By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 57 of 86

• CVE-2026-44889MEDIUM 6.1

  WebOb, a widely-used Python library for HTTP request and response handling, contains an open redirect vulnerability in how it processes redirect locations. An attacker can craft a malicious redirect URL containing whitespace characters (tabs, carriage returns, newlines) that bypass existing protections, causing users to be sent to an attacker-controlled website instead of the legitimate destination. The vulnerability affects versions before 1.8.10 and relies on the user clicking a link or visiting a page that triggers the vulnerable redirect.

• CVE-2026-44915MEDIUM 6.1

  Apache APISIX contains an open redirect vulnerability in its default CAS authentication configuration. An attacker can craft a malicious link that redirects users to an untrusted website after they authenticate, enabling phishing and credential theft. The vulnerability affects APISIX versions 3.0.0 through 3.16.0, and organizations should upgrade to version 3.17.0 to remediate the issue.

• CVE-2026-45307MEDIUM 6.1

  Speakr, a self-hosted audio transcription web application, contains an open redirect vulnerability in its post-login redirect logic. An attacker can craft a malicious URL that passes the application's safety validation but redirects authenticated users to an external attacker-controlled website. The flaw stems from a mismatch between how the validation function and the redirect function interpret scheme-relative URLs (those beginning with ////). The vulnerability affects versions prior to 0.8.20-alpha and is user-interaction dependent—victims must click a malicious link after logging in.

• CVE-2026-45384MEDIUM 6.1

  bit7z is a C++ library used by applications to handle file compression and extraction. Before version 4.0.12, the library had a flaw in how it created temporary files when updating archives. An attacker with local access could exploit a predictable temporary file location to create a symbolic link that tricks the library into overwriting arbitrary files on the system. This is a classic symlink-attack vulnerability affecting local privilege escalation or data integrity scenarios.

• CVE-2026-45500MEDIUM 6.1

  Microsoft Exchange Server contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages served by the application. An attacker can exploit this by crafting a malicious link or embedding code in a page that, when visited by a user, executes arbitrary actions in that user's browser session—such as stealing credentials, impersonating the user, or modifying email content. The vulnerability requires user interaction (clicking a link or visiting a page) but can affect any Exchange Server deployment exposed to the internet or accessible via webmail interfaces.

• CVE-2026-45560MEDIUM 6.1

  Roxy-WI, a web-based management console for load balancers and web servers, contains a stored cross-site scripting (XSS) vulnerability in its log viewer. The vulnerability exists because the application builds HTML pages by concatenating user-controlled log data without sanitization. An attacker who can generate traffic through a managed load balancer—such as by making HTTP requests to a public-facing application—can inject malicious scripts into access logs. When an administrator opens the log viewer in Roxy-WI, the injected payload executes in their browser with the privileges of that user. This is a supply-chain risk: any internet-facing service behind a Roxy-WI-managed load balancer becomes a potential injection point.

• CVE-2026-45566MEDIUM 6.1

  Roxy-WI, a web management interface for load balancers and web servers, contains a login redirect flaw that allows attackers to bypass security checks and trick users into visiting attacker-controlled websites. The vulnerability exploits an incomplete validation rule that rejects redirect URLs containing 'https://' or 'http://', but fails to account for the userinfo syntax (user@host format). By crafting a specially formed next parameter, an attacker can inject their domain into the redirect URL in a way that modern browsers interpret as routing to the attacker's site rather than the legitimate one. Successful exploitation requires user interaction—specifically a click on a malicious link—but carries real risk for credential harvesting and session hijacking.

• CVE-2026-46406MEDIUM 6.1

  Claude Code versions 2.1.59 through 2.1.128 had a local file handling vulnerability in the /copy command that could leak sensitive information or allow file manipulation. When the command executed, it wrote responses to a predictable location (/tmp/claude/response.md) with insufficient protections. Any user on the system could read files written there, potentially exposing secrets or credentials. Additionally, an attacker could plant a symlink at that location to trick the tool into overwriting arbitrary files with command output. This vulnerability requires local system access and relies on a privileged user running the /copy command, limiting its scope but creating real risk in multi-user or containerized environments.

• CVE-2026-46417MEDIUM 6.1

  Angular's server-side rendering (SSR) engine contains a vulnerability that allows attackers to redirect application requests to attacker-controlled servers. When an Angular application accepts a malicious URL during SSR initialization, the platform can be tricked into treating that URL's domain as the legitimate application origin. This causes subsequent relative requests—such as API calls or hostname lookups—to go to the attacker's server instead of the intended destination. An attacker would need to control the initial URL passed to the rendering engine, typically through manipulation of a request parameter or similar vector. The vulnerability affects the @angular/platform-server package across multiple major versions.

• CVE-2026-46547MEDIUM 6.1

  NocoDB, a popular no-code platform for building databases with a spreadsheet-like interface, contains a reflected cross-site scripting (XSS) vulnerability in its Page Leaving Warning feature. Attackers can craft malicious URLs containing JavaScript code that execute in a victim's browser when they click a specially crafted link or are redirected to the warning page. The vulnerability affects versions prior to 2026.04.1 and requires user interaction—specifically clicking a malicious link—to trigger the attack.

• CVE-2026-46642MEDIUM 6.1

  draw.io versions before 29.7.12 contain a stored cross-site scripting (XSS) vulnerability triggered when a crafted diagram file (.drawio) is opened. A malicious diagram can embed JavaScript code disguised as image markup that executes in the editor's security context as soon as the file is imported. The vulnerability stems not from the display rendering logic—which properly sanitizes content—but from a feature-detection routine in the Text Format panel that reads raw cell labels and inserts them into the DOM without validation. Attackers can craft and distribute poisoned diagram files that execute arbitrary scripts when opened by a user.

• CVE-2026-46770MEDIUM 6.1

  Oracle Application Development Framework (ADF), a core component of Oracle Fusion Middleware, contains a security flaw that allows an attacker to access or modify sensitive data without authentication. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. An attacker needs only network access and must trick a legitimate user into taking an action—such as clicking a malicious link—to trigger the vulnerability. Once successful, the attacker gains the ability to read or alter data within the ADF application, potentially affecting downstream systems that rely on it. This is not currently a known or active exploit in the wild, but it warrants prompt attention given the data-access implications.

