By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 58 of 86

• CVE-2026-59923MEDIUM 6.1

  Mistune, a widely-used Python library for converting Markdown to HTML, contains a flaw in how it validates links and image URLs. An attacker can craft Markdown that includes specially encoded JavaScript commands disguised in percent-encoded format. When a user renders this malicious Markdown through Mistune versions before 3.3.0, the library fails to block these hidden scripts, allowing them to execute in the browser. This affects any application that accepts user-supplied Markdown and displays the rendered output to other users.

• CVE-2026-59926MEDIUM 6.1

  Mistune, a popular Python library for converting Markdown into HTML, has a vulnerability in how it handles formatting directives. When users include special formatting instructions (called admonitions) in Markdown, the library failed to properly clean certain styling options before adding them to the generated HTML. This oversight allows an attacker to inject malicious code that could compromise website visitors' browsers, even if the site owner thought they had protective settings turned on. The issue affects Mistune versions before 3.2.1.

• CVE-2026-59929MEDIUM 6.1

  Mistune, a popular Python Markdown parser, contains a vulnerability in its URL sanitization logic that fails to block certain legacy and less-common URL schemes. While it successfully blocks javascript:, vbscript:, file:, and data: URLs, attackers can bypass this protection by using alternative schemes like feed:, view-source:, jar:, or others to inject malicious links into rendered HTML. When users click these links or the content is processed by certain browsers, script execution may occur. This affects Mistune versions prior to 3.3.0.

• CVE-2026-59946MEDIUM 6.1

  Composer, the PHP dependency manager, has a path traversal vulnerability in how it handles binary entry points during package installation. When a package specifies a bin entry with path segments like (..), Composer can be tricked into modifying files outside the package directory, changing their permissions to world-readable and world-executable. This happens automatically during composer install, update, or require commands. An attacker could craft a malicious package to expose sensitive files or make system binaries world-writable, creating a foothold for privilege escalation or information disclosure on affected systems.

• CVE-2026-60092MEDIUM 6.1

  AVideo's Meet plugin contains a stored cross-site scripting (XSS) vulnerability that allows an unauthenticated attacker to inject malicious JavaScript into the Participants management panel. An attacker can join any public meeting while supplying a crafted User-Agent header containing HTML and JavaScript code. This payload is saved to the database without sanitization and later displayed without encoding when the meeting host or site administrator views the participant list, causing the attacker's code to execute in their authenticated browser session. The vulnerability requires user interaction (opening the Participants panel) but affects a privileged user, making it a serious risk for meeting organizers and administrators.

• CVE-2026-7380MEDIUM 6.1

  Armiya Information Technologies' Access Control System (GKS) contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. An attacker can craft a specially designed URL or web page that, when visited by a user, executes JavaScript code in the victim's browser within the context of the GKS application. This could enable credential theft, session hijacking, or unauthorized actions performed on behalf of the victim. The vulnerability requires user interaction—a victim must click a malicious link or visit an attacker-controlled page—but the attacker does not need authentication to exploit it.

• CVE-2026-7660MEDIUM 6.1

  The Easy Updates Manager WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability in its pagination feature. Attackers can craft malicious links that inject JavaScript code into pages. When a WordPress administrator clicks such a link, the injected script executes in their browser with their privileges, potentially allowing attackers to steal credentials, modify site content, or perform unauthorized actions. The vulnerability affects versions 9.0.20 and earlier.

• CVE-2026-8059MEDIUM 6.1

  IBM Datacap and IBM Datacap Navigator versions 9.1.7, 9.1.8, and 9.1.9 contain a cross-site scripting (XSS) vulnerability in their Web UI. An unauthenticated attacker can inject malicious JavaScript code that executes in the browser of a legitimate user, potentially stealing credentials or modifying the application's behavior without the user's knowledge.

• CVE-2026-8306MEDIUM 6.1

  A stored cross-site scripting (XSS) vulnerability exists in Armiya Information Technologies' Access Control System (GKS) that allows attackers to inject malicious scripts into the application. Unlike reflected XSS attacks that require tricking a user into clicking a link, this vulnerability persists in the system, meaning any user who views the affected page will execute the attacker's code. The vulnerability requires network access and user interaction but does not demand special privileges to exploit.

• CVE-2026-8310MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in Webbeyaz Web Design's Mediküm Web product. An attacker can craft a malicious link that, when clicked by a user, executes arbitrary JavaScript in the victim's browser within the context of the Mediküm Web application. This allows theft of session cookies, credential harvesting, or malware injection. The vulnerability affects all versions through 08072026. Notably, the vendor has indicated the product is no longer supported, meaning no patches are expected.

• CVE-2026-8403MEDIUM 6.1

  SYSGUARD 6001, a security appliance from Eksagate Electronic Engineering and Computer Industry Trade Inc., contains a stored cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages served by the product. Once injected, these scripts execute in the browsers of users who access the affected pages, potentially stealing credentials, session tokens, or sensitive information. The vulnerability affects versions 2.0.2 through 6.1.3.x; version 6.1.4.0 and later are patched. A critical concern: the vendor has confirmed this product line is no longer supported, meaning no further security updates or vendor assistance should be expected.

• CVE-2026-8622MEDIUM 6.1

  The Image Sizes on Demand WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability affecting all versions through 1.3. An attacker can craft a malicious link that, when clicked by an administrator, executes arbitrary JavaScript in their browser session. The vulnerability stems from improper handling of the PHP_SELF server variable on the plugin's settings page, which fails to sanitize or escape user input. Because execution requires administrator interaction and is limited to admin context, the risk is moderate—but any successful attack grants the attacker the ability to perform administrative actions on the WordPress site.

