By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

2772 published vulnerabilities · page 17 of 28

• CVE-2026-49204MEDIUM 6.5

  A firmware vulnerability in Acer Connect M6E 5G devices contains hardcoded credentials embedded in debug modules that should have been removed before release. These credentials provide access to internal AWS Cognito test environments, potentially allowing attackers to authenticate to backend services without legitimate credentials. The flaw affects both the device firmware and the product line itself.

• CVE-2026-49376MEDIUM 6.5

  JetBrains TeamCity versions prior to 2026.1 contain a vulnerability in the SAML authentication plugin where usernames are not properly validated. This weakness allows an attacker to bypass normal username restrictions and potentially gain unauthorized access or manipulate user identity claims during the authentication process. The vulnerability requires network access but no special credentials or user interaction to exploit.

• CVE-2026-49379MEDIUM 6.5

  JetBrains TeamCity versions prior to 2026.1 contain a credential exposure vulnerability where sensitive authentication information could leak through thread names. An authenticated attacker with access to the TeamCity server could potentially extract credentials from system logs or monitoring output that display thread identities. This is a server-side information disclosure issue that does not require user interaction and affects the confidentiality of stored credentials.

• CVE-2026-49385MEDIUM 6.5

  JetBrains YouTrack contains an access control flaw that allows standard users to modify service accounts—privileged system identities that handle automated tasks and integrations. This is a privilege escalation risk because service accounts typically have elevated permissions, and unauthorized modification could allow an attacker to hijack critical workflows or lateral-move within the organization. The vulnerability affects YouTrack versions prior to 2026.1.13570.

• CVE-2026-49386MEDIUM 6.5

  JetBrains YouTrack versions prior to 2026.1.13570 contain an access control flaw that allows authenticated users to discover restricted issues and articles on the Planning Canvas feature. While attackers cannot modify or delete content, they can enumerate sensitive information that should be hidden from their permission level. This is a credential-based attack—an attacker must have valid YouTrack login credentials to exploit it, but once authenticated, the vulnerability requires no special interaction or additional privileges.

• CVE-2026-49818MEDIUM 6.5

  A path traversal flaw in Apache Airflow's Samba provider allows attackers to write files to unintended locations on Samba file shares. The vulnerability exists in the `GCSToSambaOperator`, which copies objects from Google Cloud Storage to Samba without validating that the destination path remains within the configured boundary. An attacker who can upload files to the source GCS bucket (a common scenario when external data producers have write access) could craft object names using directory traversal sequences like `../` to escape the intended destination and write files anywhere on the target Samba system. This is particularly dangerous in shared data pipelines where the GCS bucket is not exclusively controlled by the DAG author.

• CVE-2026-49938MEDIUM 6.5

  CVE-2026-49938 is an access control flaw affecting Fortinet FortiPortal that allows authenticated users to access data or functions they should not have permission to reach. The vulnerability exists in FortiPortal versions 7.0 (all versions), 7.2.0 through 7.2.8, and 7.4.0 through 7.4.7. An attacker with valid credentials can exploit this to gain unauthorized visibility into sensitive information. This is not a remote unauthenticated attack—the threat actor must first obtain legitimate login credentials.

• CVE-2026-49940MEDIUM 6.5

  Net::CIDR::Set, a Perl library for managing IP address ranges, has a parsing vulnerability in versions up to 0.20. The library incorrectly accepts non-ASCII Unicode digits (such as Arabic-Indic numerals) in IP addresses and network masks. Because these Unicode characters aren't properly converted to their numeric values, network masks may be parsed incorrectly, potentially causing the library to accept a broader range of IP addresses than intended. This could allow an attacker to bypass network access controls or firewall rules that rely on this library for IP validation.

• CVE-2026-50212MEDIUM 6.5

  CVE-2026-50212 is a denial-of-service vulnerability in Acer Connect M6E 5G devices that allows an attacker on the same network segment to remotely disconnect other users' devices without authorization. The flaw stems from inadequate validation in the device dissociation API—the mechanism that normally unbinds user endpoints from the network. An attacker can exploit this to force legitimate users offline, disrupting service availability. No authentication is required, and the attack succeeds with minimal complexity.

• CVE-2026-5074MEDIUM 6.5

  ARMember Premium, a WordPress plugin, contains a SQL Injection vulnerability in its AJAX handler that processes user-supplied sort parameters without proper validation. An authenticated user with basic Subscriber privileges or higher can craft malicious input to extract sensitive data from the site's database. The vulnerability only impacts sites that have explicitly enabled the optional 'User Private Content' addon, which is disabled by default, limiting the blast radius.

• CVE-2026-5737MEDIUM 6.5

  The Independent Analytics WordPress plugin has a flaw that lets unauthenticated attackers make the server fetch files from anywhere on the internet or internal networks. The issue stems from two weaknesses: the plugin accepts attacker-controlled domain names via a public API endpoint, and a background job that downloads favicons doesn't validate where those requests go. By crafting a request with a forged signature (which is feasible because the signing key is embedded in public JavaScript), an attacker can inject a malicious domain into the database. When the favicon fetcher runs, it will make requests to that domain on behalf of your server, potentially exposing internal services or exfiltrating data.

• CVE-2026-7048MEDIUM 6.5

  The Photo Gallery by 10Web WordPress plugin contains a SQL injection vulnerability in its gallery ordering feature. An attacker with contributor-level WordPress access or higher can craft a malicious gallery shortcode that executes arbitrary SQL queries against the site database when the shortcode renders. This allows unauthorized extraction of sensitive data like user credentials, email addresses, and other database contents. The vulnerability affects all versions up to 1.8.40.