• CVE-2026-46812MEDIUM 6.1

  Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain an authentication flaw that allows an unauthenticated network attacker to read or modify data within the application. The vulnerability requires a user to interact with a malicious request, but successful exploitation can affect not only Access Manager itself but potentially other connected systems. This is a medium-severity issue with network-accessible attack vectors and no special privileges required for initial access.

• CVE-2026-47250MEDIUM 6.1

  mcp-server-kubernetes is a tool that helps AI agents manage Kubernetes clusters through the Model Context Protocol. A flaw in versions before 3.7.0 allows an attacker with limited cluster access—such as a developer who can deploy pods—to trick a privileged operator into leaking their Kubernetes authentication token. By injecting a specially crafted instruction into application logs, the attacker can redirect kubectl commands to their own server, capture the operator's bearer token, and then use it to gain full control of the Kubernetes cluster. The vulnerability requires both an attacker with initial limited access and a privileged operator to interact with the MCP server, but the impact is severe: complete cluster compromise.

• CVE-2026-47306MEDIUM 6.1

  Samsung's rlottie library contains a flaw that allows specially crafted animation files to trigger uncontrolled recursion. When processing oversized serialized data payloads, the library fails to properly limit recursion depth, which can exhaust system resources and crash applications that depend on it. The vulnerability requires user interaction—a user must open or process a malicious animation file—but once triggered, it reliably denies service to the affected application.

• CVE-2026-47318MEDIUM 6.1

  A stack-based buffer overflow has been found in Samsung's rlottie library, an open-source animation rendering engine. When processing untrusted animation files, the library can write data beyond its allocated memory on the stack, potentially causing the application to crash or allowing limited data manipulation. The vulnerability requires a user to open a malicious animation file; it cannot be exploited remotely.

• CVE-2026-47319MEDIUM 6.1

  A memory allocation flaw in Samsung's rlottie animation rendering library allows an attacker to trigger excessive memory allocation by supplying a specially crafted input with an oversized size value. When a user opens a malicious animation file, the library attempts to allocate far more memory than intended, degrading system performance or causing the application to crash. This is a local attack that requires user interaction—the victim must open or process a hostile animation file.

• CVE-2026-47320MEDIUM 6.1

  CVE-2026-47320 is a memory safety vulnerability in Samsung's rlottie animation library that combines two distinct weaknesses: uninitialized pointer access and uncontrolled recursion. An attacker can craft malicious animation files that trigger pointer manipulation or send oversized serialized payloads, leading to application crashes and potential data corruption. The vulnerability requires local access and user interaction to exploit—someone must open a specially crafted file. While not as critical as remote execution flaws, this defect threatens availability and integrity on systems that process untrusted animation content.

• CVE-2026-47328MEDIUM 6.1

  Ubuntu Linux kernels 6.8, 6.17, and 7.0 contain a memory management bug in AppArmor SAUCE patches that allows unprivileged local users to corrupt kernel memory and exhaust system resources. The vulnerability stems from incorrect pointer deallocation—the code attempts to free memory that was never properly allocated, while simultaneously leaking other allocated memory. This combination can destabilize the kernel's memory management structures.

• CVE-2026-47833MEDIUM 6.1

  CVE-2026-47833 is a privilege escalation flaw in bpm-release (all versions before 1.4.30) where a compromised container process can exploit symlink handling in the setupBpmLogs function to gain unauthorized access to host files. An attacker can trick the system into changing ownership of arbitrary files—most critically /etc/shadow—to the vcap user, then read sensitive password hashes. This represents a container-to-host boundary breach affecting every job managed by bpm.

• CVE-2026-48157MEDIUM 6.1

  Slim, a popular PHP web framework, contains a vulnerability in versions 4.4.0 through 4.15 where developers can inadvertently create reflected cross-site scripting (XSS) vulnerabilities. If an application passes user-supplied data (like a search query or request parameter) into the HttpException::setTitle() or setDescription() methods, that data will be rendered without HTML escaping when an error page is displayed to the user. An attacker could craft a malicious request containing JavaScript that executes in the victim's browser. The vulnerability exists even when error detail display is disabled. The issue is fixed in Slim 4.15.2.

• CVE-2026-48520MEDIUM 6.1

  Langflow, a platform for building AI workflows and agents, has a file-read vulnerability in its "Shareable Playground" feature that allows public access to the flow. When a flow is made public, an attacker can craft execution requests that cause Langflow to read arbitrary files from the system—either local files or cloud storage like S3—and feed their contents into the LLM. This exposure depends on how the flow is configured and what storage backends are enabled. The vulnerability is patched in version 1.10.0.

• CVE-2026-48942MEDIUM 6.1

  CVE-2026-48942 is a cross-site scripting (XSS) vulnerability in JoomlaWorks K2 version 2.26 and earlier. The vulnerability exists because user profile images are inserted directly into HTML without proper sanitization. An attacker who can upload or modify a user profile image can craft a malicious image filename or source that executes JavaScript in the browsers of anyone viewing that profile. This requires user interaction (clicking or viewing a profile page) and affects only the user's current browser session and site context, but could be used to steal session cookies, redirect users, or deface content.

• CVE-2026-48949MEDIUM 6.1

  A Joomla vulnerability allows attackers to inject malicious scripts into multi-factor authentication (MFA) management pages. Because user input isn't properly validated before being displayed, an attacker can craft a malicious link that, when clicked by an authenticated administrator, executes JavaScript in their browser context. This could allow theft of session tokens, modification of MFA settings, or other administrative actions performed without the victim's knowledge.

• CVE-2026-48950MEDIUM 6.1

  CVE-2026-48950 is a cross-site scripting (XSS) vulnerability in Joomla's template file management component (com_templates). An attacker can inject malicious scripts into file names or metadata that are displayed without proper sanitization, allowing them to steal session cookies, redirect users, or perform actions on behalf of an administrator viewing the file management interface. The vulnerability requires user interaction—specifically, an administrator must visit the vulnerable page—but affects the security of the entire Joomla installation.

