By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 51 of 86

• CVE-2026-59149MEDIUM 6.5

  Mockoon is a tool used by developers to create and test mock APIs locally. A flaw in versions before 9.7.0 allows an attacker to read files from outside the intended mock API directory by crafting specially-formatted file requests. Because the validation check for file paths doesn't properly enforce directory boundaries, an attacker can use path-traversal tricks to escape the sandbox and access other files on the server. This vulnerability requires user interaction (the victim must visit a malicious link or request) but no authentication, and it exposes sensitive data rather than modifying or deleting it.

• CVE-2026-59207MEDIUM 6.5

  n8n's AI Agents feature contains a credential access control bypass that allows a member-level user with read-only access to a shared credential to exfiltrate that credential's secret to an attacker-controlled server. The vulnerability exists because the platform fails to enforce domain restrictions on HTTP requests made by MCP (Model Context Protocol) tools used within AI Agents workflows. An attacker with legitimate but limited access to a credential can point an MCP tool at their own server and capture the credential secret during execution. This affects n8n versions prior to 2.27.4 and 2.28.1.

• CVE-2026-59209MEDIUM 6.5

  n8n, an open-source workflow automation platform, contains a vulnerability that allows authenticated users with basic editor access to steal sensitive credentials embedded in HTTP request headers. A user with 'use-only' permissions on a shared workflow can extract secrets through pagination expressions and leak them as part of workflow item data. This affects versions before 1.123.61, 2.27.4, and 2.28.1.

• CVE-2026-59220MEDIUM 6.5

  Open WebUI, a self-hosted AI platform, contains a regular expression denial-of-service vulnerability in its chat message processing. When an authenticated user sends a malformed skill mention (a message containing <$ without a closing >) the server's message parser enters a computationally expensive loop that blocks the main event loop, making the application unresponsive. This affects versions 0.9.2 through 0.9.x and is resolved in version 0.10.0. The vulnerability requires an authenticated session to exploit.

• CVE-2026-59222MEDIUM 6.5

  Open WebUI versions 0.7.0 through 0.9.x contain an information disclosure vulnerability in the channel members API endpoint. When a user with normal channel participation permissions queries the members list, the endpoint returns complete user profile objects including sensitive configuration data such as tool server API keys and webhook credentials. This allows any channel member to harvest authentication material and integration secrets from other users without requiring elevated privileges or admin access.

• CVE-2026-59262MEDIUM 6.5

  AFFiNE, a collaborative workspace application, contains a flaw in its document history feature that allows workspace members to view the edit timeline of private documents they shouldn't have access to. An authenticated attacker can request the history of any document by its identifier, and the system will return detailed records including who edited the document, their email addresses, and when changes occurred—regardless of whether the attacker has permission to view the actual document. This is a permission-bypass issue affecting information disclosure.

• CVE-2026-59805MEDIUM 6.5

  Gumroad has a vulnerability in how it controls access to seller features. An authenticated seller can trick the system into revoking or restoring customer access to products they don't own. This happens because the system doesn't properly verify that a seller is the legitimate owner before processing access changes. The flaw exists in versions before 2026.07.06.2 and could allow sellers to maliciously disrupt competitors' sales or restore access inappropriately.

• CVE-2026-59818MEDIUM 6.5

  etcd, a widely-used distributed key-value store, has a certificate validation bypass when configured to split HTTP and gRPC traffic across separate listeners. In affected versions, the Certificate Revocation List (CRL) that should block revoked certificates is not applied to the gRPC listener, allowing an attacker with a revoked certificate to authenticate successfully. This affects etcd versions prior to 3.5.32 and 3.6.13, and is particularly relevant for organizations using etcd in Kubernetes clusters or other distributed systems where certificate-based access control is critical.

• CVE-2026-59820MEDIUM 6.5

  LiteLLM, a proxy server used to standardize API calls to various large language models, contains a path traversal vulnerability in its skill upload feature. An authenticated user who has permission to upload skills can craft a malicious ZIP file that extracts files outside the intended directory, potentially overwriting system files or placing malicious content in sensitive locations. This requires existing API access and doesn't directly cause data theft or system crashes, but enables an attacker to modify files on the server.

• CVE-2026-59853MEDIUM 6.5

  SiYuan is an open-source personal knowledge management application that helps users organize and search their notes and documents. A flaw in versions prior to 3.7.1 allows users with read-only 'publish mode' access to view private information they shouldn't be able to access—specifically, the internal IDs and file paths of unpublished documents, notebooks, and individual text blocks, as well as the search keywords other users have saved. This happens because one API endpoint doesn't properly filter what data it exposes, unlike the similar endpoints around it that do apply the correct restrictions.

• CVE-2026-59896MEDIUM 6.5

  Hono is a popular JavaScript web framework used across multiple runtime environments. A vulnerability in its JSX rendering component (versions 4.11.8 through 4.12.26) fails to properly isolate context data between concurrent requests during server-side rendering. This means that when an async component uses `await`, it could accidentally access context values—such as user data, request headers, or other sensitive information—from a different user's request that was processed at the same time. An attacker doesn't need special privileges or user interaction to trigger this; the vulnerability manifests when multiple requests are handled in parallel, creating a window where context bleeding occurs.

• CVE-2026-60001MEDIUM 6.5

  OpenSSH versions before 10.4 contain a flaw in the sshd daemon where it fails to properly enforce a configured minimum delay between authentication attempts. This delay mechanism is designed to slow down brute-force attacks by forcing attackers to wait between each login try. When the delay is not honored, an attacker can attempt passwords or keys much faster than intended, making credential-based attacks more feasible. The vulnerability affects SSH servers running vulnerable OpenSSH versions.

