By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 42 of 86

• CVE-2026-8874HIGH 7.1

  Securly Chrome Extension version 3.0.7 downloads security configuration files—specifically crisis alert keywords and filtering rules—over plain HTTP instead of the encrypted HTTPS protocol. While the same extension correctly uses HTTPS for other sensitive data (IWF and CIPA filtering data), this inconsistency leaves downloaded crisis alert configurations vulnerable to interception and modification by network-positioned attackers. An attacker on the same network could intercept these files and inject malicious keywords or rules, potentially disrupting the extension's security functionality or causing it to behave unexpectedly.

• CVE-2026-9154HIGH 7.1

  A vulnerability in Rapid7 InsightConnect's Sed Plugin allows authenticated users to write malicious files to any location on Linux systems. An attacker with valid credentials can exploit the 'expression' parameter to place arbitrary content at arbitrary file paths, potentially overwriting critical system or application files. This is a file-write vulnerability rather than code execution, but the impact depends heavily on what files an attacker targets.

• CVE-2026-9570HIGH 7.1

  The Taskbuilder WordPress plugin before version 5.0.8 contains a reflected cross-site scripting (XSS) vulnerability in its frontend shortcode functionality. An attacker can craft a malicious URL containing JavaScript code that, when visited by a logged-in user, executes in the context of that user's browser session. The vulnerability stems from inadequate sanitization of a URL parameter before it is output directly into inline JavaScript code on the page. This allows an attacker to hijack user sessions, steal sensitive data, or perform actions on behalf of the victim within WordPress.

• CVE-2026-9808HIGH 7.1

  Mautic 7's API has a flaw where user permission restrictions aren't being honored properly. Specifically, permissions designed to let users only see or edit their own resources (called 'owner-scope' restrictions) are being bypassed. An attacker with low-level API access can exploit this to view or modify other users' data, even though they shouldn't have that permission.

• CVE-2024-38487HIGH 7.0

  CVE-2024-38487 is a container escape vulnerability affecting api-gateway containers that run with root privileges. An attacker with local access to a system running a vulnerable api-gateway container could break out of the container and gain access to the underlying host system, potentially allowing them to modify, delete, or disable critical services and data. The vulnerability requires local access and some effort to exploit, but the consequences—full host compromise—are severe.

• CVE-2026-0083HIGH 7.0

  A race condition in Android's NFC (Near Field Communication) event handling code allows a local attacker with basic system access to escalate their privileges to access sensitive data or modify system files. The vulnerability requires precise timing exploitation but no special permissions or user interaction to trigger, making it a significant local security concern.

• CVE-2026-0125HIGH 7.0

  CVE-2026-0125 is a race condition vulnerability in Android's VPU (Video Processing Unit) driver that allows a local attacker to escalate their privileges. An attacker with a low-privilege local account can trigger a use-after-free condition in the vpu_ioctl.c file by timing requests carefully, potentially gaining higher-level access to the device without needing special permissions or user interaction. This is a serious flaw because it requires only local access and basic user privileges to exploit.

• CVE-2026-34335HIGH 7.0

  A use-after-free memory vulnerability exists in Windows Ancillary Function Driver for WinSock (AFD.sys), affecting Windows 10 and Windows 11 across multiple versions, as well as Windows Server 2012 through 2025. An authenticated local attacker can exploit this flaw to escalate their privileges to SYSTEM level. The vulnerability requires local access and specific conditions to trigger, but once exploited, grants complete control over the affected system.

• CVE-2026-41108HIGH 7.0

  A memory safety flaw in Windows DNS could allow someone with local system access to break out of normal restrictions and gain full control of the computer. The vulnerability exists because DNS processes input in a way that can overflow a memory buffer, and an attacker positioned locally—such as a low-privilege user or service—could exploit this to run code with elevated permissions. This is not a remote vulnerability, but it poses a significant risk in multi-user or shared-system environments.

• CVE-2026-42462HIGH 7.0

  Fedify, a TypeScript library for building federated applications using ActivityPub, contains a vulnerability that allows attackers to manipulate cryptographically signed activities without invalidating the signatures. By exploiting JSON-LD (JSON Linked Data) restructuring techniques, an attacker who receives a validly signed activity from a third party can alter its meaning and content while the Linked Data Signature remains valid. This breaks the integrity guarantee that signatures are supposed to provide, enabling attackers to forge or modify federated messages in a way that appears authentic.

• CVE-2026-42836HIGH 7.0

  A race condition in Windows' Function Discovery Service (fdwsd.dll) allows a user already logged into a machine to escalate their privileges to administrator level. The vulnerability exists because the service does not properly synchronize access to shared resources when multiple processes run concurrently, creating a narrow window where an attacker can manipulate the process. An authorized user would need local access and specific timing to exploit this, but successful exploitation grants full system-level permissions.

• CVE-2026-42911HIGH 7.0

  A use-after-free memory vulnerability exists in Windows' Ancillary Function Driver for WinSock (AFD.sys). An attacker who already has local access to a machine can exploit this flaw to gain elevated privileges, potentially running code with system-level permissions. The vulnerability requires specific conditions to trigger—it is not trivially exploitable—but once successful grants significant control over the affected system.

• CVE-2026-42912HIGH 7.0

  A race condition in Windows Telephony Service allows an attacker who already has local user access to exploit improper synchronization of shared resources and gain system-level privileges. The vulnerability requires the attacker to perform specific timing-dependent actions during concurrent operations—making it moderately difficult to exploit in practice, but reliably escalatable once triggered. No user interaction is required beyond the attacker's ability to run code as a local user.

• CVE-2026-42984HIGH 7.0

  A use-after-free memory vulnerability exists in the Windows Kernel that allows an authorized local user to escalate their privileges to a higher level of access. An attacker with standard user permissions could exploit this flaw to gain system-level control on an affected machine. The vulnerability requires local access and specific conditions to trigger, but successful exploitation would grant complete compromise of the target system.