• CVE-2026-48951MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Joomla due to insufficient escaping of user input in modal return layouts across various components. An attacker can craft a malicious link or form that, when clicked by an authenticated or unauthenticated user, injects arbitrary JavaScript into the page. This script executes in the victim's browser within the context of the Joomla site, potentially allowing theft of session tokens, credential harvesting, or malware distribution.

• CVE-2026-48952MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Joomla's installer component update list view. The vulnerability arises from insufficient sanitization of user-supplied input, allowing an attacker to inject malicious scripts that execute in the context of an administrator's browser session. An authenticated or unauthenticated attacker can craft a malicious link containing JavaScript code; when an admin clicks it and accesses the installer update list, the injected script runs with the privileges of that administrator account. This could lead to unauthorized actions, session hijacking, or further compromise of the Joomla installation.

• CVE-2026-48953MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Joomla's generic image output layout due to insufficient output escaping. An attacker can craft a malicious link containing JavaScript code that executes in a victim's browser when they view or interact with image content. The vulnerability requires user interaction and affects the confidentiality and integrity of user sessions, though it does not impact availability.

• CVE-2026-48954MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability has been discovered in Joomla's language override feature. The vulnerability stems from inadequate input validation, allowing an attacker to inject malicious scripts that execute in users' browsers. An attacker would need to trick a user into visiting a specially crafted link or interacting with a compromised page, but no special privileges are required to exploit this flaw. The vulnerability affects the confidentiality and integrity of user sessions and data, though it does not directly impact system availability.

• CVE-2026-49294MEDIUM 6.1

  Valhalla, an open-source routing engine for OpenStreetMap data, contains a cross-site scripting (XSS) vulnerability in versions 3.6.3 and earlier. The flaw exists in how the application handles JSONP callback parameters—user-supplied values are reflected directly into responses without filtering or encoding. An attacker can inject malicious JavaScript by crafting a specially formatted URL; if a victim clicks or loads that URL, the attacker's script runs in the victim's browser with the same privileges as legitimate requests, potentially allowing theft of session tokens, credential capture, or unauthorized actions. This is a reflected XSS vulnerability requiring user interaction but with relatively broad impact potential.

• CVE-2026-49375MEDIUM 6.1

  JetBrains TeamCity versions before 2026.1 and 2025.11.5 contain a reflected cross-site scripting (XSS) vulnerability on the repository download page. An attacker can craft a malicious URL and trick a user into clicking it, allowing the attacker to steal session cookies, perform actions on behalf of the user, or redirect them to phishing sites. The vulnerability requires user interaction and does not directly compromise the server itself.

• CVE-2026-49384MEDIUM 6.1

  JetBrains PyCharm versions prior to 2025.3.4 contain a stored cross-site scripting (XSS) vulnerability in Jupyter notebook Markdown cells. An attacker can inject malicious scripts into Markdown content within a notebook, which are then executed in the browser context of users who view the notebook. This allows for session hijacking, credential theft, or malware distribution without requiring the victim to take any action beyond opening an affected notebook.

• CVE-2026-49496MEDIUM 6.1

  Ghidra, the NSA's open-source reverse engineering framework, contains a memory safety bug in its Sleigh decompilation engine that can corrupt heap memory. When processing malicious binaries, the vulnerability allows an attacker to trigger a use-after-free condition—where the software attempts to access memory that has already been freed. The flaw affects version 12.0 and earlier; upgrading to version 12.1 or later resolves the issue. While exploitation requires user interaction (opening a malicious binary), the memory corruption could lead to application crashes or, in carefully crafted scenarios, potential code execution.

• CVE-2026-49510MEDIUM 6.1

  Samsung's rlottie library, an open-source animation rendering engine, contains an integer overflow vulnerability that can be triggered when processing specially crafted input. An attacker with local access who tricks a user into opening a malicious animation file could cause the application using rlottie to crash or behave unpredictably, potentially allowing data corruption or denial of service.

• CVE-2026-50019MEDIUM 6.1

  yt-dlp is a popular command-line tool for downloading audio and video from the web. Between September 2023 and June 2026, a vulnerability existed where cookies could be sent to the wrong website if yt-dlp was configured to use curl as its external downloader. This could happen during HTTP redirects or when downloading video fragments from different hosts than the main manifest. The flaw stems from how yt-dlp passes cookies to curl—without properly activating curl's cookie handling engine, curl will blindly send cookies to any domain it connects to, regardless of the cookie's intended scope. An attacker controlling a redirect target or hosting a fragment URL could intercept these cookies, potentially gaining access to authenticated sessions. The vulnerability was fixed in version 2026.06.09.

• CVE-2026-50040MEDIUM 6.1

  Storage Concentrator (SC and SCVM) contains a reflected cross-site scripting (XSS) vulnerability in its 404 error page handling. When a user visits a specially crafted malicious link, unsanitized content is echoed back and executed as JavaScript in their browser. An attacker can exploit this to steal session credentials, redirect users to phishing sites, or perform actions within the application while impersonating the victim—but only if the victim clicks a malicious link while already logged in.

• CVE-2026-50089MEDIUM 6.1

  Aqara's IAM/SSO Gateway (gw-builder.aqara.com) contains an open redirect flaw that allows attackers to craft malicious links appearing to direct users to the legitimate Aqara domain, but actually redirecting them to attacker-controlled sites. This is a classic phishing vector: a user trusts the initial Aqara URL, clicks it, and lands on a fraudulent login page or malware distribution point. The vulnerability requires user interaction (a click) and affects the confidentiality and integrity of user sessions, making it a medium-severity network-based threat.

• CVE-2026-50133MEDIUM 6.1

  Hugo, a popular static site generator, contains a stored cross-site scripting (XSS) vulnerability in versions prior to 0.162.0. When Hugo processes HTML content files—either .html files placed in the /content directory or content generated by adapters configured with text/html media type—it outputs the body verbatim without sanitization. An attacker who can inject malicious HTML into a site's content pipeline can embed JavaScript that executes in visitors' browsers. This is particularly dangerous for sites that accept HTML content from external or user-controlled sources.

