text because the code that should hide these secrets has been commented out. A low-privilege analyst could retrieve all configured notification target credentials by making a simple API call, potentially compromising downstream systems that trust those credentials.

• CVE-2026-56787MEDIUM 6.5

  RTKLIB versions up to 2.4.3 contain a bug in how they parse RTCM3 satellite correction messages. An attacker can craft malicious correction data that causes the software to read beyond allocated memory boundaries, leading to crashes or potential information disclosure. This affects GPS/GNSS systems that rely on RTKLIB for real-time positioning, particularly rover applications and CORS (Continuously Operating Reference Station) networks that receive corrections over the internet or serial links.

• CVE-2026-56789MEDIUM 6.5

  RTKLIB, a widely-used open-source library for GNSS positioning, contains a memory corruption flaw in how it parses satellite observation data from RINEX files. An attacker can craft a malicious RINEX file that declares an impossibly high number of satellites in a single epoch (more than the valid limit of 64) to trigger a heap buffer overflow. This can crash RTKLIB applications like rnx2rtkp and RTKPOST, potentially disrupting surveying, navigation, and geospatial workflows that depend on these tools.

• CVE-2026-57019MEDIUM 6.5

  A vulnerability in Juniper Networks Junos OS on MX Series routers allows an attacker on the same local network to crash a Forwarding Card (FPC) by sending a specially crafted packet. The device incorrectly calculates packet size in certain traffic scenarios, causing processing to fail and triggering a hardware reset. While the system recovers automatically, traffic is interrupted until that recovery completes, making this a localized denial-of-service risk for networks running vulnerable MX platforms.

• CVE-2026-57020MEDIUM 6.5

  Juniper Networks QFX10000 switches running Junos OS contain a flaw in how they handle IPv6 multicast traffic in EVPN-VxLAN environments. When an attacker on the same network segment sends malicious IPv6 multicast packets to a spine switch's non-IRB interface, the switch forwards them in an endless loop across fabric links and leaf switches. This causes network congestion that can degrade or block legitimate traffic. The vulnerability requires adjacent network access but no authentication, making it exploitable by insider threats or compromised devices on the same segment.

• CVE-2026-57027MEDIUM 6.5

  Juniper Junos OS running on EX4100 and EX4400 Series switches contains a memory leak in the packet forwarding engine when sFlow monitoring is enabled in a Virtual Chassis configuration. When multicast traffic crosses between chassis members, memory accumulates and is never freed, eventually exhausting buffer capacity and crashing the forwarding processor. An attacker on the adjacent network segment can trigger this condition repeatedly to deny service to the affected switch.

• CVE-2026-57032MEDIUM 6.5

  Juniper Networks EX Series switches have a vulnerability that allows authenticated users with basic access to crash the packet forwarding engine by requesting unsupported telemetry data through gRPC connections. When triggered, the forwarding processor (FPC) module crashes, taking the switch offline until it automatically restarts. This affects EX2300, EX3400, EX4000, EX4100, and EX4400 models running unpatched versions of Junos OS.

• CVE-2026-57204MEDIUM 6.5

  pypdf, a widely-used open-source Python library for working with PDF files, contains a denial-of-service vulnerability that allows an attacker to craft a malicious PDF capable of consuming excessive memory on systems that parse it. The flaw stems from the library's failure to properly enforce memory limits when processing PDF content streams that lack explicit length declarations. An attacker would need to trick a user into opening or processing such a PDF, but once they do, the parsing operation can exhaust available memory and crash or severely degrade the affected application.

• CVE-2026-57259MEDIUM 6.5

  CVE-2026-57259 is a file-access vulnerability in Foxit PDF Editor and Reader that allows attackers to steal local files from affected users. The flaw exploits loose validation of PDF structure: an attacker can disguise a malicious document as a PDF, embed external entity references that point to local file paths, and trick a user into opening it. The parser then sends the referenced files back to the attacker. This requires user interaction (opening a file) but no authentication, and success depends only on the victim's file system permissions. The vulnerability affects Windows systems running vulnerable Foxit products.

• CVE-2026-57329MEDIUM 6.5

  WooCommerce Designer Pro versions 1.9.34 and earlier contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into pages viewed by other subscribers. An attacker with login credentials could craft specially-formatted input that executes arbitrary JavaScript in the browsers of site visitors or other authenticated users, potentially stealing session tokens, modifying page content, or performing unwanted actions on their behalf.

• CVE-2026-57341MEDIUM 6.5

  A vulnerability in the Colissimo Officiel shipping plugin for WooCommerce (versions 2.9.0 and earlier) allows attackers to access or modify delivery-related data without authentication. By directly referencing internal object identifiers in API requests, an attacker can bypass authorization checks to view shipping information or alter delivery methods for orders they don't own. This is an Insecure Direct Object Reference (IDOR) vulnerability that requires no special privileges or user interaction to exploit.

• CVE-2026-57342MEDIUM 6.5

  ShortPixel Adaptive Images, a WordPress plugin used for image optimization, contains a cross-site scripting (XSS) vulnerability in versions 3.11.3 and earlier. The flaw allows authenticated users to inject malicious JavaScript that executes in the browsers of other users, including administrators. This could lead to unauthorized actions, session hijacking, or data theft within the WordPress environment.

• CVE-2026-5737MEDIUM 6.5

  The Independent Analytics WordPress plugin has a flaw that lets unauthenticated attackers make the server fetch files from anywhere on the internet or internal networks. The issue stems from two weaknesses: the plugin accepts attacker-controlled domain names via a public API endpoint, and a background job that downloads favicons doesn't validate where those requests go. By crafting a request with a forged signature (which is feasible because the signing key is embedded in public JavaScript), an attacker can inject a malicious domain into the database. When the favicon fetcher runs, it will make requests to that domain on behalf of your server, potentially exposing internal services or exfiltrating data.