• CVE-2026-44495HIGH 7.0

  Axios, a widely-used HTTP client library for JavaScript applications, contains prototype-pollution gadgets that can be exploited if another vulnerability in the same process has already poisoned JavaScript's Object.prototype. The issue affects versions 0.19.0 through 0.31.0 in the 0.x branch and version 1.15.1 in the 1.x branch. By itself, Axios does not cause the initial prototype pollution; instead, it becomes a secondary target once an attacker has already compromised Object.prototype through a separate vulnerability. When this occurs, Axios may incorrectly interpret inherited properties as legitimate request configuration, leading to potential code execution or data exposure. The vulnerability is addressed in Axios 0.31.1 and 1.15.2.

• CVE-2026-44604HIGH 7.0

  A flaw in RPM's archive extraction tool allows an attacker to run arbitrary commands on a system by crafting a malicious archive with shell metacharacters embedded in its folder name. When a user extracts such an archive using the rpmuncompress utility, the unsanitized folder name is passed directly into a shell command, enabling code execution with the privileges of the extracting user. The vulnerability affects ZIP, 7z, and GEM archive formats.

• CVE-2026-44818HIGH 7.0

  A race condition vulnerability in Microsoft Office Excel could allow an attacker to execute code on a user's computer. The flaw arises from improper synchronization when multiple processes access shared resources simultaneously. An attacker would need to trick a user into opening a malicious Excel file, but once triggered, the vulnerability can grant full control over the affected system. The vulnerability affects multiple versions of Excel and Office across 365 subscriptions, on-premises deployments, and older perpetual licenses.

• CVE-2026-45596HIGH 7.0

  A use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD) allows an authenticated attacker to elevate their privileges on a local system. The vulnerability requires the attacker to already have user-level access and involves a race condition during memory management. Successfully exploiting it grants the attacker full system-level control.

• CVE-2026-45597HIGH 7.0

  A race condition vulnerability in Windows UI Automation Manager allows an authorized local user to escalate privileges on affected systems. The flaw arises from improper synchronization when multiple processes access shared resources simultaneously. An attacker with existing local access can exploit timing windows to gain system-level privileges. This is not a remote vulnerability and requires prior authentication or local access, which narrows but does not eliminate the risk in shared computing environments.

• CVE-2026-45598HIGH 7.0

  A race condition in Windows' Ancillary Function Driver for WinSock (AFD.sys) allows an attacker who already has local access to a system to escalate their privileges to a higher level. The vulnerability stems from improper synchronization when the driver handles shared resources, meaning that under specific timing conditions, an attacker can exploit the flaw to gain elevated permissions. This is not a remote attack—the attacker must already have a foothold on the machine, such as a low-privileged user account or compromised application context.

• CVE-2026-45601HIGH 7.0

  A race condition in the Windows Ancillary Function Driver for WinSock allows someone already logged into a Windows system to escalate their privileges to a higher level of access. The vulnerability arises from improper synchronization of shared resources, meaning two processes can interfere with each other when accessing the same data simultaneously. An attacker with local user privileges can exploit this timing-dependent flaw to gain elevated system rights, though doing so requires specific conditions and is not trivial to reproduce reliably.

• CVE-2026-45603HIGH 7.0

  A race condition vulnerability exists in Windows' Ancillary Function Driver for WinSock (AFD) that allows an authorized local user to escalate privileges to a higher level on the system. The flaw arises from improper synchronization when multiple processes access a shared resource simultaneously, creating a narrow window of opportunity for an attacker to manipulate the driver's behavior. An authenticated user with basic local access can exploit this to gain elevated privileges, potentially achieving full system compromise. This is not a remote vulnerability and requires the attacker already has some level of access to the target machine.

• CVE-2026-45640HIGH 7.0

  A use-after-free vulnerability in the Windows Bluetooth Port Driver permits a user with local system access to escalate their privileges to a higher level. The flaw exists because the driver fails to properly manage memory when Bluetooth port operations conclude, leaving a freed memory region accessible for malicious manipulation. An attacker must already have some level of local authentication and user rights to exploit this issue, but successful exploitation grants full system control.

• CVE-2026-45653HIGH 7.0

  A heap-based buffer overflow vulnerability in the Windows Kernel allows a user with local system access to overflow a memory buffer, enabling them to execute code with elevated privileges. The attack requires an authenticated user account and moderate technical effort to exploit, but if successful grants attacker control over the affected system. This is a local privilege escalation issue, not a remote attack vector.

• CVE-2026-46154HIGH 7.0

  A race condition exists in the Linux kernel's scheduler extension (sched_ext) cgroup interface that can lead to use-after-free memory access. When system administrators adjust cgroup scheduling parameters like weight, idle status, or bandwidth, the kernel reads a pointer to the scheduler without proper synchronization. If another process simultaneously disables and re-enables a different scheduler, the cached pointer becomes stale and points to freed memory. When the original operation tries to use this pointer, it dereferences already-freed kernel memory, potentially allowing local privilege escalation.

• CVE-2026-46164HIGH 7.0

  A memory management bug in the Linux kernel's Btrfs filesystem can cause the same memory region to be freed twice when a sysfs initialization step fails. This double-free condition can lead to memory corruption and potentially allow an attacker with local access to crash the system or execute code with elevated privileges. The issue occurs in error handling code that wasn't properly coordinated between two layers of the filesystem's initialization logic.

• CVE-2026-46299HIGH 7.0

  CVE-2026-46299 is a lock-handling bug in the Linux kernel's HFS+ filesystem driver that can allow a local attacker with moderate privileges to crash the system or potentially escalate privileges. The vulnerability occurs during filesystem mount when the code acquires a lock but fails to release it properly if certain filename validation steps fail. This causes the system to detect a memory leak while a critical lock is still held, triggering a kernel warning and potential system instability.