• CVE-2026-50169MEDIUM 6.1

  Angular's Service Worker has a flaw in how it handles network requests for cached assets. When the Service Worker reconstructs requests, it accidentally strips away security settings that tell the browser not to follow redirects—instead forcing all redirects to be followed automatically. This can leak sensitive data if a public page redirects to a restricted area, since cookies and session tokens travel along. The vulnerability affects Angular versions prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

• CVE-2026-50171MEDIUM 6.1

  Angular applications using number formatting features are vulnerable to a denial-of-service attack if an attacker can control the formatting instructions passed to number-display functions. An attacker crafting specially designed format strings with extremely large digit specifications can cause the application to enter an infinite loop that consumes memory and CPU, effectively freezing or crashing the app. This affects Angular's number, decimal, percent, and currency formatting pipes—features commonly used to display financial data, statistics, and user-facing numbers.

• CVE-2026-50184MEDIUM 6.1

  Angular's Service Worker package has a flaw where it unintentionally reverses security settings you've configured for network requests. When your application tells the browser not to send credentials (like cookies) on a particular request, or marks a response as non-cacheable, the Service Worker strips those instructions and applies default settings instead. This can leak session data or cache sensitive pages in local storage even after logout. The issue affects Angular versions prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

• CVE-2026-50229MEDIUM 6.1

  Apache Tomcat contains a cross-site scripting (XSS) vulnerability in its bundled number-guessing example application. An attacker can inject malicious scripts into web pages served by this example, which execute in the browsers of users who interact with it. This affects multiple Tomcat versions across several release branches. The vulnerability requires user interaction (such as clicking a link) to trigger, and impacts confidentiality and integrity rather than availability.

• CVE-2026-50230MEDIUM 6.1

  Lyrion Music Server version 9.2.0 has a cross-site scripting (XSS) vulnerability in its server logging endpoint. An attacker can craft a malicious URL containing JavaScript code and trick a user into clicking it. When the user visits the link, the JavaScript runs in their browser with the same permissions as the Lyrion application, potentially allowing the attacker to steal session cookies, redirect the user, or perform actions on their behalf. No authentication is required to exploit this vulnerability, making it accessible to anyone who can send a link to a target user.

• CVE-2026-50235MEDIUM 6.1

  Lyrion Music Server 9.2.0 has a reflected cross-site scripting (XSS) vulnerability in its advanced search feature. An attacker can craft a malicious link containing JavaScript code in the search parameters. When a user clicks the link or is tricked into visiting it, the malicious script executes in their browser, potentially allowing the attacker to steal session cookies, hijack accounts, or perform actions on behalf of the user. The vulnerability requires user interaction—the victim must click a malicious link—but no special privileges or complex setup are needed to exploit it.

• CVE-2026-50555MEDIUM 6.1

  Angular's server-side rendering (SSR) feature includes a vulnerability in how it handles the serialization of raw-text HTML elements like <script>, <style>, and <iframe> tags. When dynamic content containing certain Unicode characters (specifically astral characters like emojis) appears before a closing tag, the server fails to properly escape that closing tag. This allows an attacker to break out of the raw-text context and inject arbitrary JavaScript that executes in the victim's browser with the same origin privileges. The flaw affects Angular versions prior to specific patched releases and requires user interaction (such as clicking a link) to exploit.

• CVE-2026-50556MEDIUM 6.1

  Angular applications using Server-Side Rendering (SSR) are vulnerable to Cross-Site Scripting attacks when dynamic text is bound inside <noscript> elements. The vulnerability stems from a gap in how the underlying DOM emulation library (domino) escapes closing tags during HTML serialization. An attacker who can control content rendered within a <noscript> element can inject a closing tag that terminates the noscript block prematurely, allowing arbitrary JavaScript to execute in the user's browser with the application's privileges. The issue affects Angular versions prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.

• CVE-2026-50557MEDIUM 6.1

  Angular versions prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.22 contain a template sanitization bypass vulnerability that allows attackers to inject malicious scripts through specially crafted namespace-based HTML elements. By using namespaced variants like <svg:script> or <:svg:script>, attackers can circumvent Angular's built-in protections against script injection, potentially leading to cross-site scripting (XSS) attacks. The vulnerability also extends to namespaced attributes in SVG and MathML elements, which can bypass attribute sanitizers. Any application using a vulnerable Angular version that processes user-supplied or dynamically rendered templates is at risk.

• CVE-2026-5071MEDIUM 6.1

  A vulnerability in the SocketCAN network socket implementation allows a local user to trigger an out-of-bounds memory read by sending a specially crafted network frame with a truncated buffer. The flaw stems from insufficient validation—the code relies on a disabled assertion to catch buffer length issues, but in production builds where assertions are turned off, this check is bypassed entirely. An attacker can then cause the system to crash or leak sensitive memory contents to the network.

• CVE-2026-50745MEDIUM 6.1

  A cross-site scripting vulnerability exists in Revive Adserver's stats-video.php script. The application fails to properly sanitize and encode user-supplied input before displaying it back to visitors. An attacker could craft a malicious link that, when clicked by a user, executes arbitrary JavaScript in the context of the affected domain. This is a reflected XSS vulnerability—the payload doesn't persist on the server, but requires social engineering to trick a user into clicking a specially crafted URL.

• CVE-2026-50765MEDIUM 6.1

  Koha Library Management System contains a stored cross-site scripting (XSS) vulnerability in its patron restriction type administration interface. An authenticated administrator can inject malicious JavaScript into restriction type labels, which is then stored and executed in the browsers of other users who view that page. This allows an insider threat to compromise other administrators' sessions or steal sensitive library data without requiring additional user interaction beyond normal administrative activities.