• CVE-2026-60094MEDIUM 6.5

  Vinchin Backup & Recovery versions through 9.0.0.86562 contain a vulnerability in their agentlink_server service that allows attackers to crash the backup agent or corrupt its memory without needing credentials. An attacker sends a specially crafted network packet with an incorrect length field that tricks the service into reading far more data than allocated, potentially writing up to 4 GB of attacker-controlled data into memory. This could lead to service failure or, in theory, code execution, though the current risk is primarily denial of service and data corruption.

• CVE-2026-60095MEDIUM 6.5

  Vinchin Backup & Recovery versions up to 9.0.0.86562 contain a vulnerability in the agentlink_server component that allows unauthenticated attackers to crash the service or potentially take control of it by sending a specially crafted network request. The vulnerability exists because the software copies user-supplied data into a fixed buffer without checking the length first, a classic memory safety flaw. An attacker on the network can exploit this without needing credentials.

• CVE-2026-6091MEDIUM 6.5

  A vulnerability in wolfSSL's certificate verification logic may incorrectly accept X.509 certificate chains that end at an intermediate certificate controlled by an attacker, rather than terminating at a trusted root authority. When the partial-chain verification flag is enabled in OpenSSL-compatible code, an attacker with low privileges can craft a malicious certificate chain that bypasses the normal validation requirements. This could allow the attacker to impersonate legitimate services or intercept communications in scenarios where certificate pinning or strict chain validation is relied upon for security.

• CVE-2026-61441MEDIUM 6.5

  PraisonAI Platform versions before 0.1.9 contain an authorization bypass vulnerability in their issue dependency deletion feature. A workspace member can delete dependencies created by owners or admins by targeting the deletion request through a related issue they own, rather than the owner-controlled issue. The system validates permissions only against the issue being targeted in the request, not against both sides of the dependency relationship, enabling lower-privileged users to remove critical issue links that should be protected.

• CVE-2026-61450MEDIUM 6.5

  Grav, a flat-file CMS, contains a sandbox escape vulnerability in its Twig templating system that allows page authors to read sensitive configuration data they should not access. An attacker with the ability to create or edit pages can use allowed Twig filters to dump the raw configuration object, exposing secrets such as SMTP passwords, API keys, and database credentials. This affects Grav versions before 2.0.2 and represents an incomplete patch of a previously identified sandbox bypass.

• CVE-2026-61455MEDIUM 6.5

  Grav, a popular flat-file CMS, has a vulnerability in its ZIP file handling that allows authenticated attackers to cause a denial-of-service condition. An attacker with valid credentials can upload or supply a specially crafted ZIP archive that decompresses to an enormous size, filling up the server's available disk space and making the application unavailable. The vulnerability exists because the decompression code does not enforce reasonable limits on how much data can be extracted, how many files can be created, or how deeply files can be nested within the archive.

• CVE-2026-6280MEDIUM 6.5

  CVE-2026-6280 is a medium-severity vulnerability in Nomysem (a product of NOMYSOFT Informatics Education and Consulting Inc.) that allows users with valid login credentials to access sensitive information they should not be able to reach. The core issue is that the application's access control lists (ACLs)—the rules that define who can see what—are either misconfigured or not properly enforced. An authenticated attacker can bypass these restrictions to view confidential data without needing elevated privileges or user interaction.

• CVE-2026-6291MEDIUM 6.5

  wolfSSL's PKCS#7 encryption decryption contains a timing-based information leak that allows attackers to recover encryption keys. When decrypting encrypted messages using RSA, the library returned different error messages depending on whether the encryption padding was valid or the message contents were corrupt. An attacker with network access could exploit this distinction by sending specially crafted encrypted messages and analyzing the responses to gradually reconstruct the underlying encryption key, similar to historical Bleichenbacher attacks. The vulnerability requires authenticated access (login credentials) and affects confidentiality of encrypted data but not integrity or system availability.

• CVE-2026-6329MEDIUM 6.5

  A vulnerability in wolfSSL's PKCS#12 implementation allows attackers to bypass the integrity check (MAC—Message Authentication Code) that protects the contents of PKCS#12 certificate bundles. The flaw stems from comparing the stored MAC against the computed one using a length value supplied by the attacker, rather than enforcing the correct digest length. An attacker can supply a truncated or zero-length MAC that will be incorrectly accepted, meaning a tampered PKCS#12 file could pass validation even though its contents have been altered. This is particularly dangerous in supply-chain or key-distribution scenarios where PKCS#12 files are expected to be cryptographically signed and verified.

• CVE-2026-6330MEDIUM 6.5

  A cryptographic implementation flaw in WolfSSL's ML-KEM (a post-quantum key encapsulation mechanism) on ARM64 systems causes incomplete validation of encrypted data. The implementation's constant-time comparison logic only checks half of the expected ciphertext, allowing an attacker to send a manipulated ciphertext that bypasses the security mechanism designed to reject invalid or tampered data. This weakens the encryption's resistance to certain sophisticated attacks, though the real-world impact depends on how the library is deployed in applications.

• CVE-2026-7048MEDIUM 6.5

  The Photo Gallery by 10Web WordPress plugin contains a SQL injection vulnerability in its gallery ordering feature. An attacker with contributor-level WordPress access or higher can craft a malicious gallery shortcode that executes arbitrary SQL queries against the site database when the shortcode renders. This allows unauthorized extraction of sensitive data like user credentials, email addresses, and other database contents. The vulnerability affects all versions up to 1.8.40.

• CVE-2026-7184MEDIUM 6.5

  Mattermost Server contains a flaw in how it processes certain administrative API requests that allows authenticated users with specific permissions to extract security credentials used for remote cluster connections. An attacker with the 'manage_secure_connections' permission can craft a specially designed API request to retrieve authentication tokens that should remain protected. This affects versions 11.6.1 and earlier, 11.5.4 and earlier, and 10.11.15 and earlier.