• CVE-2026-46309HIGH 7.0

  CVE-2026-46309 is a memory access control flaw in the Linux kernel's GPU driver (xe) that can leak sensitive data. When a privileged process uses a low-coherency GPU memory mode on CPU-cached buffers, the GPU can bypass CPU caches and read stale data directly from RAM—including sensitive information from previously freed memory of other processes. The fix validates GPU memory configuration requests to prevent this dangerous combination.

• CVE-2026-47293HIGH 7.0

  A use-after-free vulnerability exists in Microsoft Office's Click-To-Run installation and update mechanism. An attacker with valid credentials on a local machine can exploit a memory management flaw to gain elevated (administrator) privileges. This is not a remote vulnerability—it requires an authorized user account and local access—but the privilege escalation risk makes it a meaningful threat in environments where credential compromise or insider activity is a concern.

• CVE-2026-47648HIGH 7.0

  CVE-2026-47648 is a privilege escalation vulnerability in Windows Storage that affects multiple versions of Windows 10, Windows 11, and Windows Server. An authorized local user can exploit an untrusted search path flaw to gain elevated privileges on a compromised system. The vulnerability requires local access and user interaction is not needed, but exploitation depends on specific system conditions. With a CVSS score of 7.0 (HIGH), this poses a meaningful risk to environments where local account compromise is plausible.

• CVE-2026-49417HIGH 7.0

  A use-after-free vulnerability in FreeBSD's audio device handling allows unprivileged local users to read and write kernel memory. When an audio device is closed, its backing buffer may be freed while memory mappings remain valid, leaving the process able to access the freed region. Since audio device nodes are world-accessible by default, any local user with access to the system can exploit this to either escalate privileges to gain full system control or crash the kernel, causing a denial of service.

• CVE-2026-53329HIGH 7.0

  A memory allocation vulnerability exists in the Linux kernel's AMD display driver. When reserving space for a data structure, the code calculates the required memory size using arithmetic that can overflow, potentially allocating far less memory than needed. This creates a heap overflow condition where subsequent operations write beyond the allocated buffer, potentially allowing local attackers with unprivileged access to crash the system or execute code. The fix replaces the unsafe allocation function with a safer variant that detects and prevents overflow conditions.

• CVE-2026-54229HIGH 7.0

  A timing vulnerability exists in the abrt-dbus D-Bus service that allows a local attacker with limited privileges to take control of crash dump files while the system is processing them. The vulnerability stems from a race condition where the ChownProblemDir method changes file ownership even though privileged event handlers are actively writing to the same directory. An attacker exploiting this can redirect, modify, or delete crash dumps before they're fully processed, potentially compromising system integrity and enabling local privilege escalation.

• CVE-2026-54230HIGH 7.0

  A vulnerability in libreport's ABRT (Automatic Bug Reporting Tool) event handler scripts allows a local attacker with limited privileges to overwrite arbitrary files on a system. The flaw occurs because event scripts use file output redirection without protective measures that would prevent following symbolic links. An attacker can replace a target file with a symlink pointing to a sensitive system file, then trigger an ABRT event. Since the event scripts run as root, they unwittingly follow the symlink and write data to the attacker's chosen location, potentially corrupting critical system files or planting malicious content.

• CVE-2026-54321HIGH 7.0

  Daytona, a platform for running AI-generated code securely, had a caching bug that allowed certain sandboxes to remain publicly accessible even after their owners switched them to private. If an organization marked a preview sandbox as private, the system's cache did not update immediately, creating a window where unauthenticated users could still access the sandbox and potentially view or interact with code and data that should have been restricted. This gap has been closed in version 0.184.0.

• CVE-2026-56254HIGH 7.0

  @capgo/capacitor-updater before version 12.128.2 contains a critical flaw in how it protects app updates. The library distributes the private encryption key to every device, which means attackers can forge legitimate-looking updates. If an attacker intercepts the connection between a device and Capgo's servers—or compromises those servers—they can trick devices into installing malicious updates, even though the signatures will appear valid. This bypasses a core security mechanism that should ensure only authorized updates are installed.

• CVE-2026-56297HIGH 7.0

  FreeRDP versions before 3.22.0 contain a flaw that allows a malicious RDP server to crash or potentially take control of the client machine. The vulnerability involves a race condition—a timing problem where two network messages arrive in quick succession and cause the software to use memory that has already been freed. An attacker running a malicious RDP server can exploit this by sending specially timed messages to trigger the condition, resulting in either denial of service or remote code execution.

• CVE-2026-58050HIGH 7.0

  libssh2, a widely used SSH client library, contains a heap buffer overflow vulnerability affecting versions through 1.11.1. When a libssh2 client connects to an SSH server, the library parses responses from the public-key subsystem. An attacker operating a malicious SSH server can craft a response with a specially crafted attribute count that causes integer overflow during memory allocation on 32-bit platforms, resulting in a smaller buffer than intended. The library then writes attribute data beyond the allocated buffer boundary, corrupting heap memory and potentially enabling code execution or denial of service.

• CVE-2026-59948HIGH 7.0

  Composer, the widely-used PHP dependency manager, contains a vulnerability that allows attackers to place malicious files anywhere on a developer's system during package installation or updates. An attacker who controls a third-party repository can craft a package with an invalid name that bypasses validation checks, letting them write files outside the intended vendor directory. This is a local-impact vulnerability requiring user interaction (installing or updating packages), but the consequences are severe: an attacker can modify system files, inject code into projects, or disrupt operations. The issue affects all versions of Composer before 2.2.29 and 2.10.2.

• CVE-2026-6090HIGH 7.0

  CVE-2026-6090 is a HIGH severity authentication bypass vulnerability in Lenovo Smart Connect for Windows that allows an authenticated local user to gain elevated system privileges and run arbitrary code. An attacker already logged into the system could exploit this to escalate their access and take full control of the machine. The vulnerability requires local access and some specific conditions to trigger, making it a meaningful risk for shared systems or environments where user accounts are provisioned broadly.