• CVE-2026-50813MEDIUM 6.1

  SQLite's Session Extension contains a vulnerability in how it merges changeset and changegroup data, allowing local attackers to read sensitive information from the database. The flaw affects versions before Fossil check-in 869a51ae84df and requires user interaction to trigger. While the vulnerability does not enable data modification or direct service disruption, the information disclosure risk is paired with a high availability impact potential, making it a moderate-severity issue requiring attention in environments where SQLite handles sensitive data.

• CVE-2026-52725MEDIUM 6.1

  Angular's dynamic component creation feature contains a security flaw that allows attackers to bypass script-execution protections. When an Angular application dynamically creates a component, the framework should prevent mounting that component onto dangerous HTML elements like <script> tags. This vulnerability fails to enforce that restriction, meaning an attacker who can control where a component is mounted could force it onto a script tag, causing arbitrary JavaScript code to execute in the user's browser. This is a client-side XSS vulnerability that requires user interaction and control over component placement to exploit.

• CVE-2026-52760MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Apache ActiveMQ's Web Console browse page. An authenticated message producer can craft a JMS message ID containing malicious HTML or JavaScript. When an administrator browses the queue through the Web Console, that payload executes in their browser, potentially allowing the attacker to steal session tokens, modify queue contents, or perform actions as the administrator. The vulnerability requires authentication to trigger but exploits a trust boundary between producer and administrator roles.

• CVE-2026-53737MEDIUM 6.1

  Juicer, a plugin or tool for managing remote feeds, contains a stored cross-site scripting (XSS) vulnerability in versions through 1.12.18. When an administrator visits the plugin's settings page, the plugin fails to properly sanitize data pulled from a connected remote feed before displaying it. An attacker who controls or can manipulate that feed source can inject malicious JavaScript code that will execute in the administrator's browser session. This runs with the privileges of the logged-in admin, potentially allowing the attacker to perform unauthorized actions or steal sensitive information.

• CVE-2026-53765MEDIUM 6.1

  Chrome DevTools for agents (chrome-devtools-mcp) is a tool that allows coding agents to control and inspect a live Chrome browser. Versions 0.20.0 through 1.0.x contain a local privilege escalation vulnerability affecting macOS and Linux systems. An attacker with local access to the same machine can exploit predictable file paths to write a symlink that causes the application to overwrite files belonging to higher-privileged users when the daemon starts. The vulnerability has been fixed in version 1.1.0.

• CVE-2026-53766MEDIUM 6.1

  Chrome DevTools for agents (chrome-devtools-mcp) contains a path validation flaw that allows an attacker with local access to bypass workspace boundary restrictions. By placing symbolic links inside an authorized workspace directory that point to files outside that boundary, an attacker can read sensitive files or overwrite files they should not have access to. This circumvents the security controls meant to confine agent operations to specific directories. The vulnerability affects versions 0.24.0 through 1.0.x and is resolved in version 1.1.0.

• CVE-2026-53841MEDIUM 6.1

  OpenClaw versions prior to 2026.5.12 contain a cross-site scripting (XSS) flaw in the exported session HTML feature. When users export session data, the resulting HTML file retains unsafe JavaScript and data URI links that have not been sanitized. If an operator opens this exported file in a browser and interacts with a malicious link, an attacker can execute arbitrary JavaScript in the operator's browser context. This is a social engineering attack requiring user action but can compromise an operator's session, credentials, or browser security.

• CVE-2026-53878MEDIUM 6.1

  Django's domain name validator accepts newlines in domain values, which can lead to HTTP header injection when those values are included in responses. While Django's own `HttpResponse` class protects against this, applications that validate domains with `DomainNameValidator` and then use those values directly in HTTP headers could inadvertently inject malicious headers. The issue affects Django 6.0 before version 6.0.7 and 5.2 before version 5.2.16, though older unsupported versions may also be vulnerable.

• CVE-2026-54264MEDIUM 6.1

  Angular's Service Worker—a component that helps web applications work offline—has a flaw in how it handles redirects across different websites. When a Service Worker follows a redirect to another domain, it should remove sensitive information like login tokens before sending the request. Instead, it's currently passing those credentials along, potentially exposing them to untrusted external sites. An attacker can exploit this by crafting a scenario where a user's browser is redirected through the vulnerable Service Worker to a site the attacker controls, capturing credentials in the process. This affects Angular versions before 22.0.1, 21.2.17, and 20.3.25.

• CVE-2026-54265MEDIUM 6.1

  Angular versions prior to 22.0.1, 21.2.17, and 20.3.25 contain a vulnerability in the compiler that allows developers to accidentally create XSS vulnerabilities in their applications. The issue occurs when developers use Angular's two-way binding syntax (a shorthand for linking data both into and out of a component) on sensitive HTML properties like innerHTML or src. Under normal circumstances, Angular automatically cleans these properties to prevent malicious code injection. However, the two-way binding syntax bypasses that automatic cleaning, leaving applications vulnerable if they bind user-controlled data to these properties. An attacker who can influence what data gets bound could inject malicious JavaScript that runs in users' browsers.

• CVE-2026-54266MEDIUM 6.1

  Angular's server-side rendering (SSR) feature uses a weak caching mechanism to avoid repeating HTTP requests during client hydration. The cache relies on a 32-bit hash to identify which responses belong to which requests. Because this hash is weak, an attacker can craft a specially constructed URL with a query parameter that produces the same hash value as a sensitive endpoint. When a victim visits the attacker's link, both requests execute, but due to the collision, the wrong response gets cached and returned to the user. This could expose sensitive data like profile information by replacing it with attacker-controlled content, or vice versa.

• CVE-2026-54267MEDIUM 6.1

  Angular applications using server-side rendering (SSR) with client hydration are vulnerable to a DOM Clobbering attack that could allow attackers to inject or manipulate cached application state. When an Angular app serializes its runtime state (like HTTP responses) into an HTML script tag during SSR, the client-side code retrieves this state by searching for an element with the ID 'ng-state'. If an attacker can control user input or CMS content that sets element IDs before the legitimate script tag loads, they can create a fake 'ng-state' element. When Angular's hydration process looks for this element, it finds the attacker's version instead and attempts to parse its content as application state, potentially leading to information disclosure or application manipulation.