• CVE-2026-7300MEDIUM 6.5

  CVE-2026-7300 is a buffer overflow vulnerability in RTI Connext Professional's Web Integration Service that allows an authenticated attacker to cause a denial of service by crashing the affected service. An attacker with valid credentials can send specially crafted input that exceeds expected buffer boundaries, resulting in service unavailability. This is not a remote code execution risk, but the availability impact is significant for deployments relying on Connext for real-time data distribution.

• CVE-2026-7542MEDIUM 6.5

  The Slider Revolution WordPress plugin (versions 7.0 to 7.0.10) contains a critical information disclosure flaw that allows low-privileged users to read sensitive server files. The vulnerability chains three design weaknesses: the plugin exposes AJAX security tokens to all logged-in users, it incorrectly allows unauthenticated access to a file-copying function, and it fails to properly validate and restrict which files can be copied to the public web directory. An attacker with a basic Subscriber account can exploit this to extract configuration files, database backups, credentials, keys, and logs—essentially any non-blacklisted file type on the server.

• CVE-2026-8045MEDIUM 6.5

  A vulnerability in Schneider Electric's StruxureWare Data Center Expert allows authenticated users with Data Center Expert account privileges to disclose sensitive files from the server by submitting malicious XML files to SOAP service endpoints. The vulnerability exploits improper handling of XML external entities (XXE), a well-known attack vector that lets attackers reference external files and retrieve their contents. An attacker must have valid Data Center Expert credentials to exploit this—it is not remotely exploitable by unauthenticated users.

• CVE-2026-8118MEDIUM 6.5

  Royal Addons for Elementor, a WordPress plugin for building pages with Elementor, has a file-reading flaw affecting versions 1.7.1058 and 1.7.1059. When handling CSV file uploads in data table widgets, the plugin fails to properly validate file paths. An authenticated user with Contributor-level permission or higher can exploit this to read any file on the server that the PHP process can access—including sensitive configuration files like wp-config.php containing database credentials. The vulnerability stems from a fallback mechanism in a helper function that was added to patch a previous security issue.

• CVE-2026-8380MEDIUM 6.5

  The Frontend File Manager Plugin for WordPress versions through 23.6 contains a flaw that allows authorized users to delete posts and pages they do not own. Specifically, any user with author-level permissions or higher can permanently remove arbitrary content from a WordPress site. If an administrator enables the plugin's "Allow guest uploads" setting, this same destructive capability becomes available to unauthenticated visitors, significantly expanding the attack surface.

• CVE-2026-8458MEDIUM 6.5

  libcurl contains a connection pooling flaw that can cause authenticated requests to reuse the wrong connection. When an application makes multiple requests using Negotiate authentication (a credential delegation mechanism) to the same server but with different service configurations, libcurl's connection reuse logic may incorrectly reuse a cached connection that was authenticated for a different service. This allows subsequent requests to inherit the authentication context of a previous connection, potentially enabling privilege escalation or unauthorized actions within the authenticated session.

• CVE-2026-8653MEDIUM 6.5

  MasterStudy LMS Pro Plus, a WordPress plugin used for learning management, contains a SQL injection flaw in how it processes the 'columns' parameter. Attackers with instructor-level or higher access can exploit this to run unauthorized database queries and steal sensitive data. The vulnerability affects all versions up to 4.8.20 and requires authentication but no user interaction.

• CVE-2026-8683MEDIUM 6.5

  Mattermost Desktop App versions 6.1 and earlier contain a denial-of-service vulnerability that allows a malicious server owner to crash the application by injecting a script that attempts to open an extremely long URL. The flaw stems from insufficient validation of URL length before passing it to the browser's window.open function, causing the application to fail ungracefully when processing the oversized input.

• CVE-2026-8714MEDIUM 6.5

  A flaw in the RTSP (Real Time Streaming Protocol) server component of TP-Link Tapo C520WS v2 cameras allows an attacker on the local network to send specially crafted malformed input that causes the streaming service to stop responding. Once triggered, the camera's video streaming capability becomes unavailable until the service is restarted, effectively taking the camera offline for monitoring purposes.

• CVE-2026-8722MEDIUM 6.5

  A vulnerability in the Perl Net::Async::Statsd::Client library allows attackers to inject arbitrary metrics into statsd monitoring systems by exploiting insufficient input validation. Because the library fails to sanitize metric names for special characters (newlines, colons, and pipes), an attacker who controls metric input can inject additional monitoring data, potentially disrupting observability or falsifying application metrics.

• CVE-2026-8993MEDIUM 6.5

  The D.Launcher 2 component in the Slovak eID client ecosystem improperly handles custom URL protocols, allowing attackers to trigger NTLM authentication attempts or SMB connections to their servers, or conduct Server-Side Request Forgery (SSRF) attacks. The vulnerability requires a user to click a malicious link, making it a social engineering vector rather than an automated remote code execution. The exposure is primarily information disclosure through credential capture or network reconnaissance.

• CVE-2026-8996MEDIUM 6.5

  The WP Time Capsule backup plugin contains a flaw that allows any authenticated WordPress user with subscriber-level permissions or higher to download the most recent decrypted SQL database backup file. This backup typically contains sensitive data like password hashes, user credentials, and configuration secrets. The vulnerability only manifests if a site administrator has previously decrypted a backup—otherwise, no file is available to exploit. An attacker with even basic user access can trigger this exposure without any additional action from site administrators.