• CVE-2026-7542MEDIUM 6.5

  The Slider Revolution WordPress plugin (versions 7.0 to 7.0.10) contains a critical information disclosure flaw that allows low-privileged users to read sensitive server files. The vulnerability chains three design weaknesses: the plugin exposes AJAX security tokens to all logged-in users, it incorrectly allows unauthenticated access to a file-copying function, and it fails to properly validate and restrict which files can be copied to the public web directory. An attacker with a basic Subscriber account can exploit this to extract configuration files, database backups, credentials, keys, and logs—essentially any non-blacklisted file type on the server.

• CVE-2026-8045MEDIUM 6.5

  A vulnerability in Schneider Electric's StruxureWare Data Center Expert allows authenticated users with Data Center Expert account privileges to disclose sensitive files from the server by submitting malicious XML files to SOAP service endpoints. The vulnerability exploits improper handling of XML external entities (XXE), a well-known attack vector that lets attackers reference external files and retrieve their contents. An attacker must have valid Data Center Expert credentials to exploit this—it is not remotely exploitable by unauthenticated users.

• CVE-2026-8653MEDIUM 6.5

  MasterStudy LMS Pro Plus, a WordPress plugin used for learning management, contains a SQL injection flaw in how it processes the 'columns' parameter. Attackers with instructor-level or higher access can exploit this to run unauthorized database queries and steal sensitive data. The vulnerability affects all versions up to 4.8.20 and requires authentication but no user interaction.

• CVE-2026-8714MEDIUM 6.5

  A flaw in the RTSP (Real Time Streaming Protocol) server component of TP-Link Tapo C520WS v2 cameras allows an attacker on the local network to send specially crafted malformed input that causes the streaming service to stop responding. Once triggered, the camera's video streaming capability becomes unavailable until the service is restarted, effectively taking the camera offline for monitoring purposes.

• CVE-2026-8722MEDIUM 6.5

  A vulnerability in the Perl Net::Async::Statsd::Client library allows attackers to inject arbitrary metrics into statsd monitoring systems by exploiting insufficient input validation. Because the library fails to sanitize metric names for special characters (newlines, colons, and pipes), an attacker who controls metric input can inject additional monitoring data, potentially disrupting observability or falsifying application metrics.

• CVE-2026-8993MEDIUM 6.5

  The D.Launcher 2 component in the Slovak eID client ecosystem improperly handles custom URL protocols, allowing attackers to trigger NTLM authentication attempts or SMB connections to their servers, or conduct Server-Side Request Forgery (SSRF) attacks. The vulnerability requires a user to click a malicious link, making it a social engineering vector rather than an automated remote code execution. The exposure is primarily information disclosure through credential capture or network reconnaissance.

• CVE-2026-9493MEDIUM 6.5

  BankPro E-Service Technology's Service Center contains a flaw that allows someone with valid login credentials to view order details belonging to other customers. An attacker would modify a query parameter to bypass access controls and retrieve sensitive EC order information that should only be visible to the rightful account owner. This is a classic authorization bypass—the application fails to verify that the requesting user actually owns the data they're asking for.

• CVE-2026-9792MEDIUM 6.5

  Keycloak's Client Policies feature contains a bypass that weakens its security controls. When administrators configure policies to block the Resource Owner Password Credentials (ROPC) grant flow—a less secure authentication method—the system fails to enforce this restriction under certain conditions. An attacker can exploit this to obtain authentication tokens without proper authorization, potentially accessing sensitive data or impersonating legitimate users. The vulnerability affects how Keycloak validates policy conditions when client type, roles, attributes, or scopes are involved.

• CVE-2026-9796MEDIUM 6.5

  Keycloak has a timing vulnerability that allows an authenticated administrator with `manage-clients` permissions to temporarily escalate themselves to `realm-admin` role during a narrow window when role checks occur. Once granted, this elevated access persists indefinitely—even after the attacker's own admin permissions are removed or the system restarts. This creates a privilege escalation path that is difficult to detect and remediate after the fact.

• CVE-2026-9829MEDIUM 6.5

  Photo Gallery by 10Web, a popular WordPress plugin for creating mobile-friendly image galleries, contains a SQL injection vulnerability in versions up to 1.8.41. An attacker with contributor-level WordPress access (a lower-privileged account type) can inject malicious SQL commands through a shortcode parameter called 'compact_album_order_by'. The attacker stores this payload via an unprotected AJAX function, and it executes when the gallery is viewed on the front end, allowing the attacker to extract sensitive database information. This is a stored vulnerability—once the malicious shortcode is saved, it affects all site visitors.

• CVE-2026-9882MEDIUM 6.5

  CVE-2026-9882 is a memory safety flaw in the ANGLE graphics library used by Google Chrome that allows attackers to steal data from websites you're visiting, provided they trick you into viewing a specially crafted web page. The vulnerability stems from an integer overflow—a programming error where a number wraps around unexpectedly—enabling unauthorized cross-origin data leakage. While the Chromium team rated this as "Critical," the CVSS base score of 6.5 reflects that successful exploitation requires user interaction (clicking or viewing content) and doesn't enable code execution or system-level damage. The flaw affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-9908MEDIUM 6.5

  CVE-2026-9908 is a memory disclosure flaw in Google Chrome's ANGLE graphics library that lets attackers read uninitialized or sensitive data from your browser process. An attacker crafts a malicious HTML page; when you visit it, the bug leaks information that shouldn't be accessible—such as encryption keys, session tokens, or other sensitive values that happened to be in memory. The vulnerability requires user interaction (clicking through to a malicious site) but no authentication, and it affects Chrome versions before 148.0.7778.216.