• CVE-2026-8628MEDIUM 6.1

  The EntreDroppers WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into web pages. An attacker can craft a malicious URL and trick users into clicking it; when clicked, the injected script executes in the victim's browser within the context of the WordPress site. The flaw exists because the plugin fails to properly sanitize and escape the PHP_SELF variable, which is directly reflected into HTML form attributes without protection. All versions through 1.1.2 are affected.

• CVE-2026-8905MEDIUM 6.1

  The Osiris Signature Banner plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting all versions up to and including 0.5. An attacker can craft a malicious link or webpage that, when clicked by a logged-in site administrator, allows the attacker to change plugin settings and inject malicious scripts into the site without the administrator's knowledge or consent. The attack requires social engineering—tricking an admin into clicking a link—but once successful, it can compromise site integrity and inject persistent malicious content.

• CVE-2026-8907MEDIUM 6.1

  WP-Ultimate-Map, a WordPress plugin for displaying maps, has a security flaw that allows attackers to secretly change plugin settings and inject malicious code. The vulnerability exists because the plugin doesn't properly verify that setting changes are legitimate (a technique called CSRF protection), and doesn't clean up user input before displaying it. An attacker can trick a site administrator into clicking a malicious link, which would silently alter map zoom levels or other settings and potentially inject JavaScript that runs when the admin visits the plugin's settings page.

• CVE-2026-8910MEDIUM 6.1

  The WP Emoticon Rating plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 1.0.1. An attacker can craft a malicious link or webpage that, when clicked by an authenticated site administrator, performs unauthorized actions—specifically updating plugin settings and injecting malicious scripts. The vulnerability stems from inadequate nonce validation, a WordPress security mechanism that prevents unauthorized automated requests. Exploitation requires social engineering; the attacker cannot directly attack the site but must trick an admin into visiting a crafted page.

• CVE-2026-8916MEDIUM 6.1

  Samsung's rlottie library—an open-source animation renderer—contains a flaw that allows attackers to write data beyond the boundaries of allocated memory buffers. The vulnerability requires local access and user interaction (such as opening a crafted animation file), but once triggered, can corrupt memory and cause the application to crash or behave unpredictably. This is classified as a medium-severity issue because exploitation requires the victim to actively engage with untrusted animation content on their own system.

• CVE-2026-9280MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in the Ad Inserter – Ad Manager & AdSense Ads WordPress plugin affecting all versions up to 2.8.15. The flaw allows attackers to inject malicious scripts into web pages by crafting a deceptive link. If a user clicks the link while viewing a page with the plugin's iframe mode enabled, the attacker's script executes in their browser. This attack requires no special permissions and relies on social engineering to succeed.

• CVE-2026-9838MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in the ICS Calendar WordPress plugin affecting all versions up to 12.0.9. An attacker can inject malicious JavaScript by crafting a specially designed link and tricking a user into clicking it. The vulnerable code path is reachable through an unauthenticated AJAX action that fails to properly sanitize user input before displaying it in the page. If successful, the injected script executes in the victim's browser with their privileges, potentially allowing the attacker to steal session cookies, perform actions on their behalf, or redirect them to malicious sites.

• CVE-2025-2669MEDIUM 6.0

  IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data contain a token validation flaw that allows privileged users to exceed their intended permissions. A user with elevated credentials can bypass authorization controls to perform unauthorized operations and access sensitive data they shouldn't be able to reach. The vulnerability requires existing elevated privileges to exploit, limiting the immediate attack surface but posing significant risk to organizations where privileged accounts may be compromised or where insider threats are a concern.

• CVE-2026-13752MEDIUM 6.0

  Snowflake CLI versions before 3.19 contain a flaw that fails to properly validate user-supplied input, allowing attackers to inject and execute arbitrary SQL commands within a user's Snowflake database session. An attacker could trick users into running malicious commands, modify repository configurations with crafted values, or compromise automation scripts to exploit this vulnerability. The risk is confined by the privileges of the affected user account—a read-only user would face lower impact than an account with write or administrative permissions.

• CVE-2026-13773MEDIUM 6.0

  IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 contain a deserialization flaw in approximately 50 auto-generated CORBA stub classes within the ogclient.jar file. When application code deserializes untrusted data using ObjectInputStream, an attacker can inject a malicious IOR (Interoperable Object Reference) string that causes the application to make outbound network connections to an attacker-controlled host. This server-side request forgery (SSRF) becomes particularly dangerous when combined with a separate flaw in IBM's Object Request Broker (ORB) that allows arbitrary class instantiation, potentially leading to remote code execution on the vulnerable JVM.

• CVE-2026-20246MEDIUM 6.0

  Cisco Umbrella Virtual Appliance contains a privilege escalation flaw in its vmadmin command-line interface. An authenticated attacker with vmadmin-level access can run specially crafted commands to gain full root privileges on the device. The vulnerability stems from insufficient input validation and requires local access and existing elevated privileges to exploit, limiting its immediate blast radius but creating a critical post-compromise risk for affected deployments.

• CVE-2026-25620MEDIUM 6.0

  A command injection flaw exists in Arista's Next Generation Firewall (NGFW) captive portal feature, allowing a high-privilege user to inject commands through what should be an encrypted password field. The vulnerability is present only in version 17.4.0. While it requires authenticated administrative access to exploit, successful attacks could compromise system integrity and confidentiality.

• CVE-2026-25621MEDIUM 6.0

  Arista's Edge Threat Management NGFW version 17.4.0 contains a weakness in how its Reports application validates user input. An authenticated attacker with high-level permissions could potentially inject malicious commands through the Reports interface, leading to unauthorized access to sensitive data or limited system integrity compromise. Earlier versions are not affected.

