By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 48 of 86

• CVE-2026-43718MEDIUM 6.5

  Apple has patched a stack overflow vulnerability affecting Safari and multiple Apple operating systems. The flaw occurs when processing specially crafted web content and can cause Safari to crash unexpectedly. While the vulnerability requires user interaction (visiting a malicious website), it affects a widely-used browser on billions of devices. Apple addressed it through improved input validation in Safari 26.5.2 and corresponding OS updates across iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS.

• CVE-2026-43720MEDIUM 6.5

  A use-after-free memory vulnerability in Apple Safari and related systems allows attackers to crash Safari by tricking users into viewing specially crafted web content. The flaw stems from improper memory management that leaves dangling references to freed memory, which attackers can exploit to trigger an unexpected application crash. While the vulnerability requires user interaction (visiting a malicious website), it affects a widely used browser across multiple Apple platforms.

• CVE-2026-43721MEDIUM 6.5

  CVE-2026-43721 is a clipboard hijacking vulnerability affecting Apple's Safari browser and iOS/iPadOS/macOS platforms. A malicious website can silently read clipboard data without user knowledge or consent. The flaw stems from insufficient state management in how browsers track clipboard access permissions. While the attack requires user interaction to visit a malicious site, it poses a meaningful risk to sensitive data that users routinely copy and paste, such as passwords, authentication tokens, or private information.

• CVE-2026-43726MEDIUM 6.5

  A use-after-free memory vulnerability in Apple's Safari browser and related operating systems can cause unexpected application crashes when processing maliciously crafted web content. An attacker would need to convince a user to visit a malicious website, but no special privileges or complex setup is required for exploitation. The impact is limited to denial of service through crashes; the vulnerability does not enable data theft or system compromise.

• CVE-2026-43727MEDIUM 6.5

  A use-after-free memory flaw in Apple's Safari browser and related operating systems can crash Safari when processing malicious web content. An attacker would need to trick a user into visiting a crafted webpage, but no authentication or special user privileges are required—standard web browsing is the attack vector. The crash causes a denial of service; there is no evidence of data theft or system compromise from this vulnerability alone.

• CVE-2026-43732MEDIUM 6.5

  A path handling flaw in Apple's Safari browser and related operating systems could allow an attacker to trick users into visiting a malicious website that discloses sensitive information stored on their device. The vulnerability requires user interaction—specifically clicking a link or visiting a crafted page—but does not allow attackers to modify data or crash systems. Apple has patched this across Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.

• CVE-2026-43734MEDIUM 6.5

  A use-after-free memory vulnerability affects Apple's Safari browser and iOS/iPadOS/macOS operating systems. An attacker can craft a malicious webpage that, when visited, causes Safari or the built-in web rendering engine to crash unexpectedly. While the crash itself denies service rather than enabling data theft or system compromise, the vulnerability requires user interaction—the person must visit the malicious site. Apple has issued patches across multiple platforms and device types.

• CVE-2026-43740MEDIUM 6.5

  Apple has patched a memory disclosure vulnerability affecting Safari, iOS, iPadOS, and macOS. When a user visits a maliciously crafted website, the browser can leak sensitive data from its process memory to an attacker. The flaw stems from insufficient memory handling in the browser's web content processing engine. While the vulnerability requires user interaction (visiting a malicious site), the confidentiality risk is significant enough that Apple classified it as MEDIUM severity and issued fixes across multiple platforms simultaneously.

• CVE-2026-43742MEDIUM 6.5

  CVE-2026-43742 is a use-after-free memory vulnerability in Apple's Safari browser and related operating systems. An attacker can craft a malicious website that, when visited by a user, causes Safari or the affected system to crash unexpectedly. The vulnerability requires user interaction (visiting a malicious site) but does not enable data theft or system compromise—it simply stops the browser or app from working. Apple has released patches across its ecosystem to fix the underlying memory management flaw.

• CVE-2026-43745MEDIUM 6.5

  Safari and related Apple products contain an out-of-bounds write vulnerability that can crash the browser when processing specially crafted web content. An attacker would need to trick a user into visiting a malicious website to trigger the flaw. There is no indication of data theft or system compromise, but the denial-of-service impact may disrupt work or enable follow-on attacks.

• CVE-2026-43746MEDIUM 6.5

  Safari and related Apple operating systems contain a use-after-free memory flaw that can crash the browser when processing specially crafted web content. An attacker would need to trick a user into visiting a malicious webpage, but no special privileges or system access are required. The crash itself does not allow data theft or system compromise—it is a denial-of-service issue. Apple has released patches for Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2 that fix the underlying memory management problem.

• CVE-2026-43951MEDIUM 6.5

  Apache HTTP Server contains an out-of-bounds read vulnerability in the mod_headers and mod_mime modules when handling responses with multiple language variants. An unauthenticated attacker on the network can trigger this flaw to read sensitive data from server memory without requiring user interaction or special privileges. The vulnerability affects all versions from 2.4.0 through 2.4.67.

• CVE-2026-44645MEDIUM 6.5

  LiquidJS, a JavaScript template engine compatible with Shopify and GitHub Pages, contains a denial-of-service vulnerability in versions 10.25.7 and below. The vulnerability allows an attacker with the ability to write templates to bypass the renderLimit protection mechanism—a feature designed to prevent templates from consuming excessive CPU time. By crafting a template with an empty for loop or tablerow block, an attacker can force a single render operation to consume far more time than the configured limit allows, potentially freezing application threads and disrupting service availability. This is particularly dangerous in multi-tenant environments where untrusted users can author templates.