• CVE-2026-9912MEDIUM 6.5

  A flaw in Google Chrome's GPU processing on Android allows attackers to steal sensitive information from your device's memory. An attacker can craft a malicious web page that, when you visit it, extracts data from Chrome's process memory without your knowledge. No action from you is required beyond visiting the page—the vulnerability is triggered automatically during normal browsing.

• CVE-2026-9917MEDIUM 6.5

  Google Chrome on Android contains a flaw in its WebGL graphics processing that fails to properly initialize memory before use. When a user visits a malicious webpage, an attacker can read sensitive data left in process memory—such as parts of cached images, passwords, or other application state—without needing special permissions or bypass techniques. This affects Chrome versions before 148.0.7778.216 on Android devices.

• CVE-2026-9953MEDIUM 6.5

  CVE-2026-9953 is a memory safety bug in the ANGLE graphics library used by Google Chrome that allows an attacker to read sensitive data from the browser process. An attacker can craft a malicious HTML page that, when visited by a user, exploits an out-of-bounds read to leak information like passwords, session tokens, or other confidential data stored in Chrome's memory. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require special privileges and works across Windows, macOS, and Linux. Google has assigned it high severity within Chromium's security framework.

• CVE-2026-9981MEDIUM 6.5

  A flaw in the Skia graphics rendering library within Google Chrome allows attackers to trick users into visiting malicious web pages that expose sensitive data from the browser's memory. The vulnerability requires user interaction (clicking a link or visiting a site) but needs no special privileges to exploit, making it a realistic threat to everyday Chrome users.

• CVE-2026-9996MEDIUM 6.5

  A flaw in Google Chrome's WebRTC component allows a remote attacker to trick a user into visiting a malicious webpage that reads sensitive data from the browser's memory. The vulnerability affects Mac users running Chrome versions before 148.0.7778.216. No user action beyond visiting a crafted page is required for the attacker to attempt exploitation.

• CVE-2021-47982MEDIUM 6.4

  WordPress administrators using the WP-Paginate plugin version 2.1.3 should be aware of a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into the plugin's settings. An attacker with login credentials can submit crafted requests to the plugin configuration page, embedding JavaScript payloads that are permanently stored in the database and executed whenever site administrators access those settings. This means the payload runs in the admin's browser session, potentially allowing the attacker to steal session tokens, modify site content, create new admin accounts, or perform other harmful actions on behalf of the compromised administrator.

• CVE-2021-47983MEDIUM 6.4

  The Stripe Payments WordPress plugin version 2.0.39 contains a stored cross-site scripting (XSS) vulnerability that allows logged-in attackers to inject malicious JavaScript code into plugin settings. When an administrator views these compromised settings, the injected script executes in their browser with full administrative privileges. This type of attack is particularly dangerous because the malicious code persists in the database and affects all administrators who access the settings page.

• CVE-2021-47984MEDIUM 6.4

  The WP24 Domain Check WordPress plugin version 1.6.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with plugin access to inject malicious JavaScript code. When an admin later views the plugin's settings page, that injected code executes in their browser, potentially allowing the attacker to perform unauthorized actions on their behalf or steal sensitive information. This is a persistence threat—once injected, the malicious script remains in the plugin settings until manually removed.

• CVE-2025-14042MEDIUM 6.4

  The Automotive Car Dealership Business WordPress Theme contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 13.4.1. An attacker with contributor-level or higher permissions can inject malicious scripts into Portfolio Item 'Project Details' fields. These scripts will execute when other users view the affected pages, potentially compromising visitor sessions, stealing credentials, or defacing content. The vulnerability stems from the theme's failure to properly sanitize and escape user input in a custom field.

• CVE-2025-59610MEDIUM 6.4

  A memory corruption vulnerability affects numerous Qualcomm chipsets and platforms when processing IOCTL (input/output control) requests that contain mismatched API versions. The flaw stems from concurrent modification of user-space buffers during processing, allowing a privileged local attacker to corrupt kernel memory and potentially gain elevated code execution. The vulnerability requires high privilege access and specific conditions to trigger, limiting opportunistic exploitation but posing significant risk in compromised or malicious insider scenarios.

• CVE-2026-0409MEDIUM 6.4

  NETGEAR Orbi 370 series mesh routers contain a vulnerability that allows attackers to execute arbitrary commands on the device. An attacker must intercept and modify network traffic between the router and the Internet, then wait for the device administrator to perform specific management actions. The vulnerability affects Orbi 370, 371, 372, and 374 models running firmware versions prior to V12.1.2.7.

• CVE-2026-10024MEDIUM 6.4

  The TinyMCE shortcode Addon plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 1.0.0. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code into pages via the 'btnrel' shortcode attribute. Because the plugin fails to properly sanitize and escape this input, the injected script will execute in the browsers of anyone who views the affected page. This is a *stored* vulnerability, meaning the malicious code persists in the page content until explicitly removed.

• CVE-2026-10732MEDIUM 6.4

  The decompress package contains a critical flaw that allows attackers to write files anywhere on a system by uploading a specially crafted ZIP archive. The vulnerability exploits a race condition in how the library processes ZIP entries: when a ZIP contains two entries with identical paths—first a symlink pointing to an arbitrary location, then a regular file—the library writes the file's contents through the symlink to a location outside the intended extraction folder. This bypasses protections added in previous fixes, potentially enabling remote code execution if an attacker can control ZIP uploads or extraction workflows.