• CVE-2026-25622MEDIUM 6.0

  A vulnerability in Arista's Next Generation Firewall (NGFW) allows an authenticated administrator to inject arbitrary shell commands through the Captive Portal Custom Handler feature. An attacker with valid admin credentials can exploit improper input validation to execute system-level commands on the firewall, potentially compromising the security appliance itself.

• CVE-2026-25623MEDIUM 6.0

  Arista's Next Generation Firewall (NGFW) contains a command execution vulnerability in its browser-based management interface. An authenticated administrator with legitimate access to the firewall's web console can inject malicious input into the management pipeline, allowing them to execute arbitrary operating system commands on the underlying system. This bypasses normal administrative controls and grants attacker-level terminal access.

• CVE-2026-28262MEDIUM 6.0

  Dell iDRAC Tools versions before 11.4.1.0 contain a symlink-following vulnerability that allows a low-privileged user with local system access to tamper with files on the affected system. An attacker would need to already have some level of local access and user interaction to exploit this, making it a localized threat rather than a remotely exploitable vulnerability. The primary risk is unauthorized modification of system or application data rather than information disclosure.

• CVE-2026-42998MEDIUM 6.0

  OpenStack Keystone contains an authentication bypass vulnerability in its application credential system. An attacker with valid credentials can request a token while impersonating another user by manipulating the user identity in the authentication request. Keystone fails to validate that the requesting user owns the application credential being used, allowing the attacker to obtain a token attributed to a victim account. The token grants access only to projects shared between the attacker and victim, and only with roles that overlap between both users' permissions, but this is still sufficient for account takeover scenarios and audit trail manipulation.

• CVE-2026-42999MEDIUM 6.0

  OpenStack Keystone contains a critical authorization bypass vulnerability that allows any authenticated user to escalate their privileges and access resources belonging to other users or projects. The vulnerability stems from a flaw in how Keystone processes policy enforcement—it blindly merges user-supplied JSON request data into the authorization check dictionary, overwriting the trusted database-sourced security context. This means an attacker can simply inject fake user IDs or project IDs into their API request to trick the system into granting them permissions they shouldn't have. The issue affects all versions before 29.0.2 and has existed since Rocky (14.0.0).

• CVE-2026-43000MEDIUM 6.0

  An authenticated attacker with basic member-level permissions on an OpenStack Keystone project can escalate their privileges to administrator by chaining two Keystone features—application credentials and trusts—in an unintended way. The attack exploits a validation gap: when an impersonated token is created, Keystone checks the victim's stored admin role assignment in the database rather than validating against the actual permissions on the requesting token. This allows the attacker to create a trust that delegates the victim's admin privileges to themselves. The resulting admin access persists independently and can be maintained through additional credential chains, while all actions appear in audit logs under the victim's identity.

• CVE-2026-44273MEDIUM 6.0

  Dell Wyse Management Suite before version 2605 contains a default credentials vulnerability that allows a high-privileged local user to access sensitive information. An attacker already holding elevated administrative privileges on the system could use hardcoded or default credentials to bypass authentication controls and obtain confidential data stored within the management suite. This is not a network-accessible vulnerability and requires both local system access and high-level privileges to exploit.

• CVE-2026-44394MEDIUM 6.0

  OpenStack Keystone, the identity service underlying many cloud deployments, has a flaw in how it handles federated user logins through SAML2 or OpenID Connect. When a user rescopes a token (essentially asking for a new token with different permissions or projects), the system doesn't carry forward the original token's expiration time. Instead, it issues a fresh token with a standard lifetime. An attacker with valid federated credentials can exploit this by repeatedly rescoping their token just before it expires, effectively creating a token that never truly expires. This bypasses the organization's configured token lifetime policies, allowing indefinite access once initial compromise occurs.

• CVE-2026-46768MEDIUM 6.0

  A denial-of-service vulnerability exists in Oracle VM VirtualBox 7.2.8 that allows a high-privileged user with local access to crash or hang the hypervisor. The issue resides in the VMSVGA device component and requires administrator-level credentials to trigger, but when exploited, can render the virtualization platform unavailable and potentially affect guest virtual machines. The vulnerability does not compromise data confidentiality or integrity—it is purely an availability threat.

• CVE-2026-46825MEDIUM 6.0

  CVE-2026-46825 is a medium-severity vulnerability in Oracle VM VirtualBox 7.2.8 affecting the VMSVGA device driver. A user with high system privileges can modify or delete critical data within VirtualBox or data accessible through it. The vulnerability requires local access and elevated privileges to exploit, but can impact not only VirtualBox itself but also systems and data it manages. Oracle has classified this as a scope-change issue, meaning an attacker could potentially affect resources beyond VirtualBox's immediate boundary.

• CVE-2026-46877MEDIUM 6.0

  A vulnerability in Oracle VM VirtualBox version 7.2.8 allows an administrator or highly privileged user on the host system to read sensitive data from the virtual machine. The flaw is in the VMSVGA graphics device component. An attacker would need administrative-level access to the infrastructure running VirtualBox, but from that position can extract confidential information that VirtualBox can access. The vulnerability does not enable attackers to modify or delete data, nor does it crash the system.

• CVE-2026-47375MEDIUM 6.0

  NocoDB, a spreadsheet-like database-building platform, contains a SQL injection vulnerability that allows authenticated users to run arbitrary database commands. An attacker with permission to add columns can exploit the ARRAYSORT function's direction parameter to inject malicious SQL code. Once injected, the code executes both when the column is created and every time records are read from that column. This only affects Postgres databases and has been patched in version 2026.04.1.