• CVE-2026-44653MEDIUM 6.5

  LibreChat versions up to 0.8.3 expose sensitive credentials to users with view-only access to MCP (Model Context Protocol) servers. When a user with limited permissions queries the server configuration API, they receive plaintext API keys and OAuth secrets that should remain encrypted and admin-only. This breaks the intended access control model where viewers should never see the credentials needed to authenticate with external AI providers. An attacker with even basic read access can steal these secrets and impersonate the legitimate service.

• CVE-2026-44734MEDIUM 6.5

  OpenProject versions before 17.3.2 and 17.4.0 contain a flaw that allows any logged-in user to rename or modify the filters and grouping settings of public cost reports, even if they don't own them. An attacker who learns the numeric ID of a public cost report—either by discovery or guessing—can alter its configuration without the actual owner being notified. This undermines report integrity and can lead to data confusion or operational disruption. The vendor has patched this in versions 17.3.2 and 17.4.0.

• CVE-2026-44735MEDIUM 6.5

  OpenProject, an open-source project management platform, contains a flaw in its share access API that leaks sensitive work package information to project members who shouldn't see it. When a user with basic project permissions requests share details through the API, the system fails to check whether that user can actually view each individual work package. This allows them to discover confidential work package titles, which team members have been granted access to shared items, and what permission level (Editor, Commenter, or Viewer) was assigned to each. The vulnerability affects versions before 17.3.2 and 17.4.0.

• CVE-2026-44736MEDIUM 6.5

  OpenProject, a popular open-source project management platform, contains an information disclosure vulnerability that allows any authenticated user to discover the titles and relationships of work packages they should not be able to see. An attacker with legitimate access to the system can query the relations API endpoint and retrieve sensitive project information by guessing or enumerating work package IDs, circumventing the intended permission controls. This vulnerability was introduced as a side effect of a performance optimization and is resolved in version 17.4.0.

• CVE-2026-44740MEDIUM 6.5

  Billy, a Go library that abstracts filesystem operations, contains multiple input validation flaws that can cause denial-of-service conditions. When processing untrusted repository or filesystem data, the library can panic, enter infinite loops, or consume excessive system resources due to missing safeguards like cycle detection and recursion limits. Authenticated users can trigger these conditions over the network. The issue affects versions prior to 5.9.0 and 6.0.0-alpha.1.

• CVE-2026-44744MEDIUM 6.5

  SAP S/4HANA (On-Premise) contains a SQL injection flaw in a remote-enabled function module that allows authenticated users to craft malicious database queries. An attacker with valid credentials could bypass normal access controls and retrieve sensitive data they shouldn't see. The vulnerability does not affect system availability or data integrity—only confidentiality is at risk.

• CVE-2026-44784MEDIUM 6.5

  Discourse group owners can view their group's SMTP credentials in plaintext through the group history log, even if they lack admin or moderator privileges. This vulnerability allows unauthorized credential exposure—particularly the SMTP password—which could be misused to send emails impersonating the group from outside Discourse. The issue affects Discourse installations running vulnerable versions that have configured per-group SMTP settings and assigned group ownership to users who should not have access to email infrastructure credentials.

• CVE-2026-44796MEDIUM 6.5

  Nautobot, a network automation and source-of-truth platform, contains a denial-of-service vulnerability in its bulk-rename feature. An authenticated attacker can craft malicious regular expressions in the 'find' field and enable the regex flag to cause the application to hang or become unresponsive, disrupting access for all users. The flaw affects versions before 2.4.33 and 3.1.2.

• CVE-2026-44877MEDIUM 6.5

  CVE-2026-44877 is a remote vulnerability affecting HPE Networking Instant On switches (models 1830, 1930, and 1960) that allows an unauthenticated attacker to retrieve sensitive cryptographic secrets from a vulnerable device. While the attacker needs some level of network access to exploit it, the vulnerability poses a significant risk because successful exploitation exposes encryption keys and other cryptographic material that could be used to compromise further systems or decrypt sensitive communications.

• CVE-2026-44884MEDIUM 6.5

  Portainer Community Edition versions 2.33.0 through 2.33.7 and 2.39.0 contain a flaw that lets any logged-in user view template files they shouldn't have access to. By trying different ID numbers, an attacker can enumerate and read custom template files that may hold sensitive credentials or connection strings—data that administrators likely assume only authorized users can see. The vulnerability has been patched in versions 2.33.8 and 2.39.1.

• CVE-2026-44942MEDIUM 6.5

  A vulnerability in libzypp, the package management library used by openSUSE and other Linux distributions, allows an authenticated attacker to write files to arbitrary directories on a system by exploiting how the software processes repository configuration files (.repo files). Rather than storing downloaded content in the intended cache directories, an attacker could direct files to other locations on disk, potentially filling up storage or overwriting important system files. The issue affects libzypp versions before 17.38.13 in the 17.x branch and before 16.22.19 in the 16.x branch.

• CVE-2026-45149MEDIUM 6.5

  The brace-expansion library, a utility for generating string sequences from patterns, has a performance handling flaw in versions 5.0.0 through 5.0.5. When users expand large numeric ranges—such as {1..10000000}—the library was constructing the entire intermediate sequence in memory before applying user-defined limits. This means even if you set a maximum output of 10 items, the library would still build all 10 million elements first, consuming roughly 505 MB of memory and 800 milliseconds of processing time before discarding them. The flaw is fixed in version 5.0.6 and later.

• CVE-2026-45160MEDIUM 6.5

  ESP-IDF, Espressif's development framework for IoT devices, contains a memory safety flaw in its DHCP server component. When processing DHCP requests from clients on a local network, the parser does not properly validate option lengths, allowing an attacker to craft a malicious request that causes the device to read data beyond the intended buffer boundary. This could lead to information disclosure or device instability. The issue affects devices running as DHCP servers—notably ESP32 and similar chips using ESP-IDF's SoftAP (soft access point) feature.