• CVE-2026-9002MEDIUM 6.5

  IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 contain a vulnerability that allows attackers on the same network to crash the application server. The flaw exists in how the system handles deeply nested Protocol Buffers messages without proper size limits, enabling an attacker to exploit this by sending specially crafted network packets that cause the Java Virtual Machine to run out of memory or exhaust the call stack, bringing down the service.

• CVE-2026-9105MEDIUM 6.5

  A vulnerability in TP-Link TL-WR841N v14 routers allows anyone with valid login credentials to crash the device by sending specially crafted web requests. When triggered, the router's web server crashes and forces the device to automatically reboot, disrupting network connectivity until it comes back online. No data is at risk—this is purely a denial-of-service issue.

• CVE-2026-9132MEDIUM 6.5

  A security flaw in GitHub Enterprise Server allowed authenticated users to view source code from private repositories they shouldn't have access to. The vulnerability existed in the Copilot pull request description feature, which compared code across repositories without properly checking if the user had permission to see the target repository. An attacker needed only a valid account with read access to at least one repository on the instance to exploit this and extract sensitive code from restricted repositories.

• CVE-2026-9145MEDIUM 6.5

  A vulnerability in the Database for Contact Form 7 WordPress plugin allows unauthenticated attackers to copy arbitrary files from a server when Elementor Pro is active. The issue stems from the plugin's form entry handler trusting user-supplied input without validating whether it came from a legitimate file upload. An attacker can manipulate form submissions to point the plugin's file-copying function at sensitive files on the server or even remote sources, potentially exposing configuration files, credentials, or other sensitive data. The vulnerability requires Elementor Pro to be installed but does not require authentication.

• CVE-2026-9153MEDIUM 6.5

  A vulnerability in the Rapid7 InsightConnect Sed Plugin allows authenticated users on Linux systems to read files they shouldn't have access to. The flaw exists because the plugin doesn't properly validate input in the expression parameter, enabling attackers to craft malicious commands that bypass restrictions and access sensitive files on the server.

• CVE-2026-9219MEDIUM 6.5

  Setracker2, an Android companion app for smartwatch management, contains a flaw in how it registers new devices. The app generates a unique registration ID based on the phone's IMEI number in a predictable way, and the enrollment system doesn't verify that the person requesting enrollment actually owns the watch being registered. An attacker who learns or guesses a registration ID could hijack someone else's smartwatch, taking control of it within the app and potentially accessing associated data or features.

• CVE-2026-9258MEDIUM 6.5

  Canon's EOS Network Setting Tool versions 1.5.0 and earlier fail to properly validate SSH host keys during network connections. This allows an attacker positioned to intercept network traffic—such as on a shared Wi-Fi network or compromised router—to impersonate a legitimate server without the user's knowledge. If successful, the attacker can eavesdrop on sensitive configuration data exchanged between the tool and the camera system, such as network credentials or camera settings. The vulnerability requires user interaction (the tool must be actively used to connect), but the bar for exploitation is low given the prevalence of unencrypted or poorly-secured network environments.

• CVE-2026-9259MEDIUM 6.5

  Canon EOS Network Setting Tool version 1.5.0 and earlier fails to properly validate SSL/TLS certificates when communicating with servers. This means an attacker positioned to intercept network traffic—such as on a shared Wi-Fi network or through a compromised router—could impersonate a legitimate Canon server and intercept sensitive data sent by the tool without the user noticing the certificate is invalid. The vulnerability requires user interaction to trigger (the tool must be actively used), but does not require special privileges. It affects Windows and macOS systems running the vulnerable tool.

• CVE-2026-9262MEDIUM 6.5

  Canon EOS Network Setting Tool versions 1.5.0 and earlier use an insecure FTP protocol by default when configuring network settings for Canon EOS cameras. An attacker positioned on the same network could intercept the unencrypted FTP connection to capture sensitive credentials or modify camera configuration data in transit. This affects both Windows and macOS users of the tool.

• CVE-2026-9263MEDIUM 6.5

  A vulnerability in Zephyr's Bluetooth controller allows a remote attacker to read sensitive memory from a device. The flaw exists in how the system handles Bluetooth ISO (isochronous) data frames. When a specially crafted ISO frame header arrives—either from a connected peer or a broadcaster the device is listening to—the controller fails to validate a length field properly. This causes it to read far more data from memory than it should and send that memory content to the host system as if it were legitimate data, exposing information that shouldn't be accessible. The vulnerability affects all Zephyr versions from 3.0.0 onward that support framed ISO reception.

• CVE-2026-9493MEDIUM 6.5

  BankPro E-Service Technology's Service Center contains a flaw that allows someone with valid login credentials to view order details belonging to other customers. An attacker would modify a query parameter to bypass access controls and retrieve sensitive EC order information that should only be visible to the rightful account owner. This is a classic authorization bypass—the application fails to verify that the requesting user actually owns the data they're asking for.

• CVE-2026-9539MEDIUM 6.5

  CVE-2026-9539 is a memory disclosure vulnerability in libslirp, a user-mode TCP/IP stack commonly used in hypervisor environments like QEMU. A privileged attacker running inside a guest virtual machine can craft malicious TCP packets to read sensitive data from the host system's memory. The vulnerability stems from improper handling of TCP urgent data flags and pointers, combined with an integer underflow condition. The attacker needs elevated privileges within the guest (root or CAP_NET_RAW capability), but can leak gigabytes of host heap memory, potentially exposing cryptographic keys, session tokens, or other confidential information.

• CVE-2026-9639MEDIUM 6.5

  CVE-2026-9639 is a denial-of-service vulnerability in LXD, Canonical's container and virtual machine management platform. An authenticated user with permission to create storage volumes can crash the LXD daemon by uploading a malformed backup file that is missing a required field. The vulnerability affects LXD versions up to 6.8 and 5.21 on Linux systems. An attacker would need valid credentials and specific permissions to exploit this, but no advanced technical skill is required once access is obtained.