• CVE-2026-48529MEDIUM 6.0

  GitHub MCP Server versions 0.22.0 through 1.1.1 contain a critical session isolation flaw when running in HTTP mode with lockdown mode enabled. The server caches GraphQL credentials from the first authenticated user and reuses those credentials for all subsequent users, meaning later users' lockdown-related queries execute under the initial user's permissions rather than their own. This breaks the intended access control boundary and allows users to inadvertently access resources they shouldn't see.

• CVE-2026-55748MEDIUM 6.0

  OpenStack Horizon, the web-based dashboard for OpenStack cloud infrastructure, contains a vulnerability in how it generates RC (resource credential) files for download. When an OpenStack project has a name containing shell metacharacters—such as backticks, dollar signs, or pipes—the generated script may inadvertently execute unintended commands when a user sources the RC file in their shell environment. This is a command injection risk that could be exploited if an attacker can influence or control a project name within an OpenStack deployment.

• CVE-2026-7253MEDIUM 6.0

  IBM Sterling B2B Integrator and IBM Sterling File Gateway contain a SQL injection vulnerability that requires an attacker to hold privileged user credentials. Once authenticated, a malicious insider or compromised privileged account can craft SQL statements to read, insert, modify, or delete data directly from the backend database. This is a classic database access control failure that elevates an authenticated user's power far beyond their intended scope.

• CVE-2026-8658MEDIUM 6.0

  A command injection flaw in Rapid7's InsightConnect Tcpdump Plugin allows authenticated users with high-level privileges to run arbitrary system commands on Linux servers. The vulnerability exists because user-supplied options and filter parameters aren't properly sanitized before being passed to shell commands. An attacker with administrative or equivalent access to InsightConnect could exploit this to execute malicious code with the privileges of the plugin process.

• CVE-2026-8659MEDIUM 6.0

  A security flaw in Rapid7 InsightConnect's SQLmap plugin allows authenticated users with administrative privileges to run arbitrary commands on affected Linux systems. The vulnerability exists in how the plugin processes connection configuration parameters—specifically the api_host and api_port fields—without properly validating or sanitizing the input. An attacker with legitimate access to the InsightConnect platform could exploit this to execute unintended system commands on the underlying Linux host, potentially compromising system integrity or confidentiality.

• CVE-2026-8663MEDIUM 6.0

  A flaw in Rapid7's InsightConnect RPM Plugin for Linux allows authenticated users to run arbitrary commands on affected systems. The vulnerability stems from the plugin's failure to properly sanitize user input when constructing shell commands—specifically in how it handles repository names, package keys, and package names. An attacker with valid credentials could exploit this to execute unauthorized operating system commands, potentially compromising system integrity or accessing sensitive data.

• CVE-2026-8664MEDIUM 6.0

  A command injection flaw in the Rapid7 InsightConnect Finger Plugin allows authenticated users with high privileges to inject arbitrary operating system commands through the user or host input fields. An attacker with admin or elevated access could exploit insufficient input validation to execute unauthorized commands on the underlying Linux system, potentially compromising system integrity or accessing sensitive data.

• CVE-2017-20240MEDIUM 5.9

  Crypt::PBKDF2, a Perl cryptographic library used to derive secure keys from passwords, contains a timing-based side-channel vulnerability in versions before 0.261630. The library uses a simple string comparison (eq) to verify derived keys, which executes at different speeds depending on how many characters match between the input and the correct value. An attacker on the network can measure these timing differences to gradually narrow down the correct key without needing the password itself.

• CVE-2023-52951MEDIUM 5.9

  Synology Note Station Client versions before 2.2.4-703 transmit user credentials in cleartext over the network, allowing attackers positioned to intercept traffic—such as those on the same Wi-Fi network or controlling network infrastructure—to capture login credentials. This is a network-based credential theft vulnerability that does not require authentication or user interaction to exploit, though the attacker must be able to intercept the specific traffic.

• CVE-2023-5502MEDIUM 5.9

  Arista EOS devices configured with 802.1x authentication on network access ports have a weakness that allows a malicious user to bypass the authentication requirement under specific conditions. The vulnerability exists when 802.1x is enabled on access or trunk ports and routing is enabled on the access VLAN. An attacker could potentially gain network access without providing valid authentication credentials, though exploitation requires specific network configuration and circumstances to be in place.

• CVE-2025-12530MEDIUM 5.9

  IBM watsonx.data intelligence versions 5.2.2, 5.3.0, 5.3.1, and 5.3.1 through Patch 1 transmit sensitive data over unencrypted channels. An attacker positioned to intercept network traffic—such as on a shared network segment or through DNS/routing manipulation—could eavesdrop on communications and extract confidential information. This is a classic man-in-the-middle (MITM) vulnerability where encryption is either absent or improperly configured.

• CVE-2025-36336MEDIUM 5.9

  IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 transmit sensitive data without encryption, exposing it to interception by attackers positioned on the network path between clients and servers. An attacker could eavesdrop on this unencrypted traffic to steal confidential information. The vulnerability requires specific network conditions (high complexity attack) but affects a data intelligence platform where confidentiality breaches carry real business risk.

• CVE-2026-0061MEDIUM 5.9

  CVE-2026-0061 is a privilege escalation vulnerability in Android's WindowState component that allows an attacker to manipulate the permission-granting UI through overlay attacks (tapjacking). By displaying a malicious overlay on top of the system permission dialog, an attacker can trick users into granting sensitive permissions without explicit awareness. The critical aspect is that this requires no special execution privileges and no user interaction in the traditional sense—the attack succeeds through visual deception rather than social engineering or code execution exploits.

• CVE-2026-0075MEDIUM 5.9

  CVE-2026-0075 is a SQL injection vulnerability in Google Android's contact database access functions that allows local attackers to escalate privileges without needing special permissions or user interaction. An attacker with local access to an Android device can exploit this flaw to read, modify, or delete contact information and potentially gain elevated system privileges.