• CVE-2026-45173MEDIUM 6.5

  Idira Identity Browser Extension, a credential and identity management tool available for Chrome, Firefox, and Edge, contains a flaw in how it validates the origin of web pages before executing sensitive operations. An attacker could create a malicious webpage that tricks an already-logged-in user into triggering unauthorized actions within their authenticated session. The vulnerability affects all versions before 26.8.1 and requires user interaction—specifically navigation to a crafted site—to exploit.

• CVE-2026-45192MEDIUM 6.5

  Apache Airflow's connection API endpoint leaks sensitive credentials that should have been hidden. When a user with permission to read connections retrieves connection details via the REST API, the system fails to redact secrets stored in the connection's extra fields if they don't match known credential field names. This means passwords, API keys, and tokens for services like Slack can be exposed to any authenticated user with basic connection-read access—a permission that's often broadly granted in Airflow deployments.

• CVE-2026-45259MEDIUM 6.5

  FreeBSD's Capsicum security framework—a capability-based sandboxing system—contains a flaw in how it handles signal delivery. A sandboxed process can use the sigqueue() system call to send signals to other processes on the system, bypassing the sandbox restrictions that should limit its actions. An attacker controlling a compromised sandboxed application could exploit this to disrupt or terminate other processes, potentially escalating impact or degrading system stability.

• CVE-2026-4526MEDIUM 6.5

  EmberZNet, Silicon Labs' Zigbee networking framework, contains a vulnerability in versions 9.0.2 and earlier that allows an already-connected network device to crash the framework by sending specially crafted global ZCL (Zigbee Cluster Library) messages. The vulnerability does not expose sensitive data and requires the attacker to already have network access—it is primarily a denial-of-service risk rather than a confidentiality or integrity threat.

• CVE-2026-45267MEDIUM 6.5

  Nextcloud versions before 5.2.6 contain a security flaw where the application fails to properly check user permissions when handling form submissions. This allows authenticated users to view form submission data belonging to other users—data they should not have access to. An attacker with valid Nextcloud credentials can exploit this to read sensitive information submitted by colleagues or other organization members through forms. The vulnerability requires an existing user account but does not need special privileges or user interaction to trigger.

• CVE-2026-45275MEDIUM 6.5

  A vulnerability in Nextcloud's Approval app allows users to bypass permission controls and force files to be shared with approvers, even when they lack sharing rights. An attacker with basic user credentials can exploit this to distribute restricted files without authorization. Nextcloud addressed this in version 2.7.2.

• CVE-2026-45282MEDIUM 6.5

  Nextcloud Server contains a flaw that allows an authenticated user to download file attachments from password-protected or restricted link shares if they know the share token and have access to a document ID. This bypasses the intended security controls around shared links. The attacker can only extract attached files, not the shared documents themselves, and the vulnerability requires prior authentication and knowledge of specific document identifiers.

• CVE-2026-45306MEDIUM 6.5

  pyLoad, a Python-based download manager, contains a directory traversal weakness that allows authenticated users to access other users' session files. An attacker with login credentials can manipulate the storage folder setting to point to a sensitive Flask session directory and then download session tokens belonging to other accounts. This could enable account takeover without requiring additional exploitation. The vulnerability exists because a prior security fix addressed some directory restrictions but overlooked the Flask session storage location.

• CVE-2026-45454MEDIUM 6.5

  A path traversal vulnerability in Microsoft SharePoint Server allows an authenticated user to access files and data outside intended boundaries, potentially leading to unauthorized code execution across the network. An attacker with valid credentials can manipulate file paths to reach restricted directories and execute arbitrary code—a serious concern in multi-tenant or shared SharePoint environments where user trust is assumed but not absolute.

• CVE-2026-45501MEDIUM 6.5

  CVE-2026-45501 is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server that allows an authenticated attacker to manipulate the server into making requests on their behalf, potentially enabling network-based spoofing attacks. The vulnerability requires valid credentials to exploit, limiting its immediate blast radius, but poses a meaningful risk for organizations where internal attackers or compromised user accounts exist. The vulnerability affects multiple versions of Exchange Server and Exchange Server Subscription Edition.

• CVE-2026-45561MEDIUM 6.5

  Roxy-WI, a web management interface for HAProxy, Nginx, Apache, and Keepalived servers, contains a server-side request forgery (SSRF) vulnerability in versions 8.2.6.4 and earlier. The vulnerability exists in routes used to monitor agent status, where user-supplied server IP addresses are passed directly into HTTP requests without proper validation. This allows an authenticated attacker to redirect requests to internal IP addresses (including metadata services, loopback, and private ranges) that should not be directly accessible, potentially exposing sensitive configuration data or service information.

• CVE-2026-45582MEDIUM 6.5

  n8n-MCP, an AI assistant integration layer for the n8n workflow automation platform, fails to fully sanitize sensitive data before transmitting workflow information to its telemetry backend. The flaw allows fragments of URLs and embedded credentials—such as API keys, tenant IDs, and signed request parameters—to leak into the project's anonymous telemetry collection. This occurs when users configure HTTP-Request-style nodes with sensitive parameters in their URLs. The vulnerability affects versions before 2.51.3, where the telemetry sanitizer was enhanced to properly redact these values before transmission.

• CVE-2026-45619MEDIUM 6.5

  WWBN AVideo, an open-source video hosting platform, contains a DNS-rebinding vulnerability in its Server-Side Request Forgery (SSRF) protections. When the application checks whether a URL is safe to fetch, it validates the domain name but then makes the actual network request without

• CVE-2026-45679MEDIUM 6.5

  OpenTelemetry eBPF Instrumentation versions before 0.9.0 leak sensitive data through telemetry systems. When Redis commands fail, the instrumentation captures and exports the raw error messages produced by Redis. Attackers or misconfigured systems can craft Redis error responses containing authentication tokens, personally identifiable information, or other secrets. These sensitive values then flow into your telemetry backend—where security teams, SREs, and external monitoring vendors can see them—and may propagate into downstream analysis, alerting, or visualization tools. This is a data exfiltration vulnerability that risks exposing confidential input into systems where it was never intended to be visible.