• CVE-2026-10738MEDIUM 6.4

  The jQuery Hover Footnotes plugin for WordPress allows attackers who can write or edit content on a site (author-level access or higher) to hide malicious scripts inside footnote markup. These scripts execute whenever anyone views the affected page. The vulnerability exists because the plugin doesn't properly clean user input before storing it, and the hidden scripts bypass WordPress's built-in protections by using a specific syntax that avoids HTML tags.

• CVE-2026-10862MEDIUM 6.4

  The Accordions plugin for WordPress has a security flaw that allows authenticated users with custom-level permissions or higher to inject malicious scripts into accordion content. When other users view pages containing these injected scripts, the scripts execute in their browsers, potentially exposing sensitive information or performing unwanted actions on their behalf. This vulnerability affects all versions up to and including 2.3.23.

• CVE-2026-20454MEDIUM 6.4

  CVE-2026-20454 is a privilege escalation vulnerability in MediaTek's geniezone component affecting multiple system-on-chip (SoC) models. An attacker who already holds System privilege can exploit a race condition in memory handling to read or modify sensitive data and potentially gain higher-level control. No user interaction or network access is required—exploitation occurs locally once System privilege is obtained.

• CVE-2026-2382MEDIUM 6.4

  The FPW Category Thumbnails WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.9.5. Any user with Subscriber-level access or higher can inject malicious JavaScript through the 'id' parameter in an AJAX function. This script persists in the plugin's settings and executes whenever an administrator views that page, potentially compromising administrator accounts. The vulnerability stems from the plugin failing to properly clean and escape user input before storing and displaying it.

• CVE-2026-25600MEDIUM 6.4

  PDBM application contains a critical cryptographic weakness: a single hard-coded encryption secret embedded in the executable file that is identical across all installations. This secret is used to encrypt and decrypt user credentials stored in the application's configuration files. An attacker with local system access can extract this secret from the PDBM.exe binary, then use it to decrypt stored administrative credentials. Because the default configuration assigns these credentials administrative privileges within PDBM, successful exploitation grants attackers complete control over the application's management functions and operational capabilities.

• CVE-2026-3011MEDIUM 6.4

  The Recipe Card Blocks Lite WordPress plugin contains a flaw that allows authenticated authors and above to inject malicious scripts into recipe blocks. These scripts execute when anyone views the published post or its print version, potentially compromising visitor sessions or redirecting them to malicious sites. The vulnerability exists because the plugin decodes special character sequences after security checks have already been completed, bypassing intended protections.

• CVE-2026-34993MEDIUM 6.4

  AIOHTTP, a popular Python framework for asynchronous HTTP operations, contains a vulnerability in its CookieJar.load() function that could allow code execution when loading untrusted cookie data. The vulnerability exists in versions before 3.14.0. While the risk is moderate, it primarily affects applications that explicitly load cookie files from untrusted sources—a less common pattern than using CookieJar with application-generated data. Upgrading to version 3.14.0 or later eliminates the risk.

• CVE-2026-36612MEDIUM 6.4

  The Mercusys AC12G (EU) router with firmware version AC12G(EU)_V1_200909 ships with Wi-Fi Protected Setup (WPS) enabled by default. WPS is a feature designed to simplify device pairing, but this implementation has a critical weakness: after just 10 failed PIN guesses, the device locks out for only 60 seconds. This short lockout window makes brute-force attacks against the WPS PIN feasible within a reasonable timeframe, potentially allowing an attacker within wireless range to gain administrative access to the router.

• CVE-2026-3722MEDIUM 6.4

  A WordPress plugin called 'Auto Image Attributes From Filename With Bulk Updater' fails to properly clean and display user-supplied data in image metadata fields. This allows authenticated users with Author-level permissions or higher to embed malicious code into image properties. When site visitors view pages containing the injected image, that code runs in their browsers—potentially stealing session cookies, performing actions on their behalf, or redirecting them to malicious sites. The vulnerability affects all versions up to and including 4.9.

• CVE-2026-4080MEDIUM 6.4

  The Easy Cart plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'add_to_cart' shortcode. Attackers with Contributor-level access or above can inject malicious scripts into shortcode parameters that will execute for any user viewing the affected page. The vulnerability stems from incomplete sanitization—while HTML tags are stripped, quotation marks are not escaped, allowing attackers to break out of HTML attribute context and inject event handlers like onclick or onerror. All versions through 1.8 are affected.

• CVE-2026-4081MEDIUM 6.4

  The ZeM STL plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into website pages. When someone visits a page containing the injected script, their browser executes the attacker's code. This happens because the plugin doesn't properly clean or escape user input when processing shortcode parameters like 'url', 'color', and 'bgcolor'. All versions up to 1.0 are affected.

• CVE-2026-41982MEDIUM 6.4

  CVE-2026-41982 is a race condition vulnerability affecting the IPC (inter-process communication) module. An authenticated attacker can exploit this flaw to degrade system availability. The vulnerability requires specific conditions to trigger and is rated MEDIUM severity with a CVSS score of 6.4.

• CVE-2026-4334MEDIUM 6.4

  The Shariff Wrapper plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 4.6.20. Attackers with Contributor-level access or higher can inject malicious scripts through the 'headline' parameter in the [shariff] shortcode. When other users view the affected page, the injected code executes in their browsers, potentially enabling session hijacking, credential theft, or further compromise. The vulnerability stems from the plugin's use of a permissive HTML sanitization routine followed by unsafe string replacement operations that reintroduce dangerous content after the sanitization check.