• CVE-2026-57453MEDIUM 6.5

  Vim's bundled zip plugin has a command injection vulnerability when it falls back to PowerShell to work with zip archives on Windows systems. When you open or extract a crafted zip file with a specially designed entry name, the plugin constructs a PowerShell command that improperly quotes the filename. An attacker can exploit this quoting flaw to inject arbitrary PowerShell commands that execute with your user privileges. The vulnerability affects Vim versions 9.1.1784 through 9.2.0677 and is resolved in 9.2.0678.

• CVE-2026-57620MEDIUM 6.5

  A stored cross-site scripting (XSS) vulnerability exists in Tim Strifler's Exclusive Addons for Elementor, a WordPress page builder plugin. An authenticated user with lower privileges can inject malicious JavaScript code that persists in the database and executes in the browsers of other users—including administrators—when they view affected content. This allows attackers to steal session tokens, capture credentials, modify page content, or perform actions on behalf of higher-privileged users.

• CVE-2026-57635MEDIUM 6.5

  FunnelKit Payment Gateway for Stripe, a WooCommerce plugin, contains a Cross-Site Request Forgery (CSRF) vulnerability in versions up to 1.14.0.3. An attacker can trick users into performing unwanted actions—such as modifying payment settings or processing unauthorized transactions—by crafting a malicious webpage and enticing a victim to visit it while logged into their WooCommerce store. No authentication is required from the attacker, and the victim's browser automatically includes their session credentials, making the attack silent and difficult to detect.

• CVE-2026-57641MEDIUM 6.5

  Real Estate 7 versions 3.5.9 and earlier are vulnerable to cross-site request forgery (CSRF) attacks that do not require prior authentication. An attacker can trick a user into unknowingly triggering malicious actions within the application by hosting a specially crafted webpage or email. Since the vulnerability allows unauthenticated exploitation, any visitor to a compromised site or user who clicks a malicious link is at risk, regardless of whether they have an active session in Real Estate 7.

• CVE-2026-57669MEDIUM 6.5

  A broken access control flaw exists in Advanced Contact Form 7 DB versions up to and including 2.0.9. An authenticated subscriber with low privileges can access or read sensitive contact form data they should not be permitted to view. The vulnerability requires an existing user account but no special interaction, making it a practical concern for WordPress sites using this plugin where user roles and data segregation matter.

• CVE-2026-57737MEDIUM 6.5

  A cross-site scripting (XSS) vulnerability exists in the Shortcodes and extra features for Phlox theme, a WordPress plugin by Averta LTD. The flaw allows authenticated users to inject malicious scripts that execute in other users' browsers when they view affected pages. An attacker with login credentials could craft a malicious shortcode or page element that steals session tokens, performs actions on behalf of administrators, or defaces site content. The vulnerability affects all versions up to and including 2.17.16.

• CVE-2026-57754MEDIUM 6.5

  A cross-site scripting (XSS) vulnerability exists in Livemesh Addons for WPBakery Page Builder affecting versions 3.9.4 and earlier. The flaw allows authenticated contributors to inject malicious scripts into the page builder interface, which then execute in the browsers of other site administrators or users who view the affected content. This is a contributor-level attack—meaning someone with author or contributor permissions (not necessarily an admin) can exploit it.

• CVE-2026-57755MEDIUM 6.5

  Mosaic Gallery — Advanced Gallery plugin versions 1.2.0 and earlier contain a cross-site scripting (XSS) vulnerability that allows authenticated contributors to inject malicious scripts. When a site administrator or user with higher privileges views the gallery, the injected code executes in their browser, potentially compromising their session or account. This is a contributor-level attack, meaning the threat actor must already have posting/contribution rights to the site.

• CVE-2026-57764MEDIUM 6.5

  A cross-site scripting (XSS) vulnerability exists in the Surbma Yoast SEO Breadcrumb Shortcode plugin for WordPress in version 1.2 and earlier. An authenticated user with contributor-level access or higher can inject malicious scripts that execute in the browsers of other site visitors, potentially stealing session data, credentials, or performing actions on their behalf. The vulnerability requires user interaction (such as viewing a page containing the malicious breadcrumb) to trigger the attack.

• CVE-2026-57914MEDIUM 6.5

  Apache Kerby, a Kerberos protocol implementation, contains a vulnerability where specially crafted deeply nested ASN.1 structures can cause a stack overflow, crashing the affected service or client. This results in a denial-of-service condition that prevents legitimate users from accessing the service. The vulnerability requires an authenticated user to exploit, meaning an attacker must already have valid credentials or network access to send the malicious message.

• CVE-2026-5792MEDIUM 6.5

  A flaw in Hedef Media Promotion's Related Marketing Cloud (RMC) platform allows attackers to bypass authentication by spoofing user identities. This vulnerability can be exploited through brute force attacks without requiring any prior credentials or special user interaction. An attacker on the network can attempt repeated login attempts to gain unauthorized access to accounts.

• CVE-2026-57949MEDIUM 6.5

  RuoYi-Vue-Pro versions up to 2026.05 contain a flaw in the CRM module that allows logged-in users to view follow-up records belonging to other users. The vulnerability exists in the GET /admin-api/crm/follow-up-record/get endpoint, which fails to verify that a user should have access to a specific record before returning it. An attacker can guess or iterate through record IDs to retrieve sensitive information including notes, attachments, scheduling data, and linked business entities. This is an insecure direct object reference (IDOR) vulnerability that requires valid credentials but places no restrictions on which records an authenticated user can read.