• CVE-2026-54276MEDIUM 6.1

  AIOHTTP, a widely-used Python framework for building asynchronous HTTP applications, contains a flaw in its DigestAuthMiddleware component that can leak user credentials across domain boundaries. When a server redirects an authenticated user to a different domain (via an open redirect or similar vulnerability), AIOHTTP may automatically resend the digest authentication response to the attacker-controlled destination. An attacker cannot directly extract plaintext passwords from the digest alone, but the digest itself becomes a credential an attacker can attempt to crack or replay if cryptography is weak or if users reuse passwords across services.

• CVE-2026-54386MEDIUM 6.1

  marimo, a notebook environment for Python, contains a reflected cross-site scripting (XSS) vulnerability in versions before 0.23.9. An attacker can craft a malicious link containing malicious code in the file query parameter. When a user visits this link while accessing their marimo server, the injected JavaScript executes in the user's browser without being blocked by standard security protections. No authentication is required to exploit this vulnerability—any user who clicks a crafted link is at risk. The impact is limited to the attacker's ability to read or modify data visible to the victim within that marimo session, or perform actions on their behalf.

• CVE-2026-55423MEDIUM 6.1

  Langflow, a platform for building AI workflows and agents, has a session management flaw in versions before 1.7.0. When a user clicks logout, their session token is not properly cleared from the system. This means the previous user remains authenticated until someone else logs in with different credentials. In shared or multi-user environments, this creates a window where an attacker with brief physical or remote access could maintain unauthorized access to the account and its data after the legitimate user believes they've logged out.

• CVE-2026-55590MEDIUM 6.1

  CakePHP Authentication, a plugin used to handle user login flows in CakePHP and PSR-7 applications, has a flaw in how it validates redirect destinations after login. An attacker can craft a malicious link that tricks the redirect logic into sending users to an attacker-controlled website instead of a legitimate destination. The vulnerability exists because the code fails to properly block backslash characters used to disguise malicious URLs. Users who click a specially crafted link could be redirected to a phishing site or other attacker infrastructure, putting credentials or session data at risk.

• CVE-2026-55877MEDIUM 6.1

  Symfony UX, a popular JavaScript framework for the Symfony PHP framework, contains a cross-site scripting (XSS) vulnerability in how it renders SVG icons. The ux_icon() Twig function treats icon content as safe HTML without sanitizing it first. This means if an SVG file or icon data from the Iconify service contains malicious code—such as embedded script tags or event handlers—that code will execute in a user's browser. An attacker could exploit this by serving a malicious SVG or by compromising icon sources to run unauthorized JavaScript in the context of the affected application.

• CVE-2026-56236MEDIUM 6.1

  Capgo CLI, a command-line tool used by developers, has a flaw that allows attackers to trick it into overwriting files or exposing sensitive credentials. If a developer clones or works in a repository controlled by an attacker, the attacker can plant symbolic links (shortcuts to files) that cause the CLI to write to unintended locations on the developer's computer when they log in or build their application. The credentials file may also end up readable by anyone on that machine.

• CVE-2026-56263MEDIUM 6.1

  Crawl4AI, a web crawling framework, contains a stored cross-site scripting (XSS) vulnerability in its monitoring dashboard. An attacker can craft a malicious crawl request containing JavaScript code. When a dashboard operator views the crawl results, the malicious code executes in their browser without being sanitized, potentially allowing the attacker to steal session tokens, redirect the operator to phishing sites, or perform actions on their behalf. The vulnerability affects versions prior to 0.8.7.

• CVE-2026-56317MEDIUM 6.1

  Nuxt, a popular Vue.js framework, has a cross-site scripting (XSS) vulnerability in its NoScript component. When developers use the NoScript component to render untrusted data—such as user-supplied query parameters—the framework writes that content directly to the DOM without sanitizing it. An attacker can craft a malicious URL containing JavaScript that executes in the victim's browser when they visit the page, potentially stealing session tokens, modifying page content, or redirecting users to phishing sites.

• CVE-2026-56326MEDIUM 6.1

  Nuxt, a popular JavaScript framework for building web applications, contains a vulnerability in its `navigateTo` function that can be tricked into redirecting users to attacker-controlled websites. The vulnerability affects Nuxt 4.0.0 through 4.4.6 and all 3.x versions before 3.21.7. Attackers exploit this by crafting specially formatted URLs that bypass the framework's validation of external redirect targets, allowing them to send victims to phishing sites or steal authentication tokens. The attack requires user interaction—a victim must click a malicious link—but is otherwise straightforward to execute.

• CVE-2026-56347MEDIUM 6.1

  AVideo's TopMenu plugin version 26.0 and earlier allows attackers to inject malicious code into menu items that will execute when site visitors view the page. The plugin fails to properly sanitize user-supplied text in menu configurations, enabling stored cross-site scripting attacks. Once injected, the malicious code runs in visitors' browsers, potentially compromising their session security or enabling unauthorized site modifications.

• CVE-2026-56697MEDIUM 6.1

  Nuxt, a popular web framework, has a vulnerability in its `reloadNuxtApp` function that allows attackers to trick users into visiting malicious websites. The flaw stems from how the function validates URLs—it checks whether a path starts with a script protocol (like `javascript:`), but protocol-relative URLs (those beginning with `//`) slip through this check. When a user-supplied path like `//evil.com` is processed, the browser resolves it using the current page's protocol (http or https), redirecting to the attacker's domain instead. This enables phishing attacks or theft of sensitive authorization codes from OAuth flows. Affected versions are Nuxt 4.0.0 through 4.4.6 and all 3.x versions before 3.21.7.

• CVE-2026-56698MEDIUM 6.1

  Nuxt, a popular JavaScript framework, has a security flaw in its navigateTo function that fails to block certain types of links when users can control where they navigate. If an attacker tricks a user into clicking a specially crafted link or can inject malicious input into the navigation destination, the attacker's JavaScript code executes within the legitimate application's security context. This affects Nuxt 4.0.0 through 4.4.6 and all 3.x versions before 3.21.7. The vulnerability requires user interaction and is rated as medium severity because the impact is limited to information disclosure and minor manipulation within the page, though it can affect multiple users if hosted on shared origins.