• CVE-2026-44462MEDIUM 6.4

  Zed is a popular code editor that includes a terminal tool with permission controls meant to restrict which commands can be executed. Prior to version 0.229.0, an attacker could bypass these restrictions by chaining bash variable expansion syntax—specifically the ${var@P} expansion—to execute arbitrary commands even when they appeared to violate the allowed command prefix rules. This requires user interaction (opening a malicious project or terminal configuration) but grants the attacker code execution within the editor's process context.

• CVE-2026-45285MEDIUM 6.4

  Nextcloud inadvertently creates hidden public links when users share folders or files with Teams that include external members (people invited via email without Nextcloud accounts). These links remain invisible in the sharing interface but are emailed to the external recipient and grant full permissions—read, write, delete, reshare, download. An attacker intercepting or receiving one of these links gains unfettered access to all shared data without authentication, and the folder owner cannot see or revoke the link through normal UI controls. Versions 32.0.0–32.0.8 and 33.0.0–33.0.2 are vulnerable; patches are available.

• CVE-2026-50592MEDIUM 6.4

  Znuny, a widely-used open-source helpdesk and ticketing platform, contains a reflected cross-site scripting (XSS) vulnerability in its administrative communication log interface. An authenticated attacker with login credentials can craft a malicious URL containing injected JavaScript that executes in the browser of another administrator viewing the communication logs. This could allow credential theft, session hijacking, or other actions performed on behalf of the compromised administrator. The vulnerability affects Znuny LTS versions before 6.5.21 and Znuny versions before 7.3.3.

• CVE-2026-5714MEDIUM 6.4

  The Enable Media Replace plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Author-level permissions or higher to inject malicious scripts into pages. When other users visit those pages, the injected scripts execute in their browsers, potentially compromising their accounts, stealing session data, or performing actions on their behalf. The vulnerability exists in all versions up to and including 4.1.8 and results from the plugin's failure to properly sanitize and escape the 'location_dir' parameter.

• CVE-2026-6275MEDIUM 6.4

  The StatCounter – Free Real Time Visitor Stats WordPress plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated authors to inject malicious scripts into their posts. When any visitor views a post authored by an attacker, the injected script executes in their browser. The vulnerability exists because the plugin fails to properly escape the author's nickname before outputting it into JavaScript code on every post page.

• CVE-2026-6427MEDIUM 6.4

  The a3 Lazy Load WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions through 2.7.6. An attacker with Contributor-level permissions can craft a malicious video element that exploits a regex parsing bug in the plugin's video filtering logic. When this crafted content is viewed by any site user—including administrators—malicious JavaScript executes in their browser. The vulnerability stems from improper quote handling in HTML attribute processing, combined with unescaped output in the admin interface.

• CVE-2026-7662MEDIUM 6.4

  The ePaperFlip Publisher plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into pages. When other users view those pages, the injected scripts execute in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability affects all versions up to and including version 1 and stems from the plugin failing to properly filter and escape user input in the 'publicationid' shortcode attribute before inserting it into JavaScript code.

• CVE-2026-7795MEDIUM 6.4

  The Click to Chat – WA Widget plugin for WordPress contains a flaw that allows authenticated users with basic contributor permissions to inject malicious code into pages. When someone clicks the WhatsApp chat button on an affected site, the injected code executes in their browser. The vulnerability stems from improper handling of a shortcode parameter: the plugin escapes user input in a way that works for HTML attributes, but that escaping is later decoded by browsers when the value appears inside a JavaScript function call within an event handler. This creates a window for attackers to break out of the intended string context and run arbitrary JavaScript.

• CVE-2026-7796MEDIUM 6.4

  The EmbedPress WordPress plugin, used for embedding PDFs, videos, and other rich media content, contains a stored cross-site scripting (XSS) vulnerability that allows attackers with contributor-level access to inject malicious scripts into pages. When other users visit those pages, the injected scripts execute in their browsers, potentially allowing attackers to steal credentials, perform unauthorized actions, or compromise user sessions. This affects all versions up to and including 4.5.3.

• CVE-2026-8599MEDIUM 6.4

  MailerPress, a popular WordPress plugin for email marketing and automation, contains a vulnerability that allows attackers with author-level or higher permissions to inject malicious scripts into campaign content. These scripts execute when administrators preview the campaigns in the WordPress dashboard. The vulnerability stems from the plugin not properly filtering user input when storing campaign HTML, nor adequately escaping that content when displaying it. The public-facing preview that customers see is protected by security headers, so the risk is primarily to the WordPress site's admin users rather than to recipients of sent emails.

• CVE-2026-8677MEDIUM 6.4

  Prime Elementor Addons, a WordPress plugin for building pages with Elementor, has a stored cross-site scripting (XSS) vulnerability that allows contributors and higher-privileged users to inject malicious scripts into pages. When other users view those pages, the injected scripts execute in their browsers, potentially compromising their sessions or stealing sensitive information. The vulnerability persists through versions up to 1.3.3 because the plugin fails to properly sanitize widget HTML settings before storing them.

• CVE-2026-8841MEDIUM 6.4

  The Extra Settings for RocketChat plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 0.1. A WordPress user with contributor-level permissions or higher can craft a malicious 'title' attribute in the 'rocketchat' shortcode to inject JavaScript code into a page. When other users visit that page, the injected script executes in their browser within the site's context, potentially allowing the attacker to steal credentials, perform actions on their behalf, or deface content.