• CVE-2026-45696MEDIUM 6.5

  OpenEXR, the industry-standard image format for motion pictures, contains a flaw in its HTJ2K decoder that allows a maliciously crafted EXR file to crash any application that opens it. When processing the file, the decoder incorrectly trusts the declared image dimensions without validating them against the actual data buffer, causing it to read beyond allocated memory. Any tool that previews, validates, or processes EXR files—including thumbnail generators, asset management systems, and the exrcheck utility—is at risk. This affects versions 3.4.0 through 3.4.11.

• CVE-2026-45796MEDIUM 6.5

  Coder, a platform for provisioning remote development environments, contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in its Azure instance identity endpoint. An attacker can trick the Coder server into making HTTP requests to arbitrary internal or external hosts by submitting a specially crafted digital signature. While the attacker doesn't receive the full response from the target, error messages leaked in the API response allow reconnaissance—revealing whether a host is reachable and what type of failure occurred. This enables attackers to probe internal networks, cloud metadata endpoints, and other infrastructure without authentication.

• CVE-2026-4629MEDIUM 6.5

  Keycloak contains a privilege escalation vulnerability that allows administrators with client management permissions to grant themselves unauthorized access. A user with the `manage-clients` permission can inject a role mapper that artificially adds the `realm-admin` role to authentication tokens, bypassing normal access controls and gaining full administrative privileges over the Keycloak realm. This attack requires existing elevated privileges but results in complete administrative compromise.

• CVE-2026-46357MEDIUM 6.5

  CVE-2026-46357 is a denial-of-service vulnerability in HAX CMS (NodeJS version) that allows an authenticated user to crash the entire application with a single malformed request to the site creation endpoint. The impact is severe from an availability perspective: the application goes completely offline and requires manual server restart to recover. This affects only the NodeJS backend; PHP deployments are not impacted.

• CVE-2026-46397MEDIUM 6.5

  HAX CMS, a content management system for building microsite networks, contains a flaw that lets authenticated users read files they shouldn't have access to. An attacker with a valid login (even a low-privilege account) can manipulate how the system saves site configuration data, causing it to expose sensitive files like system passwords, API keys, or database credentials stored on the web server. This is a classic file inclusion attack that works over the network without requiring special browser interaction. The vendor has patched this in version 26.0.0.

• CVE-2026-46411MEDIUM 6.5

  FlashMQ, an MQTT broker used in multi-CPU environments, contains a flaw that allows authenticated users to deliberately overwhelm the server's write buffer beyond its intended limits. When this happens, the server triggers a safety mechanism that crashes the entire broker rather than gracefully handling the condition. An attacker with valid credentials can exploit this to cause a denial of service, taking the messaging broker offline.

• CVE-2026-46413MEDIUM 6.5

  Discourse, a widely-used open-source discussion platform, contains a vulnerability that allows regular (non-admin) users to upload files to sensitive backup storage areas that should be restricted to administrators only. An authenticated user can exploit S3 multipart upload functionality to bypass access controls and write files into the admin backup store. This is a privilege-escalation issue affecting data integrity rather than confidentiality; the vulnerability requires an existing user account but does not require special permissions to trigger.

• CVE-2026-46433MEDIUM 6.5

  lldpd, a Linux daemon that implements LLDP (Link Layer Discovery Protocol), contains a heap buffer over-read flaw in its VLAN tag handling code. When processing certain network frames that match the network interface's maximum transmission unit (MTU) size, the daemon reads 4 bytes beyond an allocated memory buffer. This can disrupt the daemon's operation, though it does not directly enable code execution or data theft. The vulnerability affects versions before 1.0.22 and requires network access to trigger.

• CVE-2026-46443MEDIUM 6.5

  Flowise, a no-code platform for building custom language model workflows, contains a credential exposure flaw in versions before 3.1.2. When users or applications retrieve stored credentials using a filter parameter, the system fails to remove encrypted credential data from the response—information that should never leave the server. An attacker with legitimate access to the Flowise instance could exploit this to extract encrypted credentials, potentially compromising downstream services or enabling lateral movement. The vulnerability does not affect credential retrieval when no filter is applied, indicating incomplete input-handling logic.

• CVE-2026-46463MEDIUM 6.5

  Dell PowerProtect Data Domain, a data protection and deduplication appliance widely deployed in enterprise backup environments, contains a flaw that allows an unauthenticated remote attacker to cause the system to stop responding. The vulnerability stems from improper handling of numeric calculations, which can overflow and trigger unexpected behavior. An attacker does not need valid credentials to attempt exploitation, making this a network-reachable concern for organizations running affected versions.

• CVE-2026-46540MEDIUM 6.5

  Nimiq's light client implementation contains a state synchronization bug where certain blockchain reorganizations (forks) fail to properly update critical consensus state. When a light client switches to a fork chain that ends in a macro block—a special checkpoint or validator election block—it updates its main chain pointer but forgets to update related state variables that track the most recent macro block and active validators. This causes the light client to verify subsequent blocks against outdated information, either rejecting valid blocks or stalling entirely if an election block triggered the fork. The bug only affects light clients (thin clients), not full nodes, and is fixed in version 1.4.0.