• CVE-2026-13083MEDIUM 6.9

  CVE-2026-13083 is a stored cross-site scripting (XSS) vulnerability in Red Hat's Pen Drive report generator. An attacker who has cluster administrator privileges can inject malicious code into cluster configuration objects—such as the ClusterVersion spec.channel field—that will execute when any user opens an HTML report generated by the tool. The vulnerability requires admin access to inject the payload, but once injected, it affects all users who view the generated report, making it a persistence and lateral movement concern in multi-user environments.

• CVE-2026-47693MEDIUM 6.9

  Poweradmin, a web-based tool for managing PowerDNS servers, contains a CSV injection vulnerability in its log export feature. When administrators export activity logs to CSV format, usernames containing spreadsheet formulas (starting with =, +, -, or @) are not sanitized before export. If an administrator opens the CSV file in Excel, Google Sheets, or similar applications, those formulas execute automatically. An attacker who can create or modify a user account with a malicious username could exploit this to run commands on an administrator's machine, steal data, or launch phishing attacks. The vulnerability affects Poweradmin versions before 4.2.4 and 4.3.3.

• CVE-2026-53935MEDIUM 6.9

  Cilium, a widely-deployed networking and security platform for Kubernetes, contains a privilege-escalation vulnerability in how it enforces namespace boundaries. Users who have permission to create CiliumLocalRedirectPolicies can exploit this flaw to redirect traffic destined for Services in other namespaces by manipulating the addressMatcher field. In addition to traffic hijacking, deleting a malicious policy can leave Cilium's internal state corrupted, breaking legitimate service-to-service communication. The vulnerability affects multiple recent versions but has been patched.

• CVE-2026-56132MEDIUM 6.9

  CVE-2026-56132 is a heap-based buffer overflow vulnerability in libexpat, a widely-used XML parsing library. The flaw occurs in the XML prologue parsing logic when multiple parser instances share internal data structures—specifically, the scaffold backing array. Improper reallocation of this shared array can cause a heap buffer overflow, potentially allowing an attacker with local access to crash the application or execute arbitrary code. The vulnerability affects libexpat versions before 2.8.2.

• CVE-2026-56406MEDIUM 6.9

  libexpat, a widely-used XML parsing library, contains an integer overflow vulnerability in its XML_ParseBuffer function. The vulnerability arises from a missing validation check that exists in a related function (XML_Parse), creating a code path that can trigger an integer overflow when processing certain XML inputs. An attacker with local access could exploit this to cause crashes or potentially execute code with elevated privileges, though remote exploitation is considered less feasible.

• CVE-2026-56407MEDIUM 6.9

  libexpat, a widely-used XML parsing library, contains an integer overflow vulnerability in its entity handling logic. The flaw occurs when the library processes XML document preambles (the prologue section) and manages entity values. An attacker could exploit this by crafting a malicious XML file that, when parsed by an application using vulnerable versions of libexpat, may cause memory corruption leading to information disclosure or data tampering. This is a local attack requiring no special privileges, though exploitation requires specific conditions to manifest.

• CVE-2026-56411MEDIUM 6.9

  libexpat, a widely-used XML parsing library, contains an integer overflow vulnerability in its xmlwf utility when processing NOTATION declarations within DOCTYPE sections. An attacker who can supply a maliciously crafted XML file with specially constructed NOTATION declarations can trigger an integer overflow, potentially leading to memory corruption and code execution on the affected system. The vulnerability affects versions of libexpat before 2.8.2.

• CVE-2025-15653MEDIUM 6.8

  Dräger's Zeus Infinity Empowered and Zeus RS C500 anesthesia workstations have a security flaw that allows someone with physical access to a device to compromise its software through USB ports. An attacker could interfere with anesthesia delivery, alter medical data, or use the device as a stepping stone to attack a hospital network if the workstation is networked or connected to Dräger's service platform.

• CVE-2025-7386MEDIUM 6.8

  Hitachi Storage Navigator, a critical management interface for enterprise storage systems, contains an information exposure vulnerability that could allow authenticated administrators to access sensitive data they shouldn't see. The flaw affects multiple Hitachi Virtual Storage Platform models across two generations. While an attacker needs valid administrative credentials to trigger the issue, successful exploitation could expose confidential information stored or processed by the storage platform, potentially including encryption keys or configuration details that could be leveraged in follow-on attacks.

• CVE-2026-0048MEDIUM 6.8

  A vulnerability exists in Android's WindowState component that allows an attacker to overlay malicious UI on top of legitimate system dialogs, tricking users into granting permissions they did not intend to approve. The attack exploits a tapjacking technique where touch inputs are intercepted and misdirected. No special privileges or user awareness is required for the attack to succeed, making it a local but potentially high-impact privilege escalation vector.

• CVE-2026-0086MEDIUM 6.8

  A vulnerability in Android's DisableSupervisionActivity allows an attacker to delete supervision data on a device by exploiting a missing null check in the onCreate method. This flaw enables local privilege escalation without requiring any special permissions or user interaction, meaning the exploit could trigger automatically during normal device operation. The vulnerability affects multiple Android versions and has a medium severity rating.

• CVE-2026-10077MEDIUM 6.8

  A vulnerability in the YooTheme WordPress theme (versions before 5.0.35) allows users with Author-level permissions to inject malicious code into posts. While WordPress's built-in content filtering (wp_kses_post) approves certain HTML attributes as safe, YooTheme's front-end framework processes these same attributes as active markup, enabling stored XSS attacks. When other users—including administrators—view an affected post, the attacker's code executes in their browsers, potentially leading to account compromise or unauthorized actions.

• CVE-2026-10609MEDIUM 6.8

  OpenShift Cluster Logging Operator contains a flaw in how it handles ServiceAccount credentials. When an operator creates a log forwarder, it automatically generates and sends ServiceAccount tokens to external destinations without first checking whether the person setting up the forwarder should have access to those credentials. This means a delegated editor—someone with limited permissions to modify cluster configurations—could trick the system into exposing sensitive authentication tokens, then use those tokens to gain higher privileges than they should have.