• CVE-2026-9705MEDIUM 6.5

  Keycloak's client registration system contains a flaw that allows an attacker who holds an old Registration Access Token (RAT) to re-enable a client application that an administrator has intentionally disabled. Once re-enabled, the attacker can reset the client's secret, potentially regaining access to sensitive APIs and data. This vulnerability undermines administrator control over client lifecycle management and creates a window for unauthorized access.

• CVE-2026-9718MEDIUM 6.5

  CVE-2026-9718 is a denial-of-service vulnerability affecting Schneider Electric PowerLogic P7 devices. An authenticated user with network access can send a specially crafted request that causes an assertion failure in the device firmware, crashing the service and disrupting availability. The attacker must already have valid credentials to exploit this—it is not remotely exploitable by anonymous users. Impact is limited to availability; confidentiality and integrity remain unaffected.

• CVE-2026-9741MEDIUM 6.5

  MongoDB's encryption features—specifically Queryable Encryption and Client-Side Field Level Encryption (CSFLE)—contain a flaw in how they handle the $vectorSearch aggregation stage. When users filter encrypted data using $vectorSearch, literal values meant to stay encrypted are instead sent to the MongoDB server in plaintext. This defeats a core purpose of client-side encryption: keeping sensitive data encrypted at rest and in transit. An authenticated attacker with database access could potentially read these exposed field values, even though the bulk of the encrypted document remains protected.

• CVE-2026-9743MEDIUM 6.5

  MongoDB Server 8.0 has a vulnerability where certain aggregation queries can leave internal data structures in an inconsistent state. If an authenticated user follows up with a cursor operation (getMore), the server attempts to access a null pointer, causing the process to crash. Only users with authentication credentials can trigger this, but no special privileges are required—any authenticated database user can initiate the attack.

• CVE-2026-9746MEDIUM 6.5

  MongoDB servers can be forced to crash when a logged-in user executes a specific combination of change stream operations with resharding resume tokens and the exchange option. An attacker with valid database credentials can trigger this denial-of-service condition without elevated privileges, causing service disruption. The crash occurs due to an unhandled invariant violation in the server code.

• CVE-2026-9748MEDIUM 6.5

  MongoDB's internal index statistics conversion stage inadvertently uses a signal mechanism that was designed for a completely different purpose. When this stage appears before the $facet aggregation operator in a pipeline, MongoDB's document processing layer receives an unexpected control signal and crashes. This is a denial-of-service flaw that requires authenticated database access to trigger.

• CVE-2026-9749MEDIUM 6.5

  MongoDB servers running aggregation pipelines with specific internal configurations can encounter a denial-of-service condition when processing large result sets. The issue occurs in the $exchange stage when key-range partitioning routes many documents to the same consumer, causing a buffer management flaw that prevents proper tracking of data flow. This can lead to server instability or unavailability without authentication requirements beyond normal database access.

• CVE-2026-9750MEDIUM 6.5

  CVE-2026-9750 is a medium-severity vulnerability in MongoDB that allows authenticated users to crash the database server or cause it to return incorrect query results. The flaw occurs because MongoDB doesn't properly separate user-supplied document fields from its internal metadata during query processing, allowing a malicious or compromised account to exploit this weakness without requiring network access beyond normal database authentication.

• CVE-2026-9752MEDIUM 6.5

  An authenticated user can crash a MongoDB server by executing a specially crafted query against a 2dsphere geospatial index. The vulnerability exists because MongoDB's validation logic fails to properly inspect nested geometric objects within a GeoJSON GeometryCollection, allowing a forbidden strict-winding Polygon to bypass safety checks and trigger a null-pointer dereference that terminates the server process.

• CVE-2026-9754MEDIUM 6.5

  CVE-2026-9754 is a medium-severity information disclosure vulnerability in MongoDB that allows an authenticated user holding the read role to extract small amounts of uninitialized stack memory by sending specially crafted filemd5 commands. An attacker with valid database credentials and read permissions can trigger this flaw to leak sensitive data that may reside in memory, such as encryption keys, session tokens, or other confidential information. The vulnerability does not enable privilege escalation, data modification, or denial of service—only unauthorized information disclosure.

• CVE-2026-9774MEDIUM 6.5

  A directory traversal vulnerability in ATEN Unizon allows authenticated users with high-level privileges to delete arbitrary files on the system. The flaw exists in the updateLicense function, which fails to properly validate file paths before performing deletion operations. While authentication is required to exploit this issue, a compromised or malicious administrator account could use this to destroy critical system files, disable services, or trigger a denial-of-service condition.

• CVE-2026-9775MEDIUM 6.5

  ATEN Unizon contains a directory traversal vulnerability in its uploadSSL method that allows authenticated attackers to delete arbitrary files from the system. By bypassing path validation checks, an attacker with valid credentials can manipulate file paths to target and remove critical files, potentially disrupting system operations or triggering a denial-of-service condition.

• CVE-2026-9792MEDIUM 6.5

  Keycloak's Client Policies feature contains a bypass that weakens its security controls. When administrators configure policies to block the Resource Owner Password Credentials (ROPC) grant flow—a less secure authentication method—the system fails to enforce this restriction under certain conditions. An attacker can exploit this to obtain authentication tokens without proper authorization, potentially accessing sensitive data or impersonating legitimate users. The vulnerability affects how Keycloak validates policy conditions when client type, roles, attributes, or scopes are involved.