• CVE-2026-46551MEDIUM 6.5

  NocoDB, a spreadsheet-like database builder, contains a flaw in how it handles file uploads from remote URLs. Authenticated editors and above can trick the server into downloading extremely large files without respecting size limits, which can fill up the disk and crash the service. The vulnerability exists in versions prior to 2026.04.4 and stems from the attachment API not validating remote file sizes before initiating downloads.

• CVE-2026-46718MEDIUM 6.5

  Apache Calcite versions 1.5.0 through 1.41 contain a vulnerability that allows attackers to supply malicious input which the application then uses to dynamically load arbitrary Java classes. This unsafe reflection flaw requires only network access and no authentication, enabling remote attackers to potentially execute unintended code or access sensitive data. The vulnerability has been resolved in version 1.42.

• CVE-2026-46810MEDIUM 6.5

  Oracle Identity Manager contains a flaw in its End User Self Service component that allows an attacker to modify, add, or delete certain data and read sensitive information without needing to log in first. The vulnerability affects two specific versions of the software and can be exploited remotely via network access through the IIOP protocol. No user interaction or special circumstances are required to trigger the attack.

• CVE-2026-46869MEDIUM 6.5

  CVE-2026-46869 is a medium-severity vulnerability in Oracle MySQL Shell (versions 8.4.0–8.4.9 and 9.0.0–9.7.0) that allows an unauthenticated attacker on the network to access sensitive data stored within MySQL Shell. The attack requires a person to interact with a malicious input or link, but once triggered, an attacker can read confidential information without needing to authenticate. No integrity or availability impact occurs—this is purely a data exposure risk.

• CVE-2026-46871MEDIUM 6.5

  MySQL Shell, Oracle's command-line interface and IDE extension for MySQL databases, contains a flaw that allows an authenticated attacker to read sensitive data without authorization. The vulnerability exists in the VS Code extension component and affects version 2026.2.0+9.6.1. An attacker who already has valid credentials can exploit this over the network to access confidential information stored within MySQL Shell's scope, but cannot modify or delete data.

• CVE-2026-46979MEDIUM 6.5

  Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38 contains a vulnerability in its integration and interfaces component that allows high-privileged attackers to access the system over HTTPS and read or modify sensitive institutional data. The vulnerability requires the attacker to already hold elevated administrative credentials, but once authenticated, they can view or alter critical campus and community information without additional obstacles. This represents a data confidentiality and integrity risk rather than a system availability threat.

• CVE-2026-47110MEDIUM 6.5

  Tiptap for PHP versions before 2.1.1 have a flaw that allows logged-in users to deliberately crash the server's ability to render HTML content. An attacker submits a specially crafted Tiptap JSON document where a link URL field is set to an array of values instead of a single text string. When the server tries to validate this field using a string-matching function, it crashes with an unhandled error. Once this malformed data is saved to the database, every user who tries to view that record will trigger the same crash, disrupting service until a database administrator manually fixes the entry.

• CVE-2026-47124MEDIUM 6.5

  Nezha Monitoring, a self-hosted server monitoring tool, contains an authorization bypass flaw affecting versions 1.4.0 through 2.0.8. The vulnerability allows any logged-in user without admin privileges to access real-time telemetry data for all servers in the system, regardless of their assigned permissions. While the main API properly restricts server visibility based on user roles, the WebSocket endpoint that streams live server status incorrectly grants access to any authenticated user, exposing sensitive monitoring data across the entire infrastructure. This was fixed in version 2.0.9.

• CVE-2026-47145MEDIUM 6.5

  EmberZNet versions 9.0.2 and earlier contain a vulnerability where specially crafted Color Control messages can crash the application. The attack requires the attacker to already be a joined member of the network, limiting exposure to internal threats. Only devices that support the Color Control cluster are vulnerable. The impact is denial of service—the application terminates unexpectedly—rather than data theft or system compromise.

• CVE-2026-47146MEDIUM 6.5

  CVE-2026-47146 is a denial-of-service vulnerability in Silicon Labs EmberZNet versions 9.0.2 and earlier. An attacker who has already joined a Zigbee network can send specially crafted Color Control cluster messages that cause the EmberZNet process to crash. The vulnerability is limited to devices that implement the Color Control cluster, and requires the attacker to be an authenticated network member—not an external threat.

• CVE-2026-47148MEDIUM 6.5

  EmberZNet versions 9.0.2 and earlier contain a denial-of-service vulnerability triggered by malformed GetGroupMembership commands. An attacker with network access and prior device enrollment can send a specially crafted message that causes the receiving device to read past the end of its message buffer, crashing the process. The vulnerability does not leak data and only affects devices that support the Groups cluster—a subset of EmberZNet deployments.

• CVE-2026-47149MEDIUM 6.5

  EmberZNet v9.0.2 and earlier contains a flaw where specially crafted Door Lock cluster messages with invalid user identifiers can crash the affected device. An attacker must already be part of the network and send the malformed message from an authenticated device to trigger the issue. No data is leaked in the attack, but the device becomes unavailable until restarted.

• CVE-2026-47152MEDIUM 6.5

  EmberZNet v9.0.2 and earlier contain a denial-of-service vulnerability triggered by a specially crafted Level Control Move command. An attacker with network access and credentials to join the network can send this malformed command to crash the EmberZNet process, disrupting device functionality. The vulnerability only affects devices that implement the Level Control cluster, a component used for controlling brightness, speed, or similar dimming/ramping functions in Zigbee networks.

• CVE-2026-47153MEDIUM 6.5

  A flaw in Silicon Labs EmberZNet v9.0.2 and earlier allows a network-joined device to crash the software through a specially crafted Level Control Step command. The vulnerability stems from a divide-by-zero error that terminates the process. Because the attacker must already be part of the network and the target device must support Level Control (a lighting/dimming feature in Zigbee), the exposure is narrower than an unauthenticated internet attack, but still represents a denial-of-service risk in IoT and smart-home deployments.