• CVE-2026-8880MEDIUM 6.4

  The RomanCart Ecommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its shortcode handler. An authenticated user with contributor permissions or higher can inject malicious JavaScript code into pages through the romancart_button shortcode's attributes. Once injected, that code executes for every visitor who views the affected page, potentially leading to session hijacking, credential theft, or defacement. The vulnerability exists in versions 2.0.8 and earlier due to inadequate input validation and output encoding.

• CVE-2026-8882MEDIUM 6.4

  A WordPress plugin called WP ApplicantStack Jobs Display contains a security flaw that allows certain logged-in users to inject malicious code into web pages. When other users visit those pages, the injected code runs in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability affects all versions up to and including 1.1.1 and requires the attacker to have at least contributor-level permissions on the WordPress site.

• CVE-2026-8883MEDIUM 6.4

  The Global Body Mass Index Calculator WordPress plugin contains a stored cross-site scripting (XSS) flaw affecting versions 1.2 and earlier. Attackers with contributor-level access can inject malicious scripts through the plugin's shortcode functionality. These scripts persist in the database and execute whenever site visitors view affected pages, potentially compromising user sessions, stealing credentials, or spreading malware across your WordPress site.

• CVE-2026-8885MEDIUM 6.4

  The DeMomentSomTres Shortcodes plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'callout' shortcode feature. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code through the 'width' and 'align' shortcode parameters. Because the plugin fails to properly sanitize and escape these inputs, the injected code executes whenever any visitor views the affected page. This creates a persistent threat that compromises site visitors, not just the page editor.

• CVE-2026-8893MEDIUM 6.4

  A stored cross-site scripting (XSS) vulnerability exists in the Express Payment For Stripe WordPress plugin up to version 1.28.0. Authenticated users with contributor-level permissions or higher can embed malicious scripts into pages using the [stripe-express] shortcode. These scripts execute in the browsers of anyone viewing the affected page, potentially allowing attackers to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability stems from the plugin failing to properly escape shortcode attribute values before rendering them in HTML.

• CVE-2026-8895MEDIUM 6.4

  A WordPress plugin called 'kk blog card' contains a security flaw that allows contributors and higher-level users to embed malicious scripts into pages. When someone visits a page with the injected code, the script runs automatically in their browser. The vulnerability exists in versions 1.3 and earlier, and stems from the plugin not properly filtering user input before inserting it into HTML code.

• CVE-2026-8900MEDIUM 6.4

  The Simple SEO Slideshow WordPress plugin has a security flaw that allows authenticated users with contributor-level permissions or higher to inject malicious scripts into pages. When someone visits a page containing this injected code, the script executes in their browser—including for administrators. The vulnerability exists because the plugin does not properly filter user input when processing shortcode attributes, even though WordPress has built-in protections that should catch this. All versions through 1.2.8 are affected.

• CVE-2026-8977MEDIUM 6.4

  The WP GDPR Cookie Consent plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with subscriber-level permissions or higher to inject malicious JavaScript code into website pages. When other users visit an affected page, the injected script executes in their browsers, potentially allowing attackers to steal session tokens, redirect visitors, inject malware, or perform other actions on behalf of legitimate users. The vulnerability exists because the plugin fails to properly validate user input and safely display stored configuration settings.

• CVE-2026-9243MEDIUM 6.4

  The Plus Addons for Elementor plugin contains a flaw that allows authenticated WordPress users with contributor-level permissions or higher to inject malicious scripts into website pages. When a victim visits an affected page, the injected script executes in their browser, potentially compromising their session or stealing data. The vulnerability exists in the Carousel Anything widget's handling of the carousel_direction parameter and affects versions up to 6.4.15.

• CVE-2026-9281MEDIUM 6.4

  Master Addons For Elementor, a popular WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with author-level permissions to inject malicious scripts into pages. The vulnerability exists in the Custom JS Extension feature and affects all versions up to 3.1.0. Because the injected scripts persist in the database and execute whenever visitors view the affected pages, this could be used to steal credentials, distribute malware, or redirect users to phishing sites. The core issue is that the plugin fails to properly validate and sanitize user input when saving custom JavaScript code, and the security checks that exist only apply to the visual editor interface, not to direct API calls.

• CVE-2026-9557MEDIUM 6.4

  Mautic's Focus component contains a Server-Side Request Forgery (SSRF) flaw that allows authenticated users to manipulate the application into making HTTP requests on their behalf. An attacker with valid credentials can craft specially-formed URLs to probe the internal network, access services that should only be reachable from within the organization, or force the server to make requests to external systems. The vulnerability requires authentication, which limits the immediate attack surface but still poses a meaningful risk to organizations where user accounts are shared, compromised, or granted to untrusted users.

• CVE-2026-9644MEDIUM 6.4

  A WordPress plugin called LiveSmart Video Chat has a security weakness that allows authenticated users with contributor-level permissions to inject malicious code into pages. When other visitors view those pages, the injected code runs in their browsers, potentially compromising their accounts or data. The vulnerability exists in all versions up to 1.2 and stems from the plugin not properly filtering user input before displaying it on pages.

• CVE-2026-9714MEDIUM 6.4

  A vulnerability in the Simple Divi Shortcode WordPress plugin (versions 1.2 and earlier) allows authenticated users with contributor-level permissions or higher to inject malicious code into pages. When other users view those pages, the injected code executes in their browsers. The vulnerability stems from the plugin failing to properly sanitize user input in the [showmodule] shortcode's 'id' parameter. While this requires authenticated access, the ability to execute arbitrary scripts across users' sessions creates a meaningful security risk for WordPress sites using this plugin.