• CVE-2026-0277MEDIUM 5.9

  CVE-2026-0277 is a certificate validation flaw in Palo Alto Networks' Prisma Access Agent for iOS that allows an attacker positioned on the network to intercept and potentially manipulate VPN traffic. Because the iOS agent fails to properly validate SSL/TLS certificates, an attacker can impersonate legitimate VPN endpoints and decrypt traffic, compromising the confidentiality of data meant to be protected by the VPN. The vulnerability requires network positioning (such as on a shared Wi-Fi network or compromised network infrastructure) but no user interaction or authentication. Windows, macOS, Linux, Android, and ChromeOS variants of the Prisma Access Agent are not vulnerable.

• CVE-2026-0420MEDIUM 5.9

  NETGEAR's ReadyCloud client application contains a flaw in how it validates TLS certificates, the security handshakes that protect encrypted connections. An attacker positioned on the network path between a user and NETGEAR's servers could intercept and read sensitive data transmitted by the app—such as account credentials or cloud sync information—without being detected. The vulnerability requires specific network conditions to exploit but poses a real confidentiality risk for users relying on ReadyCloud for remote device management.

• CVE-2026-10584MEDIUM 5.9

  Graph Explorer versions prior to 3.0.1 contain a flaw in their proxy server that causes HTTPS connections to silently downgrade to unencrypted HTTP when certificate files are unavailable. An attacker positioned to intercept network traffic could potentially eavesdrop on sensitive information that was intended to be transmitted securely. This is a configuration-dependent issue—the vulnerability manifests only when certificates are missing—but the silent fallback behavior makes it particularly insidious because applications may not explicitly warn users that encryption has been disabled.

• CVE-2026-10637MEDIUM 5.9

  A vulnerability in Zephyr's IPv6 multicast listener discovery (MLD) implementation allows a remote attacker on the local network to crash the networking stack by sending specially crafted MLD queries. The flaw stems from the code attempting to read and modify packet metadata after the packet has been freed by the network driver, creating a use-after-free condition. An attacker can trigger this without authentication by sending a valid MLDv2 General Query to the device, reliably causing a denial of service.

• CVE-2026-10638MEDIUM 5.9

  A use-after-free vulnerability exists in Zephyr's ICMPv6 network stack. When the kernel sends an ICMPv6 response (such as a reply to a ping or an error message), it tries to update statistics using a packet pointer after that packet has already been freed and returned to memory. An attacker on the network can trigger this by sending a simple ICMPv6 Echo Request or crafting packets that cause IPv6 errors, causing the device to crash or potentially corrupt memory. The flaw affects Zephyr versions roughly 4.2.0 through 4.4.0 when IPv6 networking is enabled.

• CVE-2026-10852MEDIUM 5.9

  IBM WebSphere Application Server and WebSphere Application Server Liberty contain a denial-of-service vulnerability in their WebServer Plug-in component. An attacker who can send specially crafted requests to a web server running this software can cause it to become unavailable or unresponsive. The vulnerability does not allow unauthorized access to data or system compromise—it is purely an availability impact. Exploitation requires network access but no special privileges or user interaction.

• CVE-2026-11199MEDIUM 5.9

  Google Chrome versions before 149.0.7827.53 contain a flaw in how WebRTC handles network traffic that could allow an attacker positioned on the same network to steal sensitive information across website boundaries. The vulnerability requires the attacker to be in a privileged network position—such as on a shared Wi-Fi network or controlling network infrastructure—but does not require user interaction or special permissions. The risk is limited to information disclosure; the flaw cannot be used to modify data or crash the browser.

• CVE-2026-11238MEDIUM 5.9

  Google Chrome versions before 149.0.7827.53 contain a flaw in how DevTools handles extension interactions that could allow an attacker to extract sensitive data from process memory. The attack requires social engineering—convincing a user to install a malicious Chrome extension—but if successful, an attacker gains access to potentially confidential information stored in memory that the extension can observe. This is classified as a medium-severity issue despite Chromium's internal 'Low' rating, reflecting the real-world impact of memory disclosure combined with the user-interaction barrier.

• CVE-2026-11581MEDIUM 5.9

  Kali Forms, a WordPress plugin for building contact forms, contains a stored cross-site scripting (XSS) vulnerability in versions before 2.4.13. Contributors and higher-privileged users can inject malicious JavaScript into form field captions, which then executes when administrators view the form entries list. A second weakness in the plugin's duplication feature allows Contributors to publish forms without proper authorization, enabling them to distribute the malicious form to trigger the XSS in an administrator's browser session.

• CVE-2026-11788MEDIUM 5.9

  A vulnerability exists in 389 Directory Server where the dereference control plugin fails to verify that memory allocation succeeded before proceeding. An attacker on the network can trigger memory exhaustion conditions to crash the LDAP server without providing credentials. The attack requires specific environmental conditions (system memory pressure) to succeed, but no authentication is required.

• CVE-2026-12352MEDIUM 5.9

  CVE-2026-12352 is a medium-severity authentication bypass vulnerability that allows an attacker to gain access to restricted resources on a device without providing valid credentials. The attacker does not need to be an authenticated user to exploit this flaw, and no user interaction is required. While the vulnerability does not allow attackers to modify or disable systems, it does expose sensitive information to unauthorized parties.

• CVE-2026-12725MEDIUM 5.9

  A flaw in dnsmasq allows a remote attacker to crash the DNS service by sending specially crafted DNS responses. The vulnerability only triggers when two features are active together: DNSSEC validation (which verifies DNS record authenticity) and query logging (which records DNS requests and responses). When these conditions are met, responses containing unsupported algorithm types cause dnsmasq to overflow an internal memory buffer, terminating the process. This results in denial of service—your DNS resolution stops working until the service is restarted.