• CVE-2026-47154MEDIUM 6.5

  EmberZNet versions up to 9.0.2 contain a vulnerability where specially crafted meter response messages can crash devices that support the Simple Metering cluster. The vulnerability only affects devices already connected to the network, and an attacker would need network access and authentication to send the malicious message. No data is stolen or leaked in the attack.

• CVE-2026-47155MEDIUM 6.5

  vLLM, a popular inference engine for large language models, has a supply-chain integrity vulnerability in versions before 0.22.0. When operators pin a specific model revision using deployment flags like --revision or --code-revision, vLLM may still load supporting files—such as dynamic code, GGUF model weights, image processors, or configuration files—from unpinned or default revisions instead of respecting the pinned revision. This means an operator could believe they are running a reviewed and approved version of a model, while vLLM silently loads unreviewed artifacts from elsewhere in the repository. An attacker with access to the model repository could inject malicious code or weights into these sibling artifacts, which would then be loaded even when the main model revision is pinned.

• CVE-2026-47157MEDIUM 6.5

  aiograpi, a Python library for interacting with Instagram via asynchronous API calls, had a flaw in how it handled security challenges issued by Instagram's servers. When Instagram sent a signup challenge (like a captcha or phone verification), the library blindly trusted the path provided by the server to determine where to send the user's response. An attacker positioned between the client and Instagram—such as through compromised local network, DNS spoofing, or proxy interception—could trick the library into sending sensitive requests (including the user's session credentials) to an attacker-controlled server instead of Instagram. The vulnerability was fixed in version 0.9.10 by validating challenge paths before using them.

• CVE-2026-47204MEDIUM 6.5

  Envoy, a widely-used cloud-native proxy, has a critical stability bug affecting versions 1.26.0 through 1.38.2. When the gRPC statistics filter is enabled and receives a Connect protocol request routed to a direct response, the Envoy process crashes immediately. An attacker with network access can trigger this crash with a single unauthenticated HTTP request, effectively causing a denial of service. This does not require authentication or special privileges—anyone who can send an HTTP request to the proxy can exploit it.

• CVE-2026-47207MEDIUM 6.5

  Envoy, a widely-used proxy for cloud-native applications, has a vulnerability that causes it to crash when an external processing (ext_proc) server sends a specially crafted message. The issue stems from how Envoy handles multiple responses bundled into a single network message—the first response can trigger cleanup of internal structures, but Envoy then tries to access those structures again when reading subsequent responses, leading to a crash. This affects versions 1.34.0 through 1.38.2, and is resolved in patched releases across multiple version lines.

• CVE-2026-47213MEDIUM 6.5

  Boxlite is a service that runs untrusted code safely by executing it inside lightweight virtual machines (called Boxes) with OCI containers. To prevent code from consuming resources indefinitely, administrators can set timeouts. When the timeout expires, Boxlite should forcefully terminate the process. However, in versions 0.8.2 and earlier, Boxlite uses a catchable signal (SIGALRM) instead of an uncatchable one (SIGKILL). This means malicious code can ignore the shutdown command and keep running, exhausting the virtual machine's resources and potentially disrupting the service for all users.

• CVE-2026-47238MEDIUM 6.5

  ClipBucket v5, an open-source video sharing platform, contains an authorization flaw that allows any authenticated user to modify, upload, or delete subtitles belonging to other users' videos. The vulnerability stems from missing permission checks when handling subtitle operations. An attacker with valid credentials—even a low-privilege account—can target subtitles from any video in the system, potentially corrupting content or denying legitimate users access to their own captions. The issue is fixed in version 5.5.3 - #133 and later.

• CVE-2026-47277MEDIUM 6.5

  Runtipi, a personal homeserver orchestrator, contains a vulnerability that allows unauthenticated users to read arbitrary files from the host system through its app marketplace logo endpoint. When Runtipi clones third-party app repositories, an attacker can craft a malicious app store that includes a symbolic link disguised as a logo file. Since the logo endpoint doesn't properly validate symlink targets, requesting this logo causes Runtipi to follow the symlink and return sensitive files like environment variables, JWT secrets, or application logs to the requester. This affects Runtipi versions 4.9.1 through 4.9.3 and has been patched in version 4.10.0.

• CVE-2026-47284MEDIUM 6.5

  Visual Studio Code contains a flaw that can expose sensitive information to attackers over the network. An attacker can trick a user into performing an action that leads to the disclosure of confidential data, though the attacker cannot modify systems or interrupt services. This is a moderate-severity issue requiring user interaction to exploit.

• CVE-2026-47287MEDIUM 6.5

  Visual Studio Code contains a path traversal vulnerability that could allow an attacker to modify files on your system through a malicious link or network request. The vulnerability requires user interaction—such as clicking a link or opening a file—but does not require authentication. An attacker cannot read sensitive data through this vulnerability, but they can alter or corrupt files if they successfully exploit it.

• CVE-2026-47340MEDIUM 6.5

  CVE-2026-47340 is a privilege escalation flaw in Apache DolphinScheduler that allows authenticated users to view alert instances they should not have access to. An attacker with valid credentials can bypass permission controls to see alerts associated with alert groups outside their authorization scope. This is a post-authentication issue—the attacker must already have a user account—but it enables unauthorized information disclosure within the system.

• CVE-2026-47341MEDIUM 6.5

  Apache APISIX versions 3.11.0 through 3.16.0 contain an authentication bypass vulnerability in the hmac-auth plugin. Under certain configurations, an attacker can capture and replay authentication tokens indefinitely, circumventing the token expiry mechanism designed to limit credential lifetime. This allows an attacker to maintain unauthorized access to protected APIs without re-authenticating, as long as they possess a valid token.