• CVE-2025-65640MEDIUM 6.3

  Arket Globe Document Intelligence version 5.0.0.559 contains a reflected cross-site scripting (XSS) vulnerability in the "Task in Progress / Recent" page. An authenticated attacker can inject malicious JavaScript into document creation fields that will execute in the browsers of other users viewing that page, potentially allowing session hijacking, credential theft, or other malicious actions performed on behalf of those users.

• CVE-2026-10060MEDIUM 6.3

  TRENDnet's TEW-432BRP wireless router (firmware version 3.10B20) contains a command injection vulnerability in its route configuration interface. An authenticated attacker can manipulate IP, mask, or gateway parameters to inject arbitrary commands on the device. The vulnerability requires valid credentials but poses a direct threat to affected networks. Critically, this product reached end-of-life in 2009—over 15 years ago—and the vendor has stated it cannot replicate or fix vulnerabilities in legacy hardware.

• CVE-2026-10061MEDIUM 6.3

  A command injection vulnerability exists in the TRENDnet TEW-432BRP wireless router (firmware version 3.10B20), discovered in the WPS configuration function. An authenticated attacker can manipulate the peerPin parameter to execute arbitrary commands on the device. The vulnerability is network-accessible and requires valid login credentials. Notably, this router reached end-of-life in 2009—over 15 years ago—and TRENDnet has stated they cannot replicate or provide fixes for vulnerabilities in this legacy hardware. While exploit code is public, the practical risk is limited to organizations still operating this obsolete equipment in production environments.

• CVE-2026-10064MEDIUM 6.3

  TRENDnet has disclosed a remote stack-based buffer overflow vulnerability in the TEW-432BRP wireless router (firmware version 3.10B20 and earlier). An authenticated attacker can exploit this flaw by sending a specially crafted request to the port forwarding configuration endpoint, potentially allowing code execution or denial of service. The vendor has confirmed this product reached end-of-life in 2009 and will not issue patches. Public exploit code is available, elevating the practical risk despite the device's age.

• CVE-2026-10101MEDIUM 6.3

  ACM/MCE (Advanced Cluster Management / Multicluster Engine) inadvertently exposes container registry credentials in InfraEnv status messages when pull-secret validation fails. A user with read-only namespace access can view InfraEnv objects and extract the full `.dockerconfigjson` payload—including usernames, passwords, and base64-encoded authentication tokens—despite having no direct permission to read Secrets. This circumvents Kubernetes RBAC controls designed to keep registry credentials confidential.

• CVE-2026-10127MEDIUM 6.3

  A command injection vulnerability exists in Edimax BR-6478AC wireless routers running firmware version 1.23. An authenticated attacker can send a specially crafted web request to the device's configuration interface that tricks it into executing arbitrary system commands. The vulnerability stems from improper validation of the 'rootAPmac' parameter in the device's wireless driver setup function. Because proof-of-concept code has been publicly released, there is a meaningful risk that attackers will attempt to exploit this flaw in active environments.

• CVE-2026-10152MEDIUM 6.3

  A flaw in TaleLin's lin-cms-spring-boot framework (version 0.2.1 and earlier) allows authenticated users to bypass access controls on the book endpoint. An attacker with valid login credentials can manipulate requests to perform actions they should not be permitted to execute, such as viewing, modifying, or deleting book records without proper authorization checks. Proof-of-concept code is publicly available, increasing the risk of active exploitation.

• CVE-2026-10166MEDIUM 6.3

  A command injection vulnerability exists in Edimax BR-6478AC version 1.23 that allows an authenticated attacker to execute arbitrary commands on the device. The flaw is in the web interface's wireless settings handler, where the rootAPmac parameter is not properly sanitized before being used in system commands. An attacker with valid login credentials can manipulate this parameter to inject malicious commands, potentially compromising router configuration, data, or availability. Public exploit details are available, increasing real-world risk.

• CVE-2026-10168MEDIUM 6.3

  A vulnerability in OUSL-GROUP-BrinaryBrains School Student Management System allows authenticated users to manipulate resource identifiers through the marks function in the Parents.php controller, potentially exposing or modifying student data. An attacker with login credentials can exploit this remotely by injecting malicious parameters, affecting the confidentiality and integrity of educational records. Public disclosure has occurred, increasing real-world exploitation risk.

• CVE-2026-10170MEDIUM 6.3

  A SQL injection vulnerability exists in code-projects Visitor Management System version 1.0. An authenticated attacker can manipulate the 'phone' parameter in the /vms/php/phone_0.php file to inject malicious SQL commands. This allows the attacker to read, modify, or delete database contents without special privileges. The vulnerability requires valid login credentials to exploit and has a published proof-of-concept.

• CVE-2026-10172MEDIUM 6.3

  Bdtask Multi-Store Inventory Management System version 1.0 contains a file upload vulnerability that allows authenticated users to upload arbitrary files to the server without validation. An attacker with valid login credentials can exploit this flaw to upload malicious files, potentially leading to remote code execution or other attacks. Public exploit code is available, increasing the risk of widespread exploitation.

• CVE-2026-10174MEDIUM 6.3

  Aider-AI's Aider version 0.86.3 contains a flaw in how it processes pre-commit hook arguments. An attacker with valid credentials can manipulate the git-commit-verify argument to bypass security protections that normally prevent unauthorized code commits. The vulnerability requires network access and prior authentication, making it a concern primarily for development teams using Aider in shared or untrusted environments. Public exploit code exists, increasing the practical risk.