• CVE-2026-56809MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in Ricoh Web Image Monitor, a web-based management interface found on multiple laser printers and multifunction printers (MFPs). An attacker can craft a malicious URL that, when visited by a printer administrator or authorized user, executes arbitrary JavaScript in their browser. This allows the attacker to perform actions on behalf of the logged-in user, such as modifying printer settings, accessing sensitive information, or pivoting into the network.

• CVE-2026-57241MEDIUM 6.1

  A vulnerability in Foxit PDF Editor and Reader allows an attacker to crash the application by crafting a malicious PDF file containing JavaScript. When the PDF is opened, the JavaScript code modifies page-related data structures in memory, causing them to become out of sync with what the renderer believes to be the current state. The application continues to trust an outdated page count and eventually attempts to access memory beyond valid bounds, leading to a denial of service. This requires user interaction (opening a PDF file) and affects only the local system, but can reliably crash the application.

• CVE-2026-57243MEDIUM 6.1

  A flaw in how Foxit's PDF applications handle JavaScript during document opening and form formatting can cause the application to crash. The vulnerability stems from a reentrancy issue—where JavaScript code is executed recursively before the previous execution completes—leaving the document in an inconsistent state. When the application then tries to access memory addresses based on outdated page information, it attempts to read from invalid locations, triggering a denial-of-service condition. An attacker would need to trick a user into opening a malicious PDF file to exploit this issue.

• CVE-2026-57253MEDIUM 6.1

  A flaw in Foxit PDF Editor and Reader allows a specially crafted PDF with an abnormal image object to crash the application. When the renderer processes the image's scan lines, it follows an incorrect code path and attempts to read from an invalid memory location, causing an immediate denial of service. The issue requires user interaction—opening a malicious PDF—but poses a genuine availability risk in environments where PDF handling is routine.

• CVE-2026-57255MEDIUM 6.1

  A vulnerability in PDF reader and editor applications allows a specially crafted PDF file with a malformed color space function to trigger an out-of-bounds memory access. When the application processes the PDF, the unvalidated function output creates an illegal pointer that crashes the application. This requires user interaction—the PDF must be opened—but poses a local denial-of-service risk and potential information disclosure through memory leakage.

• CVE-2026-57257MEDIUM 6.1

  CVE-2026-57257 is a memory safety flaw in Foxit PDF Editor and Reader that crashes the application when processing a specially crafted PDF file. The vulnerability stems from insufficient validation of entity indices during PRC (a PDF internal format) parsing, allowing an attacker to read memory beyond array boundaries. When a user opens a malicious PDF, the application crashes due to an out-of-bounds read, resulting in a denial of service. This is a local attack that requires user interaction—the victim must open the malicious file.

• CVE-2026-57258MEDIUM 6.1

  A vulnerability in PRC file parsing affects Foxit PDF Editor and Reader, as well as certain Windows and macOS systems. The issue stems from unsafe handling of file structure metadata: when a PRC file is opened, the application trusts the header information describing the file's array layout without validating it. An attacker can craft a malicious PRC file with misleading structure data that causes the application to read beyond allocated memory boundaries. This leads to crashes and potential information disclosure. User interaction is required—the victim must open the specially crafted file.

• CVE-2026-57454MEDIUM 6.1

  Vim versions 9.2.0320 through 9.2.0678 contain a memory safety flaw in how they handle undo and swap files. When a crafted file contains specially malformed virtual-text properties—metadata that Vim uses to annotate text—the editor fails to validate that the offset and length values actually point to valid memory locations. This causes Vim to read data outside the intended memory region, potentially crashing the application or exposing sensitive information from adjacent heap memory. The vulnerability is triggered when a user opens or restores such a malicious file, making it a user-interaction risk rather than a network-based threat.

• CVE-2026-5793MEDIUM 6.1

  BiEticaret, an e-commerce platform by Inrove Software and Internet Services, contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. When a user clicks a crafted link, the attacker's code executes in the victim's browser within the context of the BiEticaret application, potentially stealing session tokens, redirecting to phishing pages, or performing unauthorized actions on behalf of the user. Versions before 3.3.57 are affected.

• CVE-2026-57958MEDIUM 6.1

  Mixpost, a social media management platform, contains a reflected cross-site scripting (XSS) vulnerability in its OAuth callback handling. An attacker can craft a malicious callback URL with specially crafted error parameters that, when clicked by an authenticated user, executes arbitrary JavaScript in that user's browser. This can lead to session hijacking or unauthorized actions performed on behalf of the victim. The vulnerability affects Mixpost versions through 2.6.0 and requires no authentication to exploit, though the attack depends on tricking a logged-in user into clicking a malicious link.

• CVE-2026-58030MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Wikimedia Foundation's SyntaxHighlight_GeSHi extension, which is used to display colored code syntax highlighting on MediaWiki installations. The flaw allows an attacker to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper sanitization of user input in the SyntaxHighlight.php file before it is rendered in HTML. An attacker would need to trick a user into visiting a malicious wiki page or clicking a crafted link, but once triggered, the injected script executes in the victim's browser within the context of the MediaWiki site. This could allow theft of session cookies, credential harvesting, defacement, or redirection to malicious sites.

• CVE-2026-58032MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in MediaWiki's JavaScript API module that can allow attackers to inject malicious code into web pages viewed by other users. An attacker would need to trick a user into clicking a link or visiting a malicious page, but once executed, the injected script runs in the victim's browser with the permissions of the legitimate MediaWiki site. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

• CVE-2026-58037MEDIUM 6.1

  MediaWiki contains a cross-site scripting (XSS) vulnerability in multiple logging and language components. An attacker can inject malicious scripts into log entries or language-related output that execute in the browsers of users viewing those pages, potentially stealing session tokens, performing actions on behalf of logged-in users, or redirecting them to malicious sites. User interaction is required—the victim must view a page containing the injected payload—but no special permissions are needed to exploit this flaw.