• CVE-2026-47644MEDIUM 6.5

  A flaw in Microsoft Edge's Copilot Chat feature allows attackers to inject specially crafted code into the application, potentially exposing sensitive information. The vulnerability requires user interaction (such as clicking a malicious link) but does not require authentication. Once triggered, it could disclose data over the network without the user's knowledge.

• CVE-2026-47655MEDIUM 6.5

  Microsoft Graph contains a flaw that allows an authorized attacker to access sensitive information they should not be able to see. The vulnerability requires the attacker to already have valid credentials, but once authenticated, they can retrieve confidential data over the network without performing additional interactions. This is classified as a medium-severity issue because exploitation requires prior authentication, limiting the attack surface to insiders or compromised accounts.

• CVE-2026-47742MEDIUM 6.5

  Shopper is a headless e-commerce admin platform that manages product catalogs and inventory. A flaw in versions prior to 2.8.0 allowed any logged-in panel user to modify product information—including prices, stock levels, SEO details, shipping dimensions, and media attachments—even if they lacked explicit permission to edit products. The vulnerability stems from missing authorization checks on specific sub-form components and the ability for attackers to manipulate product IDs client-side to target arbitrary products. An authenticated attacker with minimal privileges could cause significant data integrity issues without detection.

• CVE-2026-47745MEDIUM 6.5

  Shopper, a headless e-commerce admin panel used to manage online stores, contains a permission-checking flaw in versions before 2.8.0. Admin users with low-level access can manipulate critical payment and fulfillment settings—such as disabling all payment methods, changing the default currency, or removing shipping carriers—even though they shouldn't have permission to do so. Any employee or contractor with admin panel access, regardless of their intended role, can trigger a complete checkout blockade or corrupt pricing data. The vendor has resolved this in version 2.8.0.

• CVE-2026-48028MEDIUM 6.5

  Mastodon, the popular open-source social network platform, has a vulnerability in how it validates incoming messages signed with digital signatures. An attacker can manipulate these signed messages by removing certain data fields while keeping the signature valid, effectively impersonating another user or system. This could allow spoofing of activities—like posts or follows—that appear to come from legitimate sources but have been altered by an attacker. The vulnerability affects multiple versions of Mastodon and has been patched in versions 4.5.10, 4.4.17, and 4.3.23.

• CVE-2026-48067MEDIUM 6.5

  Filament, a popular Laravel development framework, contains a vulnerability in how it validates user selections in certain action components. When developers use AttachAction or AssociateAction with a recordSelectOptionsQuery() method to limit which records users can select, the validation step doesn't respect those same limits. This means an authenticated attacker could manipulate the Livewire component state to submit choices that should have been blocked, potentially associating or attaching records they shouldn't have access to. The vulnerability affects Filament versions released between early 4.0.0 and the 4.11.4 / 5.6.4 fixes, as well as tables versions 3.0.0 through 3.3.51.

• CVE-2026-48101MEDIUM 6.5

  7-Zip versions 9.21 through 26.00 contain a memory disclosure flaw in their UEFI capsule parser. When processing truncated or specially crafted .scap files, the application allocates a large heap buffer without clearing it first, then fails to verify that the file contents completely filled that buffer. Any unread portion of the buffer retains leftover data from previous memory allocations—potentially sensitive information—which then leaks to the user when the archive is extracted. This affects any organization or individual using affected 7-Zip versions to handle capsule files, and is fixed in version 26.0.1.

• CVE-2026-48107MEDIUM 6.5

  Russh is a Rust-based SSH client and server library used by developers to add SSH functionality to Rust applications. A vulnerability exists in versions 0.37.0 through 0.60.x that allows a malicious SSH server to crash or hang a connecting client. When a client attempts keyboard-interactive authentication (a common multi-factor authentication method), an attacker controlling the server can send a specially crafted response with a false count of authentication prompts. The client code trusts this count without verification, causing it to pre-allocate memory based on that untrusted value before actually reading the prompt data. This mismatch leads to a denial-of-service condition. The issue requires user interaction in the sense that a client must attempt to connect to the attacker's server, but does not require special privileges.

• CVE-2026-48112MEDIUM 6.5

  7-Zip versions 9.18 through 26.00 contain a memory safety defect in their handler for Unix ar archives—specifically when parsing BSD-style symbol tables. The flaw allows an attacker to craft a malicious ar archive that, when opened by 7-Zip, causes the parser to read 4 bytes of uninitialized heap memory beyond the intended buffer boundary. This disclosure of uninitialized data could leak sensitive information from the process memory. The vulnerability requires user interaction: a victim must open the malicious archive file. Version 26.01 resolves the issue.

• CVE-2026-48129MEDIUM 6.5

  Kestra, an open-source workflow orchestration tool, contains a path traversal vulnerability in its task file handling. When flows process untrusted data (from webhooks or external sources) as file names in the `inputFiles` feature, attackers can inject directory-traversal sequences like `../` to write or overwrite files outside the intended task directory on worker systems. This could allow an attacker to place malicious files in sensitive locations or corrupt existing files, depending on worker permissions and file system layout.

• CVE-2026-48140MEDIUM 6.5

  CVE-2026-48140 is a denial-of-service vulnerability in National Instruments' grpc-device component, specifically in the BeginSidebandStream function. An authenticated attacker can craft a malicious message containing an invalid enumeration value to trigger undefined behavior in the service, causing it to crash or become unavailable. The vulnerability affects NI grpc-device version 2.17.0 and earlier. Exploitation requires valid credentials but no special privileges or user interaction.