• CVE-2026-14062MEDIUM 5.9

  Google Chrome and ChromeOS have a weakness in how they handle certain view operations that could let an attacker steal sensitive data from your computer's memory. The attack requires two things: you'd need to install a malicious extension (add-on), and the attacker would craft that extension specifically to read data from Chrome's internal memory. This is a medium-severity issue because while memory access is serious, it requires social engineering to get you to install the extension first.

• CVE-2026-14160MEDIUM 5.9

  Samsung's Escargot JavaScript engine contains a race condition vulnerability that creates a window of opportunity between when the software checks a condition and when it acts on that check. An attacker with local access could exploit this timing gap to change file or resource attributes after the initial permission check but before the actual use, potentially bypassing security controls. The vulnerability is classified as medium severity and requires local access to exploit.

• CVE-2026-14178MEDIUM 5.9

  A memory safety issue exists in openGauss when processing timestamp conversion functions with locale (NLS) parameters. Specifically, when `to_timestamp()` is called with an NLS format parameter, the database stores formatting information in memory that gets freed after query execution. However, during result output, the code tries to access this already-freed memory, which can cause the database backend process to crash. An attacker with SQL execution privileges can deliberately construct such queries to trigger this crash repeatedly, leading to denial of service. The vulnerability affects RC releases 7.0.0-RC1 and 7.0.0-RC2 and has been fixed in 7.0.0-RC3 and later versions.

• CVE-2026-14406MEDIUM 5.9

  A flaw in Chrome's V8 JavaScript engine allows an out-of-bounds memory read when a malicious browser extension executes. An attacker would first need to trick a user into installing a malicious extension, then use it to read sensitive data directly from the browser's memory. This is classified as a medium-severity issue because it requires social engineering to deliver the extension, but once installed, it can expose potentially sensitive information without further user interaction.

• CVE-2026-15289MEDIUM 5.9

  The Booking calendar and Appointment Booking System plugin for WordPress contains a SQL injection flaw that allows unauthenticated attackers to inject malicious SQL commands. The vulnerability exists because the plugin fails to properly sanitize user input in the 'wpdevart_id' parameter. Exploitation requires the Pro version of the plugin to be installed with a specific setting ('Delete previous dates') enabled. If successfully exploited, an attacker can extract sensitive data from the WordPress database without authentication.

• CVE-2026-2379MEDIUM 5.9

  Arista EOS devices with hardware-accelerated IPSec support may experience communication instability when physical network interfaces go down or certain system components restart. During these events, IPSec tunnels re-establish, but sequence numbering can become misaligned between the two endpoints of the tunnel. This mismatch can cause packets to be rejected or processed out of order, leading to dropped connections or degraded tunnel performance. The vulnerability requires network access to trigger but does not involve packet inspection or authentication bypass.

• CVE-2026-24266MEDIUM 5.9

  NVIDIA's Triton Inference Server for Linux contains a use-after-free vulnerability that allows attackers to disrupt service availability. The flaw exists in memory management logic, where freed memory is accessed again, potentially causing the application to crash. While the attack requires specific network conditions to exploit reliably, the impact is limited to denial of service rather than data theft or system compromise.

• CVE-2026-25861MEDIUM 5.9

  QloApps versions through 1.7.0 use MD5 to hash passwords, a cryptographic method that is computationally cheap to crack. The vulnerability is particularly severe because QloApps concatenates a static value (a cookie key) with user passwords before hashing, reducing the effective randomness of the hash. When guest accounts are automatically converted to customer accounts, the system assigns simple 8-character passwords, which are trivially recoverable through offline brute-force attacks. An attacker who gains access to the password database can extract user credentials without needing to interact with the application in real time.

• CVE-2026-28116MEDIUM 5.9

  Emilia Projects Progress Planner versions 1.9.0 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows authenticated administrators to inject malicious scripts into the application. When other users view affected pages, the injected code executes in their browsers, potentially enabling session hijacking, credential theft, or further lateral movement within the application environment.

• CVE-2026-31981MEDIUM 5.9

  A stored HTML injection vulnerability in Nozomi Networks CMC and Guardian allows authenticated administrators to inject malicious HTML into configuration data. When other users view the affected data in the Diagram tab or Graph view, the injected HTML renders in their browsers. This can be used to conduct phishing attacks or redirect users to malicious sites. The vulnerability requires administrative access to exploit and user interaction (viewing the affected data) to trigger, limiting its scope but still warranting remediation in environments where admin accounts may be compromised or insider threats are a concern.

• CVE-2026-33794MEDIUM 5.9

  Juniper Networks Junos OS Evolved on PTX Series routers contain a flaw in how they process routing updates that create unified-list ECMP (equal-cost multipath) routes. An unauthenticated attacker on the network can send specially crafted, continuous routing updates that trigger an unchecked condition in the evo-aftmand process running on the Packet Forwarding Engine (PFE). This causes internal state corruption and crashes the process, forcing the router offline or requiring manual intervention to recover. The attack depends on a sequence of network conditions outside the attacker's direct control, but represents a denial-of-service risk for affected PTX platforms.

• CVE-2026-36610MEDIUM 5.9

  Mercusys AC12G (EU) V1 routers with firmware version AC12G(EU)_V1_200909 transmit Dynamic DNS (DDNS) credentials using only Base64 encoding over unencrypted HTTP connections. Base64 is not encryption—it's merely encoding and can be trivially decoded by anyone observing network traffic. Because the firmware lacks TLS/SSL support entirely, an attacker positioned on the network path can intercept and recover DDNS service credentials, potentially compromising the domain name update service tied to the affected router.