• CVE-2026-11166MEDIUM 6.8

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it processes SVG (Scalable Vector Graphics) content that allows attackers to inject malicious scripts or HTML into web pages. An attacker would craft a specially designed HTML page and trick a user into visiting it; if the user does, arbitrary code could execute within the browser with the user's privileges, potentially stealing data, modifying page content, or performing actions on the user's behalf. The vulnerability requires user interaction and is rated Medium severity by Google's security team.

• CVE-2026-11218MEDIUM 6.8

  A flaw in Google Chrome's platform integration layer on Windows allows attackers to trick users into running malicious files that execute arbitrary code on their system. The vulnerability requires specific user interaction—the attacker must convince the victim to perform particular UI gestures when opening a crafted file. While Chrome's vendor assessment rates this as low severity, the combination of remote reach and code execution capability elevates the practical risk for organizations with large user populations.

• CVE-2026-11628MEDIUM 6.8

  Google Chrome versions before 149.0.7827.103 contain a use-after-free memory error in the Ozone graphics subsystem. An attacker with physical access to a device can trigger this flaw to corrupt heap memory and potentially execute arbitrary code. While the Chromium project rates this as Critical, the CVSS score reflects the requirement for physical device access, which limits real-world exploitability for most organizations.

• CVE-2026-13282MEDIUM 6.8

  A use-after-free flaw in Google Chrome's Payments feature on Android devices could allow an attacker with physical access to the device to corrupt memory and potentially execute malicious code. The vulnerability affects Chrome versions prior to 149.0.7827.201 and requires the attacker to have direct, hands-on access to the Android device. While the underlying Chromium security team rated this as High severity, the CVSS score reflects the practical constraint that exploiting it demands physical presence—a meaningful limitation in most enterprise and consumer threat models.

• CVE-2026-13595MEDIUM 6.8

  A memory safety bug in libblkid—a core Linux utility library responsible for identifying and reading partition tables—allows an attacker to trigger a use-after-free condition by inserting a specially crafted block device. When libblkid probes nested partitions (partitions within partitions), it caches a memory address pointing to partition information. If the system then discovers additional partitions and reallocates internal memory structures, that cached address becomes invalid. Subsequent reads from that stale pointer can leak sensitive information from kernel memory or crash the system. The risk is amplified because libblkid runs automatically with root privileges during USB insertion or when users mount disk images—no manual intervention required.

• CVE-2026-14440MEDIUM 6.8

  Cloudflare's Universal SSL feature automatically manages DNS Certificate Authority Authorization (CAA) records to enable TLS certificate issuance on behalf of customers. However, the auto-managed CAA records are intentionally permissive and do not honor stricter security parameters (RFC 8657 accounturi and validationmethods) that customers may set independently. This creates a gap: if a customer configures advanced CAA protections to bind certificate issuance to specific ACME accounts or validation methods, Cloudflare's authoritative DNS overrides those settings with a more permissive record at query time. A sophisticated attacker with access to an ACME account at one of the listed Certificate Authorities could potentially obtain a valid browser-trusted TLS certificate for the affected domain, enabling man-in-the-middle attacks. Exploitation is difficult in practice, requiring the attacker to satisfy domain validation from multiple geographically distributed CA vantage points and work around Cloudflare's global anycast network architecture.

• CVE-2026-36027MEDIUM 6.8

  CVE-2026-36027 is a medium-severity vulnerability affecting Code27 Companion Hub (build SQ3A.220705.003.A1) that allows an attacker with physical access to a device to run malicious code by exploiting USB debugging features. The vulnerability resides in how the Android Debug Bridge (ADB) components handle authentication and code execution, requiring an attacker to be physically present but not requiring any user interaction or special permissions to trigger the attack.

• CVE-2026-36028MEDIUM 6.8

  CVE-2026-36028 is a protection mechanism failure in the Code 27 Companion Hub that allows an attacker with physical access to the device to completely bypass kiosk restrictions by performing a factory reset. The vulnerability requires no authentication or user interaction and exposes high-value information and system integrity. The risk is primarily environmental—it only affects devices where physical access can be obtained and where kiosk restrictions are relied upon for security.

• CVE-2026-36175MEDIUM 6.8

  CVE-2026-36175 is a physical authentication bypass vulnerability affecting GNCC GP5 v7.1.76. An attacker with direct physical access to a device can interrupt the boot process and inject malicious kernel boot arguments, circumventing security controls to obtain root-level access. The vulnerability requires the attacker to be present at the device during startup, making it a targeted risk rather than a remote threat.

• CVE-2026-36933MEDIUM 6.8

  Boyleep K11 y108 devices running firmware version 2.3.0.11291 contain a vulnerability in their factory test feature that allows an attacker with physical access to execute arbitrary code. This means someone with hands-on access to the device can bypass normal security controls and run malicious code with full device privileges. The vulnerability requires no special permissions or user interaction to exploit once physical access is achieved.

• CVE-2026-39468MEDIUM 6.8

  A vulnerability in Meta Box, a popular WordPress custom fields framework, allows contributors with limited account privileges to delete arbitrary files from an affected website. The flaw exists in versions 5.11.1 and earlier. While an attacker would need contributor-level access or higher to exploit this, successful exploitation can lead to website unavailability, data loss, or system instability if critical files are deleted. This is a path traversal issue that bypasses normal file permission checks.

• CVE-2026-45608MEDIUM 6.8

  A flaw in Windows DHCP Client allows a local attacker to read sensitive memory content without authentication. The vulnerability exists because the DHCP client fails to validate buffer boundaries before reading network configuration data, exposing information like cached credentials or system details to an attacker with local access. No user interaction is required, and the attacker does not need special privileges—standard user permissions are sufficient.