• CVE-2026-48208MEDIUM 6.5

  OTRS and OTRS Community Edition contain a vulnerability that allows attackers to embed malicious SVG (Scalable Vector Graphics) code within email messages sent to the ticketing system. When an agent or customer opens an affected ticket, the crafted SVG content can consume excessive browser resources, rendering the application unresponsive or forcing a browser crash. This is a denial-of-service attack that requires no special privileges and occurs automatically when viewing a compromised ticket—the attacker simply needs to send an email to the OTRS system.

• CVE-2026-48314MEDIUM 6.5

  Adobe ColdFusion contains a path traversal vulnerability that allows an attacker to read and write files outside intended directory boundaries. Versions 2025.9, 2023.20 and earlier are affected. No user interaction is required for exploitation—an attacker can trigger the flaw remotely and directly access or modify sensitive files. The impact is classified as medium severity because while file access is limited, both confidentiality and integrity can be compromised.

• CVE-2026-48492MEDIUM 6.5

  Snipe-IT versions before 8.6.1 have an authorization bypass in the user list API endpoint. Any employee logged into Snipe-IT can retrieve a complete list of all user accounts in the system without needing special permissions or an API token. This leaks usernames, display names, employee numbers, and user IDs—sensitive directory information that could be useful for social engineering, phishing, or reconnaissance. The vulnerability requires an active user session to exploit, but does not require admin rights or knowledge of credentials beyond what any valid employee already has.

• CVE-2026-48500MEDIUM 6.5

  Filament, a Laravel development framework, has a vulnerability in how it handles file uploads on authentication-required components. The framework automatically enables file upload capability on all schema-based forms, including pages that shouldn't allow uploads—like the login form. This means an attacker without credentials could upload files to your server's temporary storage without any restrictions, potentially filling up disk space or running up storage costs. The issue affects versions 3.0.0 through 3.3.51, 4.0.0 through 4.11.4, and 5.0.0 through 5.6.4.

• CVE-2026-48618MEDIUM 6.5

  Node.js versions 22, 24, and 26 contain a TLS hostname validation flaw that exploits a mismatch in how Unicode dot separators are handled during certificate verification. An attacker with valid credentials can craft a certificate with a specially-formatted hostname that passes wildcard validation checks on the resolver side but fails on the verifier side, potentially allowing them to intercept encrypted traffic or bypass intended security boundaries. The vulnerability requires authenticated access to exploit, but the impact on confidentiality is significant.

• CVE-2026-48726MEDIUM 6.5

  Apache Airflow has a logout bypass vulnerability where JWT tokens remain valid after users log out through the web UI. When users click logout, the system fails to properly revoke their authentication tokens in deployments using FAB (Flask-AppBuilder) or Keycloak authentication. An attacker with a stolen or previously-issued JWT can continue making authenticated API calls as that logged-out user until the token naturally expires. This is a follow-up to an earlier fix that patched cookies but missed the JWT revocation paths in these two authentication modules.

• CVE-2026-4881MEDIUM 6.5

  Octopus Server contains a missing permission check in one of its API endpoints. Any authenticated user—even with minimal privileges—can exploit this flaw to make server-level changes, such as modifying configuration or access controls. The vulnerability is deceptive: the API returns an error message to the caller, but the requested changes are applied anyway. This allows a low-privileged insider or compromised account to escalate their impact significantly.

• CVE-2026-48828MEDIUM 6.5

  Apache Airflow's Bulk Variables API has a flaw where it bypasses the built-in redaction mechanism when retrieving JSON-formatted variables. Normally, Airflow hides the values of variables with secret-related key names (like `db_password`, `api_token`, or `service_secret`). However, this protection fails for JSON variables accessed through the bulk API because the redactor isn't given the variable's key name to evaluate. An authenticated user with read permissions to bulk variables can therefore extract sensitive data that should have been hidden, even though the variable name itself would normally trigger redaction. The exposure is limited to JSON-typed variables and requires existing access to Airflow's UI or API.

• CVE-2026-48855MEDIUM 6.5

  A vulnerability in Erlang OTP's SSH file transfer module allows authenticated SFTP users to discover the absolute filesystem path of the server's SFTP root directory. When a user creates a symbolic link pointing outside the intended chroot jail, the server incorrectly reveals the backend absolute path instead of the restricted path visible to the client. This leaks infrastructure information—specifically filesystem paths—but does not expose file contents, credentials, or permit access beyond the intended boundary.

• CVE-2026-48856MEDIUM 6.5

  Erlang's httpc HTTP client has a credential-leakage flaw in how it handles HTTP redirects. When a server sends a redirect response (3xx status), httpc automatically follows it to the new location while preserving the original Authorization and Proxy-Authorization headers—including any embedded credentials. An attacker controlling both the initial target server and the redirect destination can trick the client into sending credentials to an attacker-controlled domain. Since automatic redirects are enabled by default, this affects most applications using httpc unless they explicitly disable the feature.

• CVE-2026-48858MEDIUM 6.5

  An attacker who controls or compromises an FTP server can trick Erlang/OTP applications into connecting to arbitrary internal hosts and ports by injecting a malicious IP address into the FTP PASV response. When the client application tries to read or write files, traffic gets redirected to the attacker's chosen target—enabling probes against internal infrastructure, cloud metadata services, or attacks on third-party hosts. The flaw exists in how Erlang's FTP client parses the PASV response without checking that the redirected address actually belongs to the FTP server it connected to.

• CVE-2026-48860MEDIUM 6.5

  A flaw in Erlang/OTP's TLS-based distribution module allows an attacker with a valid certificate to bypass IP-address-based access controls on Erlang cluster nodes. The vulnerability stems from a logic error where the code checks the local socket address instead of the remote peer's address when validating whether a connecting node is on the allowed subnet. An attacker holding any CA-signed TLS certificate can exploit this to gain unauthorized access to Erlang RPC and code-loading functions on affected nodes.