• CVE-2026-58038MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Wikimedia Foundation's timeline component that allows attackers to inject malicious scripts into web pages. The flaw stems from improper validation of user input during page generation, affecting the Timeline.php file and EasyTimeline.pl script. An attacker can craft a malicious timeline input that, when rendered in a victim's browser, executes arbitrary JavaScript in the context of the wiki site. This requires user interaction—specifically, a victim must view or interact with a page containing the malicious timeline—but does not require authentication to exploit.

• CVE-2026-58291MEDIUM 6.1

  Microsoft Edge (Chromium-based) contains a flaw that allows attackers to access sensitive information through a network when specific conditions are met. The vulnerability stems from the application attempting to use a resource—such as memory or a file handle—after it has been released or expired. An attacker would need to trick a user into taking an action, but if successful, could potentially read confidential data without modifying or disrupting systems. This is classified as a medium-severity issue.

• CVE-2026-58303MEDIUM 6.1

  A stack-based buffer overflow has been discovered in Samsung Open Source Escargot, a JavaScript engine. The vulnerability allows an attacker to write data beyond the bounds of allocated stack memory, potentially causing application crashes or enabling localized code execution. Because exploitation requires user interaction (such as opening a malicious file or visiting a compromised website), the risk is somewhat contained, though the impact can be significant depending on how Escargot is deployed.

• CVE-2026-58304MEDIUM 6.1

  Samsung's Escargot JavaScript engine contains a memory safety vulnerability that allows an attacker to read from or write to memory locations outside the intended buffer boundaries. An attacker with local access who tricks a user into opening a malicious file or visiting a compromised page can trigger the overflow, potentially crashing the application or modifying memory to achieve unintended behavior. This is not currently a known exploited vulnerability in the wild.

• CVE-2026-58305MEDIUM 6.1

  Samsung's Escargot, an open-source JavaScript engine, contains a type confusion vulnerability that allows an attacker to manipulate memory pointers. The flaw requires local access and user interaction (such as opening a malicious file or visiting a compromised page), but once triggered, it can cause application crashes or data corruption. This is a memory safety issue stemming from improper type handling during resource access.

• CVE-2026-58306MEDIUM 6.1

  A heap-based buffer overflow has been identified in Samsung's open-source Escargot JavaScript engine. The vulnerability allows an attacker to overflow memory buffers during processing, potentially leading to application crashes or data corruption. Exploitation requires local access and user interaction, such as opening a malicious file or visiting a crafted webpage. The issue has been patched as of commit ef525f337fafddecde77a3c426212a84bb20cb98.

• CVE-2026-58307MEDIUM 6.1

  CVE-2026-58307 is a memory safety flaw in Samsung's Escargot JavaScript engine that allows an attacker to read past the end of a buffer and trigger an assertion failure. By crafting malicious input and requiring user interaction (such as opening a file or visiting a page), an attacker can cause the application to crash or potentially disclose sensitive data. The vulnerability is rated medium severity because it requires local access and user engagement, but the availability impact is substantial.

• CVE-2026-58381MEDIUM 6.1

  GIMP, a widely used open-source image editor, contains a memory safety bug in its PSP (PaintShop Pro) file parser. When GIMP opens a specially crafted PSP file, a programming error causes the application to attempt to free the same memory block twice—a condition known as a double-free. This can corrupt the application's memory state, crash the program, or in some cases allow an attacker to execute arbitrary code on the system. The vulnerability requires local file access and user interaction (opening the malicious file), limiting but not eliminating real-world risk.

• CVE-2026-58520MEDIUM 6.1

  A vulnerability in Mediawiki's UrlShortener Extension allows attackers to craft malicious URLs that redirect users to untrusted websites. When a user visits a shortened link generated by the extension, they may be sent to a phishing site, malware distribution point, or other malicious destination without clear warning. The vulnerability affects versions before 1.43.9, 1.44.6, and 1.45.4.

• CVE-2026-59710MEDIUM 6.1

  Showdown, a popular markdown-to-HTML converter, contains a stored cross-site scripting (XSS) vulnerability in how it processes table headers. When markdown containing malicious content is rendered using the default GitHub flavor configuration, an attacker can inject arbitrary HTML and JavaScript-executing SVG elements through specially crafted double-quote characters in table header text. Once injected, the malicious code persists in the rendered output and executes in the browsers of anyone viewing the content. This is particularly dangerous in applications that accept user-submitted markdown and display it to other users without sanitization.

• CVE-2026-59711MEDIUM 6.1

  Showdown, a popular markdown-to-HTML converter, has a cross-site scripting (XSS) vulnerability in how it handles metadata titles. When a specific option (completeHTMLDocument) is turned on, the library fails to properly escape special characters in markdown frontmatter metadata before inserting them into HTML title tags. An attacker can craft a markdown document with malicious code in the metadata that, when processed, breaks out of the title context and executes JavaScript in users' browsers. The vulnerability requires user interaction—someone must process the attacker's markdown—but can affect any application using Showdown with this option enabled.

• CVE-2026-59890MEDIUM 6.1

  setuptools, a core Python package management tool, contains a vulnerability in how it handles file exclusion rules when building source distributions. On macOS systems using APFS or HFS+ filesystems, attackers or malicious developers can bypass intended file exclusion directives by exploiting Unicode normalization differences. Specifically, files named with decomposed Unicode characters (NFD form) can be packed into distributed Python packages even when exclusion rules target the composed form (NFC). This allows sensitive or malicious files to be included in source distributions when they should have been excluded, potentially affecting downstream package users.

• CVE-2026-59895MEDIUM 6.1

  Hono, a JavaScript framework for building web applications, contains a flaw in its CSS class composition utility (cx() function) that fails to properly sanitize user-supplied class names during server-side rendering. When untrusted input is passed as a class attribute in JSX, an attacker can break out of the attribute context and inject arbitrary HTML markup into the rendered page. This occurs because the function marks its output as safe HTML without actually escaping the input strings. The vulnerability affects Hono versions 4.0.0 through 4.12.26 and has been patched in version 4.12.27.