• CVE-2026-57951MEDIUM 6.5

  Mythic command and control framework versions before 3.4.0.60 suffer from a database access control flaw that allows authenticated users to read sensitive output from any operation on the server, regardless of their assigned permissions. The vulnerability stems from a misconfigured permission filter in the backend that treats an OR condition as always-true, effectively removing restrictions. Any user with valid credentials—including those with minimal spectator roles—can extract step output, names, and descriptions from the payload_build_step table across all operations.

• CVE-2026-57960MEDIUM 6.5

  Hi.Events versions up to 1.9.0 contain a flaw in their public check-in endpoints that relies solely on a short identifier (short_id) to control access. An attacker who discovers or guesses this short_id can retrieve sensitive attendee information—including full names and email addresses—without needing any authentication credentials. The same flaw also permits unauthorized creation or deletion of check-in records, effectively allowing tampering with event attendance tracking.

• CVE-2026-57963MEDIUM 6.5

  Thunderbird users who receive HTML-formatted chat messages over Matrix or XMPP protocols are at risk from attackers who can inject malicious styled content and phishing links. An attacker can craft messages that manipulate the chat interface's visual presentation using CSS, potentially tricking users into clicking harmful links or revealing credentials. The vulnerability requires no authentication and can be triggered simply by sending a specially crafted message to a user, making it a network-accessible threat.

• CVE-2026-57987MEDIUM 6.5

  Microsoft Edge (Chromium-based) contains a server-side request forgery (SSRF) vulnerability that allows attackers to trick the browser into making unauthorized requests to internal or external systems on behalf of a user. An attacker would need to craft a malicious webpage or link that, when visited by a user, causes Edge to fetch resources or interact with services the user doesn't intend to access. The vulnerability could expose sensitive information accessible from the user's network perspective, such as internal service responses, metadata, or configuration details. This is not a vulnerability that spreads on its own or affects systems passively—user interaction is required for exploitation.

• CVE-2026-58010MEDIUM 6.5

  A flaw in GLib's variant serialization code contains an off-by-one error in boundary checking that allows reading one byte beyond intended memory limits. This can leak a small amount of sensitive data or crash applications when the out-of-bounds access crosses memory page boundaries. The vulnerability affects GLib across multiple Linux distributions and requires network access to exploit in most deployment scenarios.

• CVE-2026-58011MEDIUM 6.5

  A bug in GLib's date-time handling can cause an out-of-bounds memory read when processing malformed date objects. This flaw corrupts date calculations and may trigger denial-of-service conditions. The vulnerability requires no authentication and can be triggered remotely, making it moderately serious for systems that parse or manipulate dates via affected GLib versions.

• CVE-2026-58012MEDIUM 6.5

  GLib contains a buffer over-read vulnerability in its regex replacement function that occurs when specific compilation flags and string handling options interact. When the `g_regex_replace` function processes matched text with the `G_REGEX_RAW` flag enabled and case-change escape sequences, it attempts to interpret raw byte data as valid UTF-8, leading to reading beyond allocated buffer boundaries. The vulnerability can leak a small amount of adjacent memory and trigger application crashes if the overread crosses memory page boundaries, making it a moderate risk to availability and confidentiality.

• CVE-2026-58013MEDIUM 6.5

  GLib contains a buffer over-read vulnerability in its I/O channel line-reading function. When an application uses a custom line terminator longer than one character, the vulnerable code reads beyond the intended buffer boundary. This can leak a small amount of memory or crash the application if the read extends into unmapped memory. The issue is triggered when parsing input with unusual line terminators, which may or may not be common in typical deployments.

• CVE-2026-58027MEDIUM 6.5

  A Wikimedia Foundation AbuseFilter component is exposing sensitive information that should be restricted to authorized users. The vulnerability requires an authenticated user to trigger, and affects the API filter query functionality. While the issue doesn't allow attackers to modify data or disrupt service, the confidentiality impact is significant—affected versions leak information through the includes/Api/QueryAbuseFilters.Php file that authenticated users shouldn't access.

• CVE-2026-58029MEDIUM 6.5

  A vulnerability in MediaWiki's authentication handling allows attackers to compromise user account security. The flaw resides in how the software processes authentication-related API calls and account linking operations. An attacker can exploit this without authentication or user interaction to gain unauthorized access to user accounts or modify account credentials, though the vulnerability does not enable full system compromise or data destruction.

• CVE-2026-58033MEDIUM 6.5

  MediaWiki contains a vulnerability that can expose sensitive information to unauthorized users. The issue exists in the InfoAction component and requires user interaction to trigger. An attacker cannot exploit this remotely without the target user taking an action (such as clicking a link), but once triggered, the vulnerability can leak confidential data that should remain protected.

• CVE-2026-58051MEDIUM 6.5

  libssh2, a widely-used SSH protocol library, contains a memory safety bug affecting versions through 1.11.1. When a malicious SSH server sends a crafted response during publickey subsystem negotiation, libssh2 can fail to properly initialize new entries in its public key list. If parsing then fails, the cleanup routine attempts to free memory that was never initialized, potentially executing arbitrary code or causing a denial of service. An attacker controlling an SSH server can trigger this condition without any special privileges or user interaction.

• CVE-2026-58058MEDIUM 6.5

  Nmap versions up to 7.99 contain a flaw in how they process IPv6 extension headers during network scanning. When a target or intermediary sends back a specially crafted IPv6 response with a truncated extension header, Nmap's pointer tracking can advance past the legitimate packet data. This causes the remaining-length counter to underflow—rolling over to an unexpectedly large number—leading to out-of-bounds memory reads and potential crashes. The issue is triggered specifically during raw IPv6 scans and requires no user interaction or authentication.