• CVE-2026-9796MEDIUM 6.5

  Keycloak has a timing vulnerability that allows an authenticated administrator with `manage-clients` permissions to temporarily escalate themselves to `realm-admin` role during a narrow window when role checks occur. Once granted, this elevated access persists indefinitely—even after the attacker's own admin permissions are removed or the system restarts. This creates a privilege escalation path that is difficult to detect and remediate after the fact.

• CVE-2026-9815MEDIUM 6.5

  A vulnerability in the MagicForm WordPress plugin (versions up to 0.1.3) allows anyone on the internet to upload executable PHP files to a website without authentication. This happens when form administrators leave the file upload field's extension allowlist empty—a configuration that appears to disable all validation. An attacker can exploit this to run arbitrary code on the server, potentially taking over the website or extracting sensitive data. The vulnerability is particularly dangerous because no login credentials or user interaction is required.

• CVE-2026-9822MEDIUM 6.5

  CVE-2026-9822 is a privilege-escalation vulnerability in the WP Hotel Booking WordPress plugin that allows users with basic Subscriber-level accounts to access sensitive information they shouldn't be able to see. Specifically, attackers can view other users' booking details, discover active discount coupons, and retrieve pricing data—all without administrator approval. The flaw stems from missing permission checks in several AJAX request handlers. Any WordPress site running the plugin before version 2.3.1 is affected if it allows user registration or has existing low-privilege accounts.

• CVE-2026-9829MEDIUM 6.5

  Photo Gallery by 10Web, a popular WordPress plugin for creating mobile-friendly image galleries, contains a SQL injection vulnerability in versions up to 1.8.41. An attacker with contributor-level WordPress access (a lower-privileged account type) can inject malicious SQL commands through a shortcode parameter called 'compact_album_order_by'. The attacker stores this payload via an unprotected AJAX function, and it executes when the gallery is viewed on the front end, allowing the attacker to extract sensitive database information. This is a stored vulnerability—once the malicious shortcode is saved, it affects all site visitors.

• CVE-2026-9882MEDIUM 6.5

  CVE-2026-9882 is a memory safety flaw in the ANGLE graphics library used by Google Chrome that allows attackers to steal data from websites you're visiting, provided they trick you into viewing a specially crafted web page. The vulnerability stems from an integer overflow—a programming error where a number wraps around unexpectedly—enabling unauthorized cross-origin data leakage. While the Chromium team rated this as "Critical," the CVSS base score of 6.5 reflects that successful exploitation requires user interaction (clicking or viewing content) and doesn't enable code execution or system-level damage. The flaw affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-9908MEDIUM 6.5

  CVE-2026-9908 is a memory disclosure flaw in Google Chrome's ANGLE graphics library that lets attackers read uninitialized or sensitive data from your browser process. An attacker crafts a malicious HTML page; when you visit it, the bug leaks information that shouldn't be accessible—such as encryption keys, session tokens, or other sensitive values that happened to be in memory. The vulnerability requires user interaction (clicking through to a malicious site) but no authentication, and it affects Chrome versions before 148.0.7778.216.

• CVE-2026-9912MEDIUM 6.5

  A flaw in Google Chrome's GPU processing on Android allows attackers to steal sensitive information from your device's memory. An attacker can craft a malicious web page that, when you visit it, extracts data from Chrome's process memory without your knowledge. No action from you is required beyond visiting the page—the vulnerability is triggered automatically during normal browsing.

• CVE-2026-9917MEDIUM 6.5

  Google Chrome on Android contains a flaw in its WebGL graphics processing that fails to properly initialize memory before use. When a user visits a malicious webpage, an attacker can read sensitive data left in process memory—such as parts of cached images, passwords, or other application state—without needing special permissions or bypass techniques. This affects Chrome versions before 148.0.7778.216 on Android devices.

• CVE-2026-9953MEDIUM 6.5

  CVE-2026-9953 is a memory safety bug in the ANGLE graphics library used by Google Chrome that allows an attacker to read sensitive data from the browser process. An attacker can craft a malicious HTML page that, when visited by a user, exploits an out-of-bounds read to leak information like passwords, session tokens, or other confidential data stored in Chrome's memory. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require special privileges and works across Windows, macOS, and Linux. Google has assigned it high severity within Chromium's security framework.

• CVE-2026-9981MEDIUM 6.5

  A flaw in the Skia graphics rendering library within Google Chrome allows attackers to trick users into visiting malicious web pages that expose sensitive data from the browser's memory. The vulnerability requires user interaction (clicking a link or visiting a site) but needs no special privileges to exploit, making it a realistic threat to everyday Chrome users.

• CVE-2026-9996MEDIUM 6.5

  A flaw in Google Chrome's WebRTC component allows a remote attacker to trick a user into visiting a malicious webpage that reads sensitive data from the browser's memory. The vulnerability affects Mac users running Chrome versions before 148.0.7778.216. No user action beyond visiting a crafted page is required for the attacker to attempt exploitation.

• CVE-2016-20070MEDIUM 6.4

  WordPress Booking Calendar Contact Form version 1.0.23 has two related security weaknesses that let attackers with basic subscriber accounts escalate their privileges and inject malicious code. An attacker can manipulate plugin settings and inject JavaScript that runs in administrator browsers, potentially compromising site integrity and administrative sessions. The plugin fails to properly check whether a user should have access to these sensitive functions and doesn't clean input before storing or displaying it.

• CVE-2021-47982MEDIUM 6.4

  WordPress administrators using the WP-Paginate plugin version 2.1.3 should be aware of a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into the plugin's settings. An attacker with login credentials can submit crafted requests to the plugin configuration page, embedding JavaScript payloads that are permanently stored in the database and executed whenever site administrators access those settings. This means the payload runs in the admin's browser session, potentially allowing the attacker to steal session tokens, modify site content, create new admin accounts, or perform other harmful actions on behalf of the compromised administrator.