• CVE-2026-10175MEDIUM 6.3

  A code injection vulnerability exists in Aider-AI Aider version 0.86.3 within the Architect Mode feature. An authenticated user can manipulate the editor_coder.run function in auth.py to inject and execute arbitrary code on the system. The flaw requires valid credentials to exploit but no additional user interaction, making it a direct threat to organizations using this development assistance tool. Public exploit code is already available.

• CVE-2026-10176MEDIUM 6.3

  Aider-AI's Aider version 0.86.3 contains a SQL injection vulnerability in its code generation workflow that can be exploited by authenticated users to manipulate database queries. While the vulnerability requires login credentials to trigger, an attacker with access can extract, modify, or delete sensitive data. Public exploit information is available, increasing the near-term risk of active exploitation.

• CVE-2026-10177MEDIUM 6.3

  Aider-AI's Aider version 0.86.3 contains a server-side request forgery (SSRF) vulnerability in its AWS EC2 metadata endpoint handling. An authenticated attacker can exploit the requests.get function in api_docs.py to make the application fetch resources from arbitrary locations, potentially accessing sensitive internal services or metadata. The vulnerability is remotely exploitable and public disclosure has already occurred.

• CVE-2026-10180MEDIUM 6.3

  A command injection vulnerability exists in the TRENDnet TEW-432BRP router (firmware version 3.10B20) that allows authenticated users to execute arbitrary system commands through the formSysCmd web interface parameter. The vulnerability is in the /goform/formSysCmd endpoint and can be exploited remotely by anyone with network access and valid credentials. TRENDnet has not patched this issue because the router reached end-of-life in 2009 and is no longer supported.

• CVE-2026-10182MEDIUM 6.3

  A remote command injection vulnerability exists in the TRENDnet TEW-432BRP wireless router running firmware version 3.10B20. An authenticated attacker can exploit the WLAN setup function by manipulating the 'enrollee' parameter to execute arbitrary commands on the device. The vulnerability has been publicly disclosed. However, this router reached end-of-life in 2009—over 15 years ago—and the vendor has stated they cannot replicate or fix vulnerabilities in products no longer supported. Organizations still operating this hardware face unpatched exposure.

• CVE-2026-10193MEDIUM 6.3

  OFCMS versions up to 1.1.3 contain a SQL injection vulnerability in the ComnController component. An authenticated attacker can manipulate the 'system.user.query' parameter to inject malicious SQL commands, potentially accessing, modifying, or deleting database records. The vulnerability has been publicly disclosed and exploit code is available, making active exploitation a realistic threat.

• CVE-2026-10194MEDIUM 6.3

  A heap-based buffer overflow exists in OFFIS DCMTK 3.7.0 within the query/retrieve service component (dcmqrscp). An authenticated attacker can trigger this flaw remotely by sending specially crafted requests to the image deletion function, potentially causing memory corruption, data loss, or service disruption. The vulnerability requires valid credentials to exploit but poses moderate risk in networked medical imaging environments where DCMTK is deployed.

• CVE-2026-10202MEDIUM 6.3

  A SQL injection vulnerability exists in OFCMS version 1.1.3 affecting the JSON Query Interface within the SystemDictController component. An authenticated attacker can send specially crafted queries to manipulate SQL commands executed by the application, potentially reading, modifying, or deleting database records. The vulnerability requires valid user credentials but can be exploited over the network without user interaction. Exploit code is publicly available, increasing the risk of active exploitation.

• CVE-2026-10203MEDIUM 6.3

  A SQL injection vulnerability exists in OFCMS 1.1.3 within the Query function of the SystemParamController component. The flaw allows authenticated attackers to inject malicious SQL commands through the JSON Query Interface, potentially compromising database integrity and confidentiality. Public exploit code is available, increasing active exploitation risk.

• CVE-2026-10204MEDIUM 6.3

  A SQL injection vulnerability has been discovered in OFCMS version 1.1.3, specifically in the JSON Query Interface of the user management controller. An authenticated attacker can submit specially crafted queries to execute arbitrary SQL commands against the application's database. This could allow them to read, modify, or delete sensitive data. The vulnerability is not currently on the CISA Known Exploited Vulnerabilities (KEV) catalog, but exploit code has been publicly released, increasing the practical risk of attacks.

• CVE-2026-10205MEDIUM 6.3

  Metasoft MetaCRM version 6.4.0 contains an unrestricted file upload vulnerability in its logo upload functionality. An authenticated attacker can upload arbitrary files to the server, potentially leading to code execution or system compromise. The vulnerability affects a JSP file handling logo uploads and requires valid user credentials to exploit. Public exploit code exists for this issue.

• CVE-2026-10209MEDIUM 6.3

  A SQL injection vulnerability exists in the Online Hospital Management System version 1.0, specifically in the appointment booking functionality. An authenticated attacker can manipulate the 'editid' parameter in the appointmentdetail.php file to inject malicious SQL commands. This allows an attacker with valid credentials to read, modify, or delete sensitive appointment and patient data without additional authorization. Since the exploit has been publicly disclosed, the risk of active exploitation is elevated.

• CVE-2026-10210MEDIUM 6.3

  AstrBot version 4.23.6 contains a vulnerability in its skill management system that allows authenticated users to inject malicious code through the prompt description field. An attacker with login credentials can manipulate how skill prompts are processed, potentially leading to unauthorized data access, system modification, or service disruption. The vulnerability has been publicly disclosed, and exploit code is available, though the vendor has not engaged with disclosure efforts.