• CVE-2026-58167MEDIUM 6.5

  Nightingale (n9e), an open-source observability platform, contains a credential disclosure vulnerability in its datasource management API. Any user with standard (low-privilege) access can retrieve the complete configuration of all connected data sources—including plaintext database passwords, API tokens, and encryption keys—through a single API endpoint. This happens because the endpoint lacks proper permission checks that are present on other similar operations, and the response is not filtered to remove sensitive fields. An attacker with legitimate low-privilege credentials can use disclosed secrets to gain unauthorized access to backend databases, monitoring systems, and other connected infrastructure.

• CVE-2026-58173MEDIUM 6.5

  Vibe-Trading versions before 0.1.10 contain a path traversal flaw in the persistent memory feature. An authenticated attacker can craft a malicious memory_type parameter to write arbitrary Markdown files to locations outside the intended application directory. This allows an attacker to potentially overwrite sensitive files or inject content in unintended places on the server filesystem.

• CVE-2026-58174MEDIUM 6.5

  Hermes WebUI has a flaw in how it handles imported sessions that allows a user with default profile access to read files from isolated named workspaces. When a session is imported, the application checks that the session belongs to the correct workspace, but then saves it without recording which profile it belongs to. This causes the system to treat it as a default profile session. An attacker can then export that imported session and use its identifier to access files they shouldn't have permission to view, bypassing the profile isolation controls that are meant to keep different user workspaces separate.

• CVE-2026-58176MEDIUM 6.5

  RuoYi-Vue-Plus is a workflow and task management platform. Versions through 5.6.2 contain a critical authorization gap: the workflow task management system fails to validate whether users should be allowed to perform sensitive actions. This means any employee with basic system access—regardless of their job role—can reassign approval tasks to themselves or others, see all pending approvals organization-wide, and manipulate the workflow process. This breaks the fundamental control that prevents one person from both initiating and approving the same transaction.

• CVE-2026-58191MEDIUM 6.5

  Appium's base-driver component has a reflected cross-site scripting (XSS) vulnerability affecting versions prior to 10.7.0. The vulnerability exists in three built-in test routes that unconditionally mount without restriction. When users visit these endpoints, the application reflects unsanitized input from query parameters, POST fields, and HTTP headers directly into the HTML response. An attacker can craft a malicious link or form that executes arbitrary JavaScript in the victim's browser within the Appium server's origin, potentially compromising sessions or sensitive data accessible to that context.

• CVE-2026-58251MEDIUM 6.5

  NATS Server, a widely-deployed messaging system for cloud and edge environments, contains an access control bypass in versions before 2.14.0, 2.12.7, and 2.11.16. An authenticated user who has been restricted from subscribing to certain message topics can circumvent those restrictions by using queue subscriptions—a legitimate NATS feature for load balancing. The server's permission logic fails to properly validate queue-based subscriptions against plain subject deny rules, allowing an attacker to access restricted message streams. This affects organizations relying on NATS for secure multi-tenant or sensitive workloads.

• CVE-2026-58252MEDIUM 6.5

  NATS Server versions before 2.14.0, 2.12.7, and 2.11.16 contain an authorization bypass flaw that allows authenticated users to receive messages on subjects they should not have access to. The vulnerability occurs when a user's wildcard subscription pattern overlaps with—but is not fully contained within—a configured wildcard deny rule. Additionally, queue subscriptions can be manipulated to deliver messages to unauthorized queue consumers. An attacker with valid credentials could exploit this to eavesdrop on restricted message streams without needing elevated privileges.

• CVE-2026-58254MEDIUM 6.5

  NATS Server, a widely-used messaging platform for cloud and edge deployments, has a flaw in how it validates trace destination requests from leafnode connections. Leafnodes are a federation mechanism that allows separate NATS clusters to communicate. An attacker with leafnode operator privileges can bypass message trace restrictions that would normally block such operations on direct client connections. This allows them to send unauthorized trace events to protected subjects and potentially disrupt normal message delivery or persistence by exploiting trace-only behavior.

• CVE-2026-58266MEDIUM 6.5

  Anki, a popular open-source flashcard application, contains a vulnerability that allows malicious card packages to bypass security restrictions and read files from your computer. The vulnerability exists because user scripts embedded in card packages can access Anki's internal API—which normally communicates between the application's interface and its backend—and exploit exposed methods to steal files. An attacker could craft a malicious card deck that, when imported, reads sensitive files and sends them over the network. The issue affects versions before 25.09.4 and is resolved in that release.

• CVE-2026-58374MEDIUM 6.5

  Hostapd, a widely-deployed open-source Wi-Fi access point management daemon, contains a memory safety bug in its Wi-Fi 7 (802.11be) Multi-Link Operation feature. An attacker within wireless range can send a specially crafted Wi-Fi management frame that causes the daemon to write data past the end of an allocated memory region. This happens during the initial connection phase, before any authentication occurs, and reliably crashes the hostapd process. The vulnerability requires only radio proximity and affects deployments running hostapd v2.11 and later versions built with Wi-Fi 7 support enabled.

• CVE-2026-58403MEDIUM 6.5

  Hugo, a popular static site generator, has a flaw in how it manages file access within mount boundaries. Versions 0.123.0 through 0.163.0 allow a symlink placed inside a theme or local mount to bypass directory restrictions and read arbitrary files from the server. An attacker who can contribute a malicious theme or alter a mounted directory could exploit this to access sensitive files that the Hugo process can read. The vulnerability requires user interaction—the user must run Hugo—but poses a meaningful confidentiality risk in collaborative or shared hosting environments. This has been patched in v0.163.1.