• CVE-2026-36616MEDIUM 5.9

  Mercusys AC12G (EU) V1 routers contain hardcoded credentials baked directly into the firmware. A researcher can extract a WiFi driver password, RADIUS shared secret, WPS test key, and default network password from the device's production binary. This allows someone with network access to bypass WiFi protections and potentially reach internal network resources, though the attack requires being within radio range and some technical effort to extract and use these credentials.

• CVE-2026-40991MEDIUM 5.9

  Spring REST Docs, a popular documentation tool used by developers to generate API documentation from tests, contains an XML External Entity (XXE) injection vulnerability when documenting remote APIs over HTTP. An attacker who gains control of an API being documented—or convinces a developer to document a malicious API—can inject malicious XML that executes during the documentation-generation process. The attack requires the developer to actively run their documentation tests, making social engineering or API compromise the likely attack vector.

• CVE-2026-41017MEDIUM 5.9

  Apache Airflow's JWT authentication middleware fails to mark session cookies as secure, exposing them to interception when the API server sits behind a TLS-terminating reverse proxy—a standard cloud architecture. An attacker on a shared network (public Wi-Fi, compromised LAN, or captive portal) can intercept an authenticated user's session token and replay it to gain API access. The vulnerability only materializes in specific deployment topologies where the reverse proxy strips HTTPS before forwarding to Airflow; teams running Airflow with end-to-end encryption or without reverse proxies are not affected. Apache Airflow 3.2.2 and later patch this issue.

• CVE-2026-41696MEDIUM 5.9

  Spring Data MongoDB, a widely-used persistence framework for MongoDB, contains a query injection vulnerability affecting multiple versions. When developers use the @Query annotation with regex parameter binding, the framework fails to properly validate user-supplied input. This allows an attacker to craft a malicious string that escapes the intended regex boundaries and inject arbitrary queries. The vulnerability does not currently appear on the CISA KEV catalog, but the broad version range affected and the sensitive nature of database queries make it a meaningful risk for organizations relying on Spring Data MongoDB.

• CVE-2026-41710MEDIUM 5.9

  Spring Retry, a popular Java retry library used across enterprise applications, contains a vulnerability that allows attackers to disable the retry and circuit-breaker mechanisms that applications depend on for resilience. By sending many crafted requests designed to fail, an attacker can fill the application's retry cache until it stops accepting new entries. Once saturated, the cache becomes permanently unable to process any further retries or circuit-breaker decisions, effectively breaking the fault-tolerance layer of affected applications.

• CVE-2026-41711MEDIUM 5.9

  Spring Data Commons, a widely-used data access library in the Spring ecosystem, contains a flaw in how it processes Sort parameters. An attacker can craft malicious Sort requests that cause applications to exhaust stack memory, crashing the service. This is a network-accessible denial-of-service vulnerability that requires no authentication or user interaction—any exposed endpoint accepting Sort parameters becomes an attack surface.

• CVE-2026-41721MEDIUM 5.9

  Spring Data Commons, a widely-used data access abstraction framework, contains a vulnerability that enables remote denial-of-service attacks. When Spring Data Web Support is enabled and a controller uses the @ProjectedPayload annotation, attackers can craft specific HTTP requests that force the application to consume excessive memory, degrading or halting service availability. The vulnerability requires specific configuration conditions to be present, limiting its immediate exposure but posing real risk to affected deployments.

• CVE-2026-41840MEDIUM 5.9

  Spring WebFlux applications running affected versions of Spring Framework contain a denial-of-service vulnerability triggered by specially crafted multipart requests. An unauthenticated remote attacker can exploit this to disrupt application availability without requiring special network access or user interaction. The vulnerability affects a wide range of Spring Framework versions spanning multiple release lines, making it broadly relevant to organizations using Spring-based web services.

• CVE-2026-41841MEDIUM 5.9

  Spring MVC and WebFlux applications contain a vulnerability that can leak sensitive information through improper handling of static resource requests. An attacker can craft requests to bypass normal access controls and read files that should be protected, though successful exploitation requires specific conditions. The vulnerability affects multiple Spring Framework versions across several release lines.

• CVE-2026-41843MEDIUM 5.9

  Spring Framework applications that serve static resources through MVC or WebFlux are vulnerable to path traversal attacks. An attacker can craft malicious requests to access files outside the intended static resource directory, potentially reading sensitive configuration files, source code, or other protected assets. This vulnerability affects multiple recent versions of Spring Framework across all actively maintained branches.

• CVE-2026-41846MEDIUM 5.9

  Spring Framework contains a reflected cross-site scripting (XSS) vulnerability in its JSP form tag library. When developers use Spring MVC form tags and bind user-supplied input to the cssClass, cssErrorClass, or cssStyle attributes without proper sanitization, an attacker can inject malicious HTML and JavaScript code. This code executes in the victim's browser when they view the affected page, potentially allowing credential theft, session hijacking, or other client-side attacks. The vulnerability requires user interaction (such as clicking a malicious link) to trigger.

• CVE-2026-41973MEDIUM 5.9

  CVE-2026-41973 is a permission control vulnerability affecting the calls functionality in an unspecified application. An attacker with local access to a system can exploit insufficient permission checks to read sensitive information, modify data, or disrupt service availability. The vulnerability requires no special privileges or user interaction to trigger, making it a concern for systems where local access controls are weak or where multiple users share the same machine.

• CVE-2026-42387MEDIUM 5.9

  A vulnerability in DNS recursors allows a malicious authoritative nameserver to crash the resolver by sending a specially crafted zone file. The attack requires the recursor to process the zone through its caching mechanism, but lacks proper validation of the input, triggering a denial-of-service condition. An attacker would need to control or compromise an authoritative nameserver in the DNS hierarchy to exploit this.