• CVE-2021-47983MEDIUM 6.4

  The Stripe Payments WordPress plugin version 2.0.39 contains a stored cross-site scripting (XSS) vulnerability that allows logged-in attackers to inject malicious JavaScript code into plugin settings. When an administrator views these compromised settings, the injected script executes in their browser with full administrative privileges. This type of attack is particularly dangerous because the malicious code persists in the database and affects all administrators who access the settings page.

• CVE-2021-47984MEDIUM 6.4

  The WP24 Domain Check WordPress plugin version 1.6.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with plugin access to inject malicious JavaScript code. When an admin later views the plugin's settings page, that injected code executes in their browser, potentially allowing the attacker to perform unauthorized actions on their behalf or steal sensitive information. This is a persistence threat—once injected, the malicious script remains in the plugin settings until manually removed.

• CVE-2025-14042MEDIUM 6.4

  The Automotive Car Dealership Business WordPress Theme contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 13.4.1. An attacker with contributor-level or higher permissions can inject malicious scripts into Portfolio Item 'Project Details' fields. These scripts will execute when other users view the affected pages, potentially compromising visitor sessions, stealing credentials, or defacing content. The vulnerability stems from the theme's failure to properly sanitize and escape user input in a custom field.

• CVE-2025-14785MEDIUM 6.4

  Website Builder by SeedProd—a popular WordPress plugin for creating landing pages, coming soon pages, and maintenance modes—contains a stored cross-site scripting (XSS) vulnerability in its nested menu widget shortcode. An authenticated user with contributor-level permissions or higher can embed malicious JavaScript into pages. That script then executes for anyone visiting the affected page, potentially compromising visitor data or session tokens. The vulnerability affects all versions through 6.20.2.

• CVE-2025-36320MEDIUM 6.4

  IBM watsonx.data intelligence contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript into the web interface. Once injected, the script persists and executes in the browsers of other users who access the affected page, potentially enabling attackers to steal session credentials or manipulate application behavior. The vulnerability affects versions 5.2.0 through 5.3.0 and requires valid user credentials to exploit.

• CVE-2025-59610MEDIUM 6.4

  A memory corruption vulnerability affects numerous Qualcomm chipsets and platforms when processing IOCTL (input/output control) requests that contain mismatched API versions. The flaw stems from concurrent modification of user-space buffers during processing, allowing a privileged local attacker to corrupt kernel memory and potentially gain elevated code execution. The vulnerability requires high privilege access and specific conditions to trigger, limiting opportunistic exploitation but posing significant risk in compromised or malicious insider scenarios.

• CVE-2025-8444MEDIUM 6.4

  A WordPress plugin called Animation Addons for Elementor (versions up to 2.6.7) allows authenticated users with contributor-level permissions to inject malicious scripts into pages. When other users visit those pages, the scripts execute in their browsers, potentially stealing session data, modifying page content, or performing actions on their behalf. The vulnerability stems from the plugin's failure to properly clean and validate user input before storing it.

• CVE-2026-0409MEDIUM 6.4

  NETGEAR Orbi 370 series mesh routers contain a vulnerability that allows attackers to execute arbitrary commands on the device. An attacker must intercept and modify network traffic between the router and the Internet, then wait for the device administrator to perform specific management actions. The vulnerability affects Orbi 370, 371, 372, and 374 models running firmware versions prior to V12.1.2.7.

• CVE-2026-10024MEDIUM 6.4

  The TinyMCE shortcode Addon plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 1.0.0. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code into pages via the 'btnrel' shortcode attribute. Because the plugin fails to properly sanitize and escape this input, the injected script will execute in the browsers of anyone who views the affected page. This is a *stored* vulnerability, meaning the malicious code persists in the page content until explicitly removed.

• CVE-2026-10089MEDIUM 6.4

  The Insert Pages plugin for WordPress has a security flaw where it fails to properly clean user-supplied text before displaying it on web pages. Specifically, when an author or administrator creates a custom field (metadata) with a specially crafted name and inserts a page using the plugin's shortcode, that malicious field name gets displayed without protection. This allows attackers to inject JavaScript code that runs in the browsers of anyone viewing the affected page. The vulnerability requires an authenticated account with author-level permissions or higher to exploit, which limits the immediate risk but still represents a meaningful threat in environments where multiple content creators have access.

• CVE-2026-10093MEDIUM 6.4

  A vulnerability in the File Sharing & Download Manager – User Private Files WordPress plugin allows authenticated users with subscriber-level permissions or higher to inject malicious scripts into pages. When other users visit an affected page, those scripts execute in their browsers, potentially leading to credential theft, session hijacking, or other client-side attacks. The flaw exists in how the plugin handles the 'fldr_ttl' parameter, failing to properly sanitize and escape user input.

• CVE-2026-10095MEDIUM 6.4

  WP Photo Album Plus, a popular WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability in versions up to 9.1.13.005. Attackers with contributor-level access or higher can inject malicious code through the 'subtext' parameter of the plugin's photo shortcode. When other users—including administrators—view the compromised post, the injected script executes in their browser, potentially allowing attackers to steal session tokens, modify content, or perform actions on their behalf. The vulnerability persists in the database, making it a lasting threat until patched.

• CVE-2026-10570MEDIUM 6.4

  The Sympl Repeater for ACF and Elementor plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated authors and higher-privileged users to inject malicious scripts into pages. When a page containing an affected repeater field is viewed by any site visitor, the injected script executes in their browser. The vulnerability stems from the plugin's failure to properly escape data when rendering ACF field values in Elementor, leaving user input exposed to script injection.