• CVE-2026-58446MEDIUM 6.5

  Presenton versions before 0.8.8-beta contain an authentication bypass in their bundled MCP (Model Context Protocol) server. When deployed on servers or Docker with username/password authentication enabled, the MCP endpoint at /mcp is accessible without logging in because the nginx reverse proxy doesn't enforce authentication checks on that path. Once accessed, the MCP server automatically creates a valid session token, allowing attackers to run tools like presentation generation, consume the operator's LLM API credits, and create presentations on the victim's instance. The Electron desktop client is unaffected because it doesn't bundle the MCP server.

• CVE-2026-58447MEDIUM 6.5

  Invidious, a privacy-focused YouTube alternative, contains an authorization flaw that allows any logged-in user to delete videos from other users' playlists. An attacker can obtain video index numbers from publicly available playlist data and use them to remove videos they don't own, causing permanent data loss. The vulnerability affects versions up to 2.20260626.0 and was fixed in commit 77ad416.

• CVE-2026-58448MEDIUM 6.5

  yudao-cloud versions before 2026.06 have a broken access control flaw in their BPM (Business Process Management) module. Any authenticated user can view process instance records they shouldn't have access to by crafting requests with process IDs. An attacker with valid login credentials can read sensitive workflow data belonging to other users or organizations—including form submissions, approver names, comments, and process definitions—without needing ownership or administrative rights.

• CVE-2026-58451MEDIUM 6.5

  Horde IMP versions before 7.0.1 contain a vulnerability that allows attackers with valid login credentials to read sensitive files directly from the server's filesystem. An attacker can craft malicious email with specially formatted image links that trick the application into retrieving arbitrary files instead of legitimate images. These stolen files can then be sent out as email attachments, exposing confidential data. Additionally, an attacker without credentials can exploit this if a legitimate user is currently logged in, using a technique called CSRF (cross-site request forgery) to perform the attack on their behalf.

• CVE-2026-58494MEDIUM 6.5

  Wasmtime is a WebAssembly runtime that enables sandboxed execution of wasm code. A permission-checking flaw in wasmtime-wasi (the WASI interface layer) allows a guest WebAssembly program with only read-only access to a file to bypass safety controls and modify or overwrite files on the host system that are exposed as read-only through the WASI filesystem interface. The vulnerability affects versions before 24.0.11, 36.0.12, 45.0.3, and 46.0.1, and stems from insufficient permission validation during hard-link creation and file renaming operations.

• CVE-2026-58523MEDIUM 6.5

  Microsoft Edge for Android contains an access control vulnerability that allows an attacker to bypass a security feature through network interaction. The vulnerability requires user interaction (such as clicking a malicious link) but does not require authentication. While an attacker cannot modify data or disrupt service, they can access confidential information the user would normally be restricted from viewing.

• CVE-2026-58578MEDIUM 6.5

  LobeChat before version 2.2.10-canary.15 has a regular expression denial of service (ReDoS) flaw. An authenticated attacker can supply a specially crafted GitHub repository URL during skill import that causes the application to enter a CPU-intensive loop, freezing the service for tens of seconds and blocking all other users. The vulnerability stems from unsafe handling of user-supplied input that gets injected into a regex pattern without proper escaping.

• CVE-2026-59098MEDIUM 6.5

  LobeChat versions up to 2.2.9 contain an access control flaw in its semantic search feature that allows logged-in users to retrieve sensitive data belonging to other users. An attacker with a valid account can request documents, knowledge bases, and associated metadata from victims by manipulating identifiers in the search requests, bypassing the application's user isolation controls. The vulnerability requires authentication but does not demand elevated privileges, making it exploitable by any valid user.

• CVE-2026-59149MEDIUM 6.5

  Mockoon is a tool used by developers to create and test mock APIs locally. A flaw in versions before 9.7.0 allows an attacker to read files from outside the intended mock API directory by crafting specially-formatted file requests. Because the validation check for file paths doesn't properly enforce directory boundaries, an attacker can use path-traversal tricks to escape the sandbox and access other files on the server. This vulnerability requires user interaction (the victim must visit a malicious link or request) but no authentication, and it exposes sensitive data rather than modifying or deleting it.

• CVE-2026-59207MEDIUM 6.5

  n8n's AI Agents feature contains a credential access control bypass that allows a member-level user with read-only access to a shared credential to exfiltrate that credential's secret to an attacker-controlled server. The vulnerability exists because the platform fails to enforce domain restrictions on HTTP requests made by MCP (Model Context Protocol) tools used within AI Agents workflows. An attacker with legitimate but limited access to a credential can point an MCP tool at their own server and capture the credential secret during execution. This affects n8n versions prior to 2.27.4 and 2.28.1.

• CVE-2026-59209MEDIUM 6.5

  n8n, an open-source workflow automation platform, contains a vulnerability that allows authenticated users with basic editor access to steal sensitive credentials embedded in HTTP request headers. A user with 'use-only' permissions on a shared workflow can extract secrets through pagination expressions and leak them as part of workflow item data. This affects versions before 1.123.61, 2.27.4, and 2.28.1.

• CVE-2026-59220MEDIUM 6.5

  Open WebUI, a self-hosted AI platform, contains a regular expression denial-of-service vulnerability in its chat message processing. When an authenticated user sends a malformed skill mention (a message containing <$ without a closing >) the server's message parser enters a computationally expensive loop that blocks the main event loop, making the application unresponsive. This affects versions 0.9.2 through 0.9.x and is resolved in version 0.10.0. The vulnerability requires an authenticated session to exploit.