• CVE-2026-42388MEDIUM 5.9

  A vulnerability exists in how certain DNS systems validate SOA (Start of Authority) records within catalog zones. When an SOA record is not properly validated, it can cause the affected system to crash. This is a network-accessible issue that does not require authentication, though successful exploitation depends on specific conditions being in place. The crash results in a denial of service rather than data exposure or system compromise.

• CVE-2026-42655MEDIUM 5.9

  A flaw in the Best Payments Plugin for WordPress (versions 4.6.19 and earlier) allows attackers to bypass authentication checks without providing valid credentials. The vulnerability is rated medium severity because while it enables unauthorized actions, the conditions required to exploit it are somewhat restricted, and it does not directly expose sensitive data or cause system unavailability. Organizations using affected versions should prioritize patching, particularly if the plugin processes payment data or integrates with payment gateways.

• CVE-2026-42766MEDIUM 5.9

  A flaw in OpenSSL's CMS (Cryptographic Message Syntax) password decryption logic allows an attacker to crash applications by sending specially crafted encrypted messages. The vulnerability stems from the code not properly checking whether an optional field exists before using it, resulting in a null pointer crash and service disruption.

• CVE-2026-42767MEDIUM 5.9

  An OpenSSL vulnerability allows an attacker controlling or intercepting CMP (Certificate Management Protocol) traffic to crash client applications by sending a specially crafted certificate response. The attack exploits a code defect where OpenSSL fails to properly validate a specific field in the response, causing the application to crash and become unavailable. This is a denial-of-service issue, not a data breach or unauthorized access risk.

• CVE-2026-43625MEDIUM 5.9

  CodexBar versions before 0.32.0 have a vulnerability where session cookies imported from your browser can be intercepted over the network. When CodexBar redirects requests to Amp or Ollama providers, attackers positioned on your network path can capture these cookies if the redirect sends them over unencrypted HTTP. This requires the attacker to be on the network between you and the provider, but the leaked cookies could grant them access to your sessions on those services.

• CVE-2026-44733MEDIUM 5.9

  OpenProject, a widely-used open-source project management platform, contains a password validation flaw that allows an attacker with an active session to change another user's password without proper authorization. The vulnerability exists in how the application handles PATCH requests to the password change API endpoint. An attacker who has already compromised a user's session can exploit this to take over that account by resetting the password, effectively locking out the legitimate user. The flaw has been patched in versions 17.3.2 and 17.4.0.

• CVE-2026-45680MEDIUM 5.9

  OpenTelemetry eBPF Instrumentation versions prior to 0.9.0 contain a performance degradation vulnerability in their metrics collection pipeline. When systems experience high activity, the instrumentation replays recorded probe hits by iterating once per run count. On busy infrastructure, this run-count delta can grow very large, forcing the metrics exporter into a computationally expensive tight loop during each collection interval. The result is excessive CPU consumption that can degrade system performance. This is a denial-of-service condition rather than a confidentiality or integrity breach, but it directly impacts availability and operational efficiency.

• CVE-2026-45681MEDIUM 5.9

  OpenTelemetry eBPF Instrumentation versions prior to 0.9.0 contain a memory disclosure vulnerability triggered by CPU scheduling mismatches. When the instrumentation falls back to a 256-byte buffer but retains the original payload size marker (up to 8KB), a mismatch between CPUs can cause the code to read memory beyond the buffer boundary. This leaked memory is inadvertently captured and exported as telemetry data, potentially exposing sensitive information from adjacent kernel memory to anyone consuming the telemetry stream.

• CVE-2026-45690MEDIUM 5.9

  Nextcloud Server contains an authentication bypass flaw that lets attackers with a valid password defeat two-factor authentication (2FA). During login, the system temporarily grants a session token before asking for the second factor. An attacker who intercepts this token can replay it using HTTP Basic Authentication to access the account without providing the 2FA code. This affects Nextcloud Server versions 32.0.0 through 32.0.8 and 33.0.0 through 33.0.2, as well as older Enterprise Server branches. The vulnerability requires knowledge of the user's password, limiting opportunistic exploitation but creating a material risk for password-compromised accounts.

• CVE-2026-45691MEDIUM 5.9

  Nextcloud Server contains a session management flaw that allows attackers to bypass two-factor authentication (2FA). When a user logs in with their password but hasn't completed TOTP verification yet, a temporary session cookie is created. An attacker with legitimate credentials can capture or reuse this intermediate cookie as a Bearer token to directly access file storage endpoints (DAV), gaining unauthorized read and write access while completely circumventing the mandatory 2FA requirement. This affects Nextcloud Server versions 32.0.0–32.0.8 and 33.0.0–33.0.2, as well as several Enterprise Server releases.

• CVE-2026-46538MEDIUM 5.9

  Microsoft UFO is an open-source automation framework that lets multiple devices work together on tasks. In version 3.0.1-4-ge2626659, it has a flaw where one authenticated device can trick another device by sending a fake task completion message. When Device A receives a task from the coordinator, the system should only accept a completion message from Device A itself. Instead, the system accepts completion messages from any authenticated device as long as they use the same task ID. An attacker with legitimate access to the network can exploit this to inject false results into another device's task, potentially disrupting automated workflows.

• CVE-2026-46539MEDIUM 5.9

  Nimiq, a blockchain platform built on Rust, contains a flaw in how it verifies that transactions are genuinely included in a block. Under specific conditions—when checking a block at a particular position in the blockchain—the verification code skips its cryptographic checks entirely and simply approves the block as valid. An attacker could exploit this to forge fake block headers that would be accepted by the network without proper authentication, potentially allowing invalid transactions to be recorded on the blockchain.