• CVE-2026-10653MEDIUM 6.4

  Zephyr's network buffer library has a race condition in how it tracks when buffers are no longer in use. The library uses reference counts to know when a buffer can be safely freed, but these counts are updated using regular (non-atomic) operations. When multiple threads or tasks share the same buffer and call the unref function simultaneously, a timing race can cause the library to think two different holders are the last user—leading to the same buffer being freed twice, memory corruption, and potential use-after-free conditions. The vulnerability affects multiple subsystems including networking, Bluetooth, USB, and message passing. Actual exploitation requires genuine concurrency, shared buffer architecture in the application, and precise timing; external attackers have limited ability to trigger it directly.

• CVE-2026-10732MEDIUM 6.4

  The decompress package contains a critical flaw that allows attackers to write files anywhere on a system by uploading a specially crafted ZIP archive. The vulnerability exploits a race condition in how the library processes ZIP entries: when a ZIP contains two entries with identical paths—first a symlink pointing to an arbitrary location, then a regular file—the library writes the file's contents through the symlink to a location outside the intended extraction folder. This bypasses protections added in previous fixes, potentially enabling remote code execution if an attacker can control ZIP uploads or extraction workflows.

• CVE-2026-10738MEDIUM 6.4

  The jQuery Hover Footnotes plugin for WordPress allows attackers who can write or edit content on a site (author-level access or higher) to hide malicious scripts inside footnote markup. These scripts execute whenever anyone views the affected page. The vulnerability exists because the plugin doesn't properly clean user input before storing it, and the hidden scripts bypass WordPress's built-in protections by using a specific syntax that avoids HTML tags.

• CVE-2026-10833MEDIUM 6.4

  Gutenberg Essential Blocks, a popular WordPress page builder plugin, contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 6.1.4. An authenticated WordPress user with Contributor-level permissions or higher can inject malicious JavaScript code through the 'configurablePrefix' block attribute. Once injected, this code executes whenever anyone visits the affected page, potentially compromising site visitors or enabling further attacks. The vulnerability stems from the plugin failing to properly sanitize user input and escape output in this specific block parameter.

• CVE-2026-10862MEDIUM 6.4

  The Accordions plugin for WordPress has a security flaw that allows authenticated users with custom-level permissions or higher to inject malicious scripts into accordion content. When other users view pages containing these injected scripts, the scripts execute in their browsers, potentially exposing sensitive information or performing unwanted actions on their behalf. This vulnerability affects all versions up to and including 2.3.23.

• CVE-2026-11328MEDIUM 6.4

  A WordPress plugin called Exclusive Addons for Elementor has a stored cross-site scripting (XSS) vulnerability affecting versions up to 2.7.9.8. An attacker with Contributor-level access or higher can inject malicious scripts into post titles that will execute whenever anyone visits the affected page. The vulnerability stems from the plugin's failure to properly sanitize and escape user input in the post title parameter.

• CVE-2026-11370MEDIUM 6.4

  The WP Meta SEO plugin for WordPress has a Server-Side Request Forgery (SSRF) vulnerability affecting all versions through 4.5.18. An authenticated user with contributor-level permissions or higher can manipulate the 'new_link' parameter in an AJAX request to force the WordPress server to make HTTP requests to internal systems, cloud metadata services, or other arbitrary network destinations. The vulnerability is particularly dangerous because the HTTP response status codes are reflected back to the attacker, effectively creating a reconnaissance tool for mapping internal infrastructure or extracting sensitive information from cloud environments like AWS metadata endpoints.

• CVE-2026-11380MEDIUM 6.4

  A WordPress plugin called JetWidgets For Elementor has a security flaw in its Animated Box widget that allows authenticated users with author-level permissions to inject malicious scripts into pages. When visitors view those pages, the injected scripts execute in their browsers. The vulnerability affects versions up to 1.0.21 and requires an attacker to already have login access to the WordPress site.

• CVE-2026-11402MEDIUM 6.4

  A WordPress plugin called Services Section Block allows attackers with contributor access or higher to inject malicious scripts into pages. When someone visits those pages, the hidden scripts run in their browser. The vulnerability exists because the plugin doesn't properly validate input or sanitize output when handling links in service blocks. The injected code hides in HTML comments, which lets it slip past WordPress's standard security checks.

• CVE-2026-11597MEDIUM 6.4

  A WordPress plugin called Surbma | Infusionsoft Shortcode (versions up to 2.0.1) fails to properly validate and sanitize user input when creating shortcodes that embed external scripts. An authenticated WordPress user with contributor access or higher can inject malicious code into shortcode parameters, which gets embedded in web pages. Any visitor to those pages will execute the injected script in their browser, potentially compromising their session or harvesting sensitive information. The vulnerability requires an authenticated user to exploit it, but once weaponized, affects all subsequent visitors to the compromised page.

• CVE-2026-11614MEDIUM 6.4

  The Xpro Addons plugin for WordPress, which provides 140+ widgets for the Elementor page builder, contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.7.2. An authenticated user with author-level permissions or higher can inject malicious JavaScript code through the 'custom_attributes' parameter. This code persists in the database and executes whenever anyone visits the affected page, potentially allowing the attacker to steal session tokens, modify page content, or redirect users to malicious sites.

• CVE-2026-11783MEDIUM 6.4

  The Dokan multivendor marketplace plugin for WordPress has a stored cross-site scripting (XSS) flaw in how it handles product SKU data. An authenticated user with custom-level access or higher can inject malicious scripts into a product's SKU field. When site visitors—including those not logged in—use the store search widget, the injected script executes in their browsers. This allows an attacker to steal session data, redirect users, deface pages, or perform actions on behalf of victims.