• CVE-2026-59222MEDIUM 6.5

  Open WebUI versions 0.7.0 through 0.9.x contain an information disclosure vulnerability in the channel members API endpoint. When a user with normal channel participation permissions queries the members list, the endpoint returns complete user profile objects including sensitive configuration data such as tool server API keys and webhook credentials. This allows any channel member to harvest authentication material and integration secrets from other users without requiring elevated privileges or admin access.

• CVE-2026-59262MEDIUM 6.5

  AFFiNE, a collaborative workspace application, contains a flaw in its document history feature that allows workspace members to view the edit timeline of private documents they shouldn't have access to. An authenticated attacker can request the history of any document by its identifier, and the system will return detailed records including who edited the document, their email addresses, and when changes occurred—regardless of whether the attacker has permission to view the actual document. This is a permission-bypass issue affecting information disclosure.

• CVE-2026-59805MEDIUM 6.5

  Gumroad has a vulnerability in how it controls access to seller features. An authenticated seller can trick the system into revoking or restoring customer access to products they don't own. This happens because the system doesn't properly verify that a seller is the legitimate owner before processing access changes. The flaw exists in versions before 2026.07.06.2 and could allow sellers to maliciously disrupt competitors' sales or restore access inappropriately.

• CVE-2026-59818MEDIUM 6.5

  etcd, a widely-used distributed key-value store, has a certificate validation bypass when configured to split HTTP and gRPC traffic across separate listeners. In affected versions, the Certificate Revocation List (CRL) that should block revoked certificates is not applied to the gRPC listener, allowing an attacker with a revoked certificate to authenticate successfully. This affects etcd versions prior to 3.5.32 and 3.6.13, and is particularly relevant for organizations using etcd in Kubernetes clusters or other distributed systems where certificate-based access control is critical.

• CVE-2026-59820MEDIUM 6.5

  LiteLLM, a proxy server used to standardize API calls to various large language models, contains a path traversal vulnerability in its skill upload feature. An authenticated user who has permission to upload skills can craft a malicious ZIP file that extracts files outside the intended directory, potentially overwriting system files or placing malicious content in sensitive locations. This requires existing API access and doesn't directly cause data theft or system crashes, but enables an attacker to modify files on the server.

• CVE-2026-59853MEDIUM 6.5

  SiYuan is an open-source personal knowledge management application that helps users organize and search their notes and documents. A flaw in versions prior to 3.7.1 allows users with read-only 'publish mode' access to view private information they shouldn't be able to access—specifically, the internal IDs and file paths of unpublished documents, notebooks, and individual text blocks, as well as the search keywords other users have saved. This happens because one API endpoint doesn't properly filter what data it exposes, unlike the similar endpoints around it that do apply the correct restrictions.

• CVE-2026-59896MEDIUM 6.5

  Hono is a popular JavaScript web framework used across multiple runtime environments. A vulnerability in its JSX rendering component (versions 4.11.8 through 4.12.26) fails to properly isolate context data between concurrent requests during server-side rendering. This means that when an async component uses `await`, it could accidentally access context values—such as user data, request headers, or other sensitive information—from a different user's request that was processed at the same time. An attacker doesn't need special privileges or user interaction to trigger this; the vulnerability manifests when multiple requests are handled in parallel, creating a window where context bleeding occurs.

• CVE-2026-60001MEDIUM 6.5

  OpenSSH versions before 10.4 contain a flaw in the sshd daemon where it fails to properly enforce a configured minimum delay between authentication attempts. This delay mechanism is designed to slow down brute-force attacks by forcing attackers to wait between each login try. When the delay is not honored, an attacker can attempt passwords or keys much faster than intended, making credential-based attacks more feasible. The vulnerability affects SSH servers running vulnerable OpenSSH versions.

• CVE-2026-60094MEDIUM 6.5

  Vinchin Backup & Recovery versions through 9.0.0.86562 contain a vulnerability in their agentlink_server service that allows attackers to crash the backup agent or corrupt its memory without needing credentials. An attacker sends a specially crafted network packet with an incorrect length field that tricks the service into reading far more data than allocated, potentially writing up to 4 GB of attacker-controlled data into memory. This could lead to service failure or, in theory, code execution, though the current risk is primarily denial of service and data corruption.

• CVE-2026-60095MEDIUM 6.5

  Vinchin Backup & Recovery versions up to 9.0.0.86562 contain a vulnerability in the agentlink_server component that allows unauthenticated attackers to crash the service or potentially take control of it by sending a specially crafted network request. The vulnerability exists because the software copies user-supplied data into a fixed buffer without checking the length first, a classic memory safety flaw. An attacker on the network can exploit this without needing credentials.

• CVE-2026-6091MEDIUM 6.5

  A vulnerability in wolfSSL's certificate verification logic may incorrectly accept X.509 certificate chains that end at an intermediate certificate controlled by an attacker, rather than terminating at a trusted root authority. When the partial-chain verification flag is enabled in OpenSSL-compatible code, an attacker with low privileges can craft a malicious certificate chain that bypasses the normal validation requirements. This could allow the attacker to impersonate legitimate services or intercept communications in scenarios where certificate pinning or strict chain validation is relied upon for security.

• CVE-2026-61441MEDIUM 6.5

  PraisonAI Platform versions before 0.1.9 contain an authorization bypass vulnerability in their issue dependency deletion feature. A workspace member can delete dependencies created by owners or admins by targeting the deletion request through a related issue they own, rather than the owner-controlled issue. The system validates permissions only against the issue being targeted in the request, not against both sides of the dependency relationship, enabling lower-privileged users to remove critical issue links that should be protected.