• CVE-2026-45673MEDIUM 6.8

  Netty, a widely-used Java framework for building network applications, has a DNS resolver flaw that makes it easier for attackers to poison DNS caches. The issue stems from two weaknesses: the framework generates DNS request IDs using a predictable random number generator, and it sends all DNS queries from the same UDP port by default. Together, these reduce the unpredictability of DNS traffic, making it feasible for an attacker to craft malicious DNS responses that get cached and served to users—a technique known as DNS Cache Poisoning or a Kaminsky attack. Patched versions 4.1.135.Final and 4.2.15.Final address both issues.

• CVE-2026-45775MEDIUM 6.8

  Discourse, a popular open-source discussion platform, contains a path traversal vulnerability in its backup handling system that could allow an authenticated site administrator to access backup files from other sites within the same multisite deployment. The vulnerability affects versions 2026.1.0 through 2026.1.3, 2026.3.0, and 2026.4.0. An attacker with admin privileges on one Discourse site could craft a specially crafted backup download request to retrieve sensitive backup data from a different site hosted on the same infrastructure. This requires existing administrative authentication and only impacts deployments where backups are stored locally on the same server. The issue has been resolved in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

• CVE-2026-45810MEDIUM 6.8

  Nextcloud Server contains an authorization flaw that allows any authenticated user with access to a single file comment to read all comments across the system. The vulnerability stems from missing validation when retrieving comment data, effectively breaking comment-level access controls. An attacker needs valid Nextcloud credentials and interaction with at least one comment, but can then enumerate and read comments they should not have permission to access. This affects Nextcloud Server 31.0.0 through 31.0.11 and 32.0.0 through 32.0.2, with critical patches available.

• CVE-2026-47775MEDIUM 6.8

  Envoy, a widely-used open-source proxy for cloud applications, has a weakness in how it protects user authentication data. When processing OAuth2 logins, Envoy encrypts a sensitive code using standard encryption without adding a security tag. An attacker can exploit this by sending many carefully crafted requests to the login callback endpoint, observing whether they succeed or fail, and gradually reconstructing the encrypted code. Once reconstructed, the attacker can impersonate the user if they also have a stolen authorization code. This affects Envoy versions before 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

• CVE-2026-47838MEDIUM 6.8

  Spring Security contains a flaw in how it processes X.509 certificate subject names (the DN field used for authentication). When a certificate contains a specially crafted Common Name (CN) value, Spring Security may misread it and extract the wrong username. An authenticated attacker could exploit this by presenting a malformed certificate to impersonate another user. The vulnerability affects multiple Spring Security versions across the 5.7, 5.8, 6.3, 6.4, and 6.5 release lines.

• CVE-2026-48117MEDIUM 6.8

  DroneAware, a drone detection platform accessible at droneaware.io, had a critical account security flaw that allowed attackers to hijack user accounts before legitimate owners completed setup. An attacker could register an account using someone else's email address with their own password, then when the real owner activated the account (either by email link or Google login), the attacker's password remained valid—giving the attacker persistent, silent access without alerting the victim. The vulnerability has already been fixed server-side as of May 20, 2025, and no action is required from users.

• CVE-2026-48775MEDIUM 6.8

  LangGraph SQLite Checkpoint, a data persistence component in LangGraph, can deserialize untrusted Python objects from checkpoint files stored in SQLite databases. If an attacker gains write access to the checkpoint storage backend, they can inject malicious serialized objects that execute arbitrary code when the application loads a checkpoint. This is a defense-in-depth vulnerability—it requires an attacker to first compromise the underlying storage layer, but if they do, they can escalate that access to runtime code execution. The issue affects versions 4.1.0 and earlier; version 4.1.1 and later contain a fix.

• CVE-2026-48782MEDIUM 6.8

  Pydantic AI, a Python framework for building AI agent applications, contains a vulnerability that allows attackers to bypass security protections designed to prevent unauthorized access to cloud credentials. The issue stems from an incomplete fix to a prior vulnerability (CVE-2026-46678). Attackers can use IPv6 address encoding tricks to reach internal cloud metadata endpoints that store temporary AWS, Azure, or GCP credentials, potentially exposing those credentials if the application has enabled downloading from local/internal URLs. The vulnerability only affects applications that explicitly enable local URL downloads and run on networks using specific IPv6 transition technologies, which are common in NAT64-configured environments and some Kubernetes clusters.

• CVE-2026-50021MEDIUM 6.8

  pnpm, a widely-used Node.js package manager, has a gap in its integrity verification logic. When a lockfile entry is missing an integrity checksum, pnpm will install the package without validating that its contents match what was originally locked. An attacker who can modify your lockfile and redirect package downloads to a compromised registry can inject altered code into your dependencies—even when you run pnpm install --frozen-lockfile, which is intended to be a safe, reproducible install. Unlike npm's ci command, which always enforces integrity checks, pnpm silently skips verification if the checksum is absent, creating a dangerous fail-open behavior.

• CVE-2026-50206MEDIUM 6.8

  A vulnerability in Acer Connect M6E 5G devices allows an authenticated administrator to execute arbitrary commands by uploading a malicious VPN configuration file. The device fails to properly sanitize special characters in VPN profile settings, which an attacker with high-level access could exploit to break out of the configuration parsing context and inject system commands. This is not a vulnerability an unauthenticated remote user can easily trigger, but it represents a significant risk in environments where VPN profiles are managed by potentially compromised accounts or supply chain actors.

• CVE-2026-50507MEDIUM 6.8

  Windows BitLocker, Microsoft's full-disk encryption feature, contains a flaw that allows an attacker with physical access to a device to bypass its security protections without providing authentication credentials. The vulnerability affects multiple versions of Windows 10, Windows 11, and Windows Server platforms. Because the attack requires physical presence, the risk is somewhat contained to scenarios where an attacker can directly access hardware—such as a stolen laptop or a device left unattended in a hostile environment. The vulnerability is classified as medium severity, but organizations relying on BitLocker as a primary defense against data theft should treat this seriously.