• CVE-2026-61450MEDIUM 6.5

  Grav, a flat-file CMS, contains a sandbox escape vulnerability in its Twig templating system that allows page authors to read sensitive configuration data they should not access. An attacker with the ability to create or edit pages can use allowed Twig filters to dump the raw configuration object, exposing secrets such as SMTP passwords, API keys, and database credentials. This affects Grav versions before 2.0.2 and represents an incomplete patch of a previously identified sandbox bypass.

• CVE-2026-61455MEDIUM 6.5

  Grav, a popular flat-file CMS, has a vulnerability in its ZIP file handling that allows authenticated attackers to cause a denial-of-service condition. An attacker with valid credentials can upload or supply a specially crafted ZIP archive that decompresses to an enormous size, filling up the server's available disk space and making the application unavailable. The vulnerability exists because the decompression code does not enforce reasonable limits on how much data can be extracted, how many files can be created, or how deeply files can be nested within the archive.

• CVE-2026-6280MEDIUM 6.5

  CVE-2026-6280 is a medium-severity vulnerability in Nomysem (a product of NOMYSOFT Informatics Education and Consulting Inc.) that allows users with valid login credentials to access sensitive information they should not be able to reach. The core issue is that the application's access control lists (ACLs)—the rules that define who can see what—are either misconfigured or not properly enforced. An authenticated attacker can bypass these restrictions to view confidential data without needing elevated privileges or user interaction.

• CVE-2026-6291MEDIUM 6.5

  wolfSSL's PKCS#7 encryption decryption contains a timing-based information leak that allows attackers to recover encryption keys. When decrypting encrypted messages using RSA, the library returned different error messages depending on whether the encryption padding was valid or the message contents were corrupt. An attacker with network access could exploit this distinction by sending specially crafted encrypted messages and analyzing the responses to gradually reconstruct the underlying encryption key, similar to historical Bleichenbacher attacks. The vulnerability requires authenticated access (login credentials) and affects confidentiality of encrypted data but not integrity or system availability.

• CVE-2026-6329MEDIUM 6.5

  A vulnerability in wolfSSL's PKCS#12 implementation allows attackers to bypass the integrity check (MAC—Message Authentication Code) that protects the contents of PKCS#12 certificate bundles. The flaw stems from comparing the stored MAC against the computed one using a length value supplied by the attacker, rather than enforcing the correct digest length. An attacker can supply a truncated or zero-length MAC that will be incorrectly accepted, meaning a tampered PKCS#12 file could pass validation even though its contents have been altered. This is particularly dangerous in supply-chain or key-distribution scenarios where PKCS#12 files are expected to be cryptographically signed and verified.

• CVE-2026-6330MEDIUM 6.5

  A cryptographic implementation flaw in WolfSSL's ML-KEM (a post-quantum key encapsulation mechanism) on ARM64 systems causes incomplete validation of encrypted data. The implementation's constant-time comparison logic only checks half of the expected ciphertext, allowing an attacker to send a manipulated ciphertext that bypasses the security mechanism designed to reject invalid or tampered data. This weakens the encryption's resistance to certain sophisticated attacks, though the real-world impact depends on how the library is deployed in applications.

• CVE-2026-7048MEDIUM 6.5

  The Photo Gallery by 10Web WordPress plugin contains a SQL injection vulnerability in its gallery ordering feature. An attacker with contributor-level WordPress access or higher can craft a malicious gallery shortcode that executes arbitrary SQL queries against the site database when the shortcode renders. This allows unauthorized extraction of sensitive data like user credentials, email addresses, and other database contents. The vulnerability affects all versions up to 1.8.40.

• CVE-2026-7184MEDIUM 6.5

  Mattermost Server contains a flaw in how it processes certain administrative API requests that allows authenticated users with specific permissions to extract security credentials used for remote cluster connections. An attacker with the 'manage_secure_connections' permission can craft a specially designed API request to retrieve authentication tokens that should remain protected. This affects versions 11.6.1 and earlier, 11.5.4 and earlier, and 10.11.15 and earlier.

• CVE-2026-7300MEDIUM 6.5

  CVE-2026-7300 is a buffer overflow vulnerability in RTI Connext Professional's Web Integration Service that allows an authenticated attacker to cause a denial of service by crashing the affected service. An attacker with valid credentials can send specially crafted input that exceeds expected buffer boundaries, resulting in service unavailability. This is not a remote code execution risk, but the availability impact is significant for deployments relying on Connext for real-time data distribution.

• CVE-2026-7542MEDIUM 6.5

  The Slider Revolution WordPress plugin (versions 7.0 to 7.0.10) contains a critical information disclosure flaw that allows low-privileged users to read sensitive server files. The vulnerability chains three design weaknesses: the plugin exposes AJAX security tokens to all logged-in users, it incorrectly allows unauthenticated access to a file-copying function, and it fails to properly validate and restrict which files can be copied to the public web directory. An attacker with a basic Subscriber account can exploit this to extract configuration files, database backups, credentials, keys, and logs—essentially any non-blacklisted file type on the server.

• CVE-2026-8045MEDIUM 6.5

  A vulnerability in Schneider Electric's StruxureWare Data Center Expert allows authenticated users with Data Center Expert account privileges to disclose sensitive files from the server by submitting malicious XML files to SOAP service endpoints. The vulnerability exploits improper handling of XML external entities (XXE), a well-known attack vector that lets attackers reference external files and retrieve their contents. An attacker must have valid Data Center Expert credentials to exploit this—it is not remotely exploitable by unauthenticated users.