• CVE-2026-50573MEDIUM 6.8

  pnpm, a widely-used Node.js package manager, has a vulnerability that undermines a core security mechanism: the lockfile integrity check. When you run `pnpm install` without the frozen flag, pnpm is supposed to verify that downloaded packages match the integrity hashes stored in pnpm-lock.yaml. However, in versions before 10.34.0 and 11.4.0, if a package registry serves modified content for a previously-locked package, pnpm reports the mismatch but then silently accepts the new content, updates the lockfile, and installs the modified package anyway. This defeats the purpose of lockfile integrity verification, which exists to prevent supply-chain attacks where registries or network intermediaries might inject malicious code into your dependencies.

• CVE-2026-52809MEDIUM 6.8

  Gogs, a self-hosted Git service, contains a password-reset token vulnerability affecting versions before 0.14.3. When administrators configure a shorter password-reset window (such as 10 minutes) for security or compliance purposes, the system ignores that setting and instead issues tokens valid for the much longer account-activation lifetime. Users receive password-reset emails that falsely claim tokens expire in the configured shorter timeframe, but the tokens remain valid far longer than advertised. This discrepancy between stated and actual token lifetime significantly extends the window in which a stolen reset token can be exploited to compromise an account.

• CVE-2026-53196MEDIUM 6.8

  A vulnerability in the Linux kernel's USB serial driver for IO Technic devices allows a malicious USB device to overflow kernel memory when connected to a host system. The driver fails to properly validate the size of data it reads from a device's onboard memory, trusting an untrusted value from the device itself. When a crafted device is plugged in, it can write far more data into a small kernel buffer than it was designed to hold, potentially leading to code execution or system crash.

• CVE-2026-53523MEDIUM 6.8

  Nezha Monitoring, a self-hosted server and website monitoring tool, contains a host header injection vulnerability in its OAuth2 authentication flow. Attackers can manipulate the Host header in requests to trick the application into constructing malicious OAuth2 callback URLs, potentially redirecting users to attacker-controlled sites during the authentication process. The vulnerability affects all versions from 1.0.0 through 2.1.x and has been fixed in version 2.2.0.

• CVE-2026-54421MEDIUM 6.8

  OpenStack Ironic has a flaw where PATCH requests to update volume property fields can leak sensitive credentials like iSCSI usernames and passwords to authorized users. This is a privilege-aware vulnerability—only users with authorization to modify those fields can trigger the leak, and only through PATCH operations, not POST. The issue affects Ironic versions before 37.0.1.

• CVE-2026-55201MEDIUM 6.8

  Evil-WinRM versions through 3.9 contain a path traversal flaw in how they handle file downloads from Windows servers. When a user downloads files from a remote Windows machine using Evil-WinRM, a compromised or rogue server can trick the client into writing files outside the intended download folder by embedding special directory-traversal sequences (like "../") in filenames. An attacker controlling the remote server could exploit this to overwrite important files on the client machine—such as SSH keys or shell configuration files—potentially gaining persistent access or escalating privileges on the client system.

• CVE-2026-55411MEDIUM 6.8

  ToolJet, an open-source platform for building internal tools and AI agents, contains a credential exposure vulnerability affecting versions prior to 3.20.1780-lts. An authenticated user can request decryption of data-source secrets belonging to any other organization by knowing or guessing a credential ID. The vulnerability exists because the decryption endpoint lacks proper access controls and organization-level scoping, allowing cross-tenant secret theft. Only users with a ToolJet account can exploit this, but the attacker's organization affiliation is irrelevant—any authenticated user gains access to any other tenant's secrets.

• CVE-2026-55689MEDIUM 6.8

  OpenFGA, an authorization engine widely used by developers, has a flaw in how it validates authentication tokens when using OpenID Connect (OIDC). Before version 1.18.0, if a system administrator configured OIDC authentication without explicitly setting an audience parameter, the system would accept tokens meant for other services using the same identity provider. An attacker with valid credentials for a related service could potentially use their token to gain unauthorized access to OpenFGA instances. This is a configuration-dependent vulnerability that requires both OIDC enablement and a missing audience configuration to be exploitable.

• CVE-2026-55885MEDIUM 6.8

  Grav, a file-based web platform, contains a vulnerability in versions prior to 1.7.53 that allows authenticated administrators with backup permissions to download sensitive configuration files and password hashes. An attacker with admin credentials and backup access can retrieve a complete backup archive that includes the administrator password hash and site configuration details, potentially enabling lateral movement or privilege escalation. The vulnerability is mitigated by restricting backup permissions and updating to version 1.7.53 or later.

• CVE-2026-56109MEDIUM 6.8

  CVE-2026-56109 is a memory corruption vulnerability in ALSA (Advanced Linux Sound Architecture), a fundamental audio library used across Linux systems. When the library parses a specially crafted audio configuration file, it accidentally frees the same memory location twice—a condition called a double-free. This memory corruption can crash audio services or potentially allow an attacker to corrupt data on the system. The vulnerability requires local access and a malicious configuration file, so it poses a moderate but real risk to Linux deployments where untrusted users can provide audio configuration.

• CVE-2026-56342MEDIUM 6.8

  AVideo through version 27.0 contains a server-side request forgery (SSRF) vulnerability in its Live plugin test endpoint. An authenticated administrator can craft requests to the statsURL parameter that bypass internal validation, allowing them to read responses from arbitrary URLs—including private IP ranges, localhost services, and cloud metadata endpoints. This means an attacker with admin access could potentially extract sensitive credentials, internal service configurations, and network topology information from your infrastructure.