• CVE-2026-8118MEDIUM 6.5

  Royal Addons for Elementor, a WordPress plugin for building pages with Elementor, has a file-reading flaw affecting versions 1.7.1058 and 1.7.1059. When handling CSV file uploads in data table widgets, the plugin fails to properly validate file paths. An authenticated user with Contributor-level permission or higher can exploit this to read any file on the server that the PHP process can access—including sensitive configuration files like wp-config.php containing database credentials. The vulnerability stems from a fallback mechanism in a helper function that was added to patch a previous security issue.

• CVE-2026-8380MEDIUM 6.5

  The Frontend File Manager Plugin for WordPress versions through 23.6 contains a flaw that allows authorized users to delete posts and pages they do not own. Specifically, any user with author-level permissions or higher can permanently remove arbitrary content from a WordPress site. If an administrator enables the plugin's "Allow guest uploads" setting, this same destructive capability becomes available to unauthenticated visitors, significantly expanding the attack surface.

• CVE-2026-8458MEDIUM 6.5

  libcurl contains a connection pooling flaw that can cause authenticated requests to reuse the wrong connection. When an application makes multiple requests using Negotiate authentication (a credential delegation mechanism) to the same server but with different service configurations, libcurl's connection reuse logic may incorrectly reuse a cached connection that was authenticated for a different service. This allows subsequent requests to inherit the authentication context of a previous connection, potentially enabling privilege escalation or unauthorized actions within the authenticated session.

• CVE-2026-8653MEDIUM 6.5

  MasterStudy LMS Pro Plus, a WordPress plugin used for learning management, contains a SQL injection flaw in how it processes the 'columns' parameter. Attackers with instructor-level or higher access can exploit this to run unauthorized database queries and steal sensitive data. The vulnerability affects all versions up to 4.8.20 and requires authentication but no user interaction.

• CVE-2026-8683MEDIUM 6.5

  Mattermost Desktop App versions 6.1 and earlier contain a denial-of-service vulnerability that allows a malicious server owner to crash the application by injecting a script that attempts to open an extremely long URL. The flaw stems from insufficient validation of URL length before passing it to the browser's window.open function, causing the application to fail ungracefully when processing the oversized input.

• CVE-2026-8714MEDIUM 6.5

  A flaw in the RTSP (Real Time Streaming Protocol) server component of TP-Link Tapo C520WS v2 cameras allows an attacker on the local network to send specially crafted malformed input that causes the streaming service to stop responding. Once triggered, the camera's video streaming capability becomes unavailable until the service is restarted, effectively taking the camera offline for monitoring purposes.

• CVE-2026-8722MEDIUM 6.5

  A vulnerability in the Perl Net::Async::Statsd::Client library allows attackers to inject arbitrary metrics into statsd monitoring systems by exploiting insufficient input validation. Because the library fails to sanitize metric names for special characters (newlines, colons, and pipes), an attacker who controls metric input can inject additional monitoring data, potentially disrupting observability or falsifying application metrics.

• CVE-2026-8993MEDIUM 6.5

  The D.Launcher 2 component in the Slovak eID client ecosystem improperly handles custom URL protocols, allowing attackers to trigger NTLM authentication attempts or SMB connections to their servers, or conduct Server-Side Request Forgery (SSRF) attacks. The vulnerability requires a user to click a malicious link, making it a social engineering vector rather than an automated remote code execution. The exposure is primarily information disclosure through credential capture or network reconnaissance.

• CVE-2026-8996MEDIUM 6.5

  The WP Time Capsule backup plugin contains a flaw that allows any authenticated WordPress user with subscriber-level permissions or higher to download the most recent decrypted SQL database backup file. This backup typically contains sensitive data like password hashes, user credentials, and configuration secrets. The vulnerability only manifests if a site administrator has previously decrypted a backup—otherwise, no file is available to exploit. An attacker with even basic user access can trigger this exposure without any additional action from site administrators.

• CVE-2026-9002MEDIUM 6.5

  IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 contain a vulnerability that allows attackers on the same network to crash the application server. The flaw exists in how the system handles deeply nested Protocol Buffers messages without proper size limits, enabling an attacker to exploit this by sending specially crafted network packets that cause the Java Virtual Machine to run out of memory or exhaust the call stack, bringing down the service.

• CVE-2026-9105MEDIUM 6.5

  A vulnerability in TP-Link TL-WR841N v14 routers allows anyone with valid login credentials to crash the device by sending specially crafted web requests. When triggered, the router's web server crashes and forces the device to automatically reboot, disrupting network connectivity until it comes back online. No data is at risk—this is purely a denial-of-service issue.

• CVE-2026-9132MEDIUM 6.5

  A security flaw in GitHub Enterprise Server allowed authenticated users to view source code from private repositories they shouldn't have access to. The vulnerability existed in the Copilot pull request description feature, which compared code across repositories without properly checking if the user had permission to see the target repository. An attacker needed only a valid account with read access to at least one repository on the instance to exploit this and extract sensitive code from restricted repositories.

• CVE-2026-9145MEDIUM 6.5

  A vulnerability in the Database for Contact Form 7 WordPress plugin allows unauthenticated attackers to copy arbitrary files from a server when Elementor Pro is active. The issue stems from the plugin's form entry handler trusting user-supplied input without validating whether it came from a legitimate file upload. An attacker can manipulate form submissions to point the plugin's file-copying function at sensitive files on the server or even remote sources, potentially exposing configuration files, credentials, or other sensitive data. The vulnerability requires Elementor Pro to be installed but does not require authentication.