• CVE-2026-57948MEDIUM 6.8

  Pinpoint through version 3.1.0 improperly configures its session cookies, leaving them accessible to JavaScript code running on the same domain and transmittable in unencrypted HTTP traffic. An attacker who can inject malicious JavaScript—either through a stored weakness in the application or a temporary reflected payload—can steal the session token and hijack an authenticated user's account. Additionally, on networks where HTTP is used, an attacker positioned to observe traffic can intercept the session cookie directly. The vulnerability requires user interaction (visiting a malicious link or page) and network or code-injection conditions to exploit, but the impact—full account compromise—is significant.

• CVE-2026-58208MEDIUM 6.8

  NATS Server, a popular messaging platform used in cloud and edge deployments, contains a flaw in its WebSocket listener that can be exploited by an unauthenticated attacker to crash the server. The vulnerability arises because the WebSocket component attempts to route MQTT-over-WebSocket traffic to MQTT handling logic even when MQTT is not actually configured or initialized on that server instance. An attacker with network access to the WebSocket listener can send specially crafted requests that trigger this uninitialized state, causing the server process to crash and disrupting messaging services. The issue affects versions prior to 2.14.3 and 2.12.12.

• CVE-2026-58404MEDIUM 6.8

  Hugo, a popular static site generator, contains a security bypass in versions 0.162.0 through 0.163.0. The issue stems from incomplete validation of IP address formats in Hugo's security policy for remote requests. While the security policy correctly blocks requests to loopback addresses (127.0.0.1) and cloud metadata endpoints, attackers can circumvent this protection by encoding IP addresses in alternative formats—such as integers, hexadecimal, or octal notation—that the validator doesn't recognize. This allows malicious templates to make unauthorized requests to local services during the build process, potentially exposing sensitive data from cloud metadata services in CI/CD environments. The vulnerability is resolved in version 0.163.1.

• CVE-2026-58522MEDIUM 6.8

  Microsoft Edge for Android contains a flaw that allows an attacker with local access to a device to view sensitive files through relative path traversal. This occurs because the application improperly validates file paths, enabling an attacker to navigate beyond intended directories and access information they should not be able to reach. An attacker does not need special permissions or user interaction to exploit this vulnerability.

• CVE-2026-59208MEDIUM 6.8

  n8n workflow automation instances can be tricked into granting unauthorized access when they trust multiple token issuers for authentication. An attacker with a valid token from one trusted issuer can impersonate users from another trusted issuer if their token's subject identifier matches a victim's username. The flaw stems from n8n only checking the user's identifier in the token while ignoring which issuer provided it, creating a mismatch between authentication sources.

• CVE-2026-59804MEDIUM 6.8

  Midscene Bridge Server versions up to 1.10.3 fail to validate the origin of incoming WebSocket connections and do not require authentication tokens. An attacker can open a malicious website, and when a victim visits it, the attacker's page can connect to the victim's local Socket.IO server without any authentication. Once connected, the attacker can take over the active bridge session, intercept automation commands, inject malicious instructions, steal data from command payloads, or crash the server entirely. The vulnerability requires user interaction—the victim must visit a malicious site—but once triggered, it grants near-complete control over any active Midscene Bridge automation.

• CVE-2026-59807MEDIUM 6.8

  Composio SDK versions before 0.2.32-beta.283 contain a flaw that bypasses file path validation controls. An attacker can craft malicious prompts that trick the SDK into reading and uploading sensitive files—such as SSH private keys and credentials—to attacker-controlled storage. The vulnerability requires network access but does not need authentication or user interaction, making it a meaningful risk for environments where the SDK processes untrusted input.

• CVE-2026-7764MEDIUM 6.8

  A flaw in Morse Micro's HaLow Wi-Fi kernel driver allows an attacker within radio range to crash devices or leak small amounts of sensitive memory by sending a specially crafted wireless frame. The vulnerability exists because the driver doesn't properly validate the size of data embedded in beacon or probe response frames before reading from it. No password, pairing, or user action is needed—an attacker simply has to be nearby with the right equipment.

• CVE-2026-7842MEDIUM 6.8

  The Infility Global WordPress plugin versions before 2.15.20 contain a SQL injection vulnerability in its import functionality. Attackers with Editor-level WordPress access can manipulate sorting parameters to extract database contents without needing to modify data. This requires the ImportData module to be enabled and the attacker to already have a valid WordPress account with elevated privileges.

• CVE-2026-8595MEDIUM 6.8

  An Editor-level user in Grafana can create a dashboard containing a specially crafted table panel with a malicious field name. When other users view that dashboard, the malicious field name executes as JavaScript in their browsers without additional user interaction beyond viewing the dashboard. This is a stored cross-site scripting (XSS) vulnerability—the attack persists in the dashboard artifact itself, making it a reliable vector for compromising viewer sessions.

• CVE-2026-9261MEDIUM 6.8

  Canon EOS Network Setting Tool versions 1.5.0 and earlier use weak SSH encryption algorithms when communicating over the network. An attacker positioned to intercept traffic—such as on a shared network or via man-in-the-middle positioning—could potentially decrypt SSH sessions or forge authentication, compromising the confidentiality and integrity of communications between the tool and network devices. This affects both macOS and Windows users of the tool.

• CVE-2026-9673MEDIUM 6.8

  The json-2-csv package contains a flaw in its CSV injection protection mechanism. Versions 3.15.0 through 5.5.10 allow an attacker to bypass the preventCsvInjection option and inject malicious formulas into CSV files. When a user opens these files in spreadsheet applications like Excel or Google Sheets, the formulas execute automatically, potentially leading to data exfiltration or further compromise.

• CVE-2026-9699MEDIUM 6.8

  Mattermost Plugins up to certain versions contain a logging vulnerability that can expose OpenAI API keys. When the OpenAI API returns an error during authentication attempts, Mattermost fails to strip sensitive information before writing the response to log files. An attacker with access to server logs—such as a system administrator, support team member, or someone with read access to log files or diagnostic packages—could extract a valid or partially recoverable OpenAI API key. This is a privilege-escalation risk: the attacker must already have legitimate access to logs or support materials, but once they do, they can obtain credentials that unlock external API access.