By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 59 of 86

• CVE-2026-47205MEDIUM 5.9

  Envoy, a widely-deployed open source proxy for cloud-native infrastructure, contains a use-after-free defect in its authorization filter that can cause the proxy to crash. The vulnerability occurs when a request uses dynamic per-route authorization settings and the client connection closes very quickly—such as when a user rapidly refreshes a WebSocket connection to a protected endpoint. Under these conditions, Envoy's internal authorization tracking becomes corrupted, leading to a segmentation fault that terminates the affected proxy instance. This flaw affects Envoy versions 1.36.0 through 1.36.8, 1.37.0 through 1.37.4, and 1.38.0 through 1.38.2.

• CVE-2026-47221MEDIUM 5.9

  Envoy, a widely-deployed open source proxy for cloud-native applications, contains a crash vulnerability in its HTTP request routing logic. When an HTTP 303 redirect response is received on certain types of requests (POST, PUT, DELETE, PATCH without a body), Envoy attempts to process a non-existent request body, causing the entire proxy process to crash. An attacker can trigger this by sending a simple HTTP request to a vulnerable Envoy instance that is configured to handle 303 redirects internally. The result is immediate denial of service—all connections through that Envoy instance terminate. This affects versions from 1.18.0 through several recent releases, though patches are available.

• CVE-2026-47741MEDIUM 5.9

  Shopper, a headless e-commerce admin panel, had a race condition in its checkout process that allowed customers to bypass discount usage limits during high-concurrency periods like Black Friday or flash sales. The system would apply a discount to an order and save it to the database before verifying whether that discount had already been used up. If multiple customers checked out simultaneously with the same coupon, the system would grant the discount to all of them even after the coupon's limit was exceeded, because the counter-increment happened too late in the process. Merchants would not receive any warning that over-redemption had occurred, leading to undetected revenue loss.

• CVE-2026-48090MEDIUM 5.9

  Envoy, a widely-deployed service proxy for containerized environments, contains a memory-safety bug in its OAuth2 filter that can crash worker processes when handling concurrent token exchanges. The vulnerability occurs when an asynchronous token-verification operation completes after the downstream connection it serves has already closed, causing the filter code to access memory that is no longer valid. An attacker can trigger this condition remotely without authentication, leading to denial of service. The issue does not enable code execution but degrades service availability.

• CVE-2026-48497MEDIUM 5.9

  Envoy, a widely-used proxy for cloud-native applications, has a flaw in its DNS filtering that crashes the process when handling domain names of exactly 255 characters. While DNS standards allow names up to 255 octets, Envoy incorrectly requires them to be strictly shorter, causing abnormal termination when this limit is met. This affects both local and remote DNS resolution configurations. The issue is resolved in patched versions across all affected release branches.

• CVE-2026-48613MEDIUM 5.9

  A SQL injection flaw exists in phpBB's profile field migration process. When forums upgrade from older versions, user-supplied profile field data is not properly validated before being used in database queries. An authenticated attacker with specific interaction conditions could craft malicious input to execute arbitrary SQL commands, potentially exposing or modifying forum data. The vulnerability affects only forums that upgraded from versions before 3.3.8 but have not yet reached version 3.3.11 or later.

• CVE-2026-48681MEDIUM 5.9

  OpenStack Ironic, a bare-metal provisioning service, contains a directory traversal vulnerability that allows authenticated administrators to overwrite arbitrary files on the system during deployment when using a specially crafted ISO image. An attacker with high-level privileges can exploit this during the boot image creation process to alter critical system files or configuration, potentially compromising the integrity of deployed infrastructure.

• CVE-2026-48682MEDIUM 5.9

  FastNetMon Community Edition versions up to 1.2.9 contain a flaw in how it reads and interprets network packet headers. When processing IPv4 packets, the software validates that a packet has at least a minimum header size, but then makes unsafe assumptions about header field values. Specifically, it reads past the actual packet boundary when a packet header contains an unusually large size indicator, or it misinterprets packet data when that indicator is too small. This can cause the software to read memory it shouldn't access or misidentify packet contents, potentially leading to information disclosure or unexpected behavior.

• CVE-2026-48706MEDIUM 5.9

  Envoy, a widely-deployed proxy for cloud-native environments, contains a memory overflow vulnerability in its StatsD metrics sink. When Envoy formats statistics—particularly metric names derived from HTTP or gRPC request paths—it uses fixed-size 16 KB buffers. If a request path or other statistic name exceeds this size, the buffer management logic fails to safely handle the overflow, instead writing past allocated memory. An attacker sending requests with extremely long paths could crash the Envoy process or, in theory, execute arbitrary code. This affects Envoy versions 1.34.0 through 1.38.2 and requires an immediate upgrade to patched releases.

• CVE-2026-48994MEDIUM 5.9

  ImageMagick, widely used for image processing across web services and automation workflows, contains a flaw in how it handles MAT image files on 32-bit systems. When processing certain MAT files, the software fails to properly validate a function's return value, allowing an attacker to write data past the intended memory boundary. This heap buffer overwrite can crash the application or potentially allow code execution, though the latter is not guaranteed due to the attack complexity required.

• CVE-2026-49267MEDIUM 5.9

  Apache Airflow's EmailOperator and email utilities fail to validate the SMTP server's certificate when configured to use STARTTLS encryption without full SSL/TLS. This allows an attacker on the network between your Airflow worker and SMTP server to intercept the connection, inject a fraudulent certificate, and steal login credentials and email contents without detection. The risk is elevated in environments where the SMTP relay sits outside your trusted network perimeter.

• CVE-2026-49270MEDIUM 5.9

  Apache ActiveMQ brokers with network connectors configured to sync durable subscriptions are leaking sensitive metadata to unauthenticated attackers. An attacker can request a complete list of durable topic subscriptions, including client IDs, subscription names, destination topics, and JMS selector expressions—all without needing to authenticate. This occurs because the broker responds to BrokerInfo commands before validating the connection's authentication status.

• CVE-2026-49858MEDIUM 5.9

  API Platform, a popular open-source framework for building REST and GraphQL APIs, has a security flaw in how it decides what data to show to different users. The vulnerability affects versions 2.6.0 through 4.1.28, 4.2.25, and 4.3.11. When an API endpoint is protected with access rules (defined via #[ApiProperty(security: ...)] annotations), those rules should prevent lower-privileged users from seeing certain sensitive fields. However, due to a caching mechanism that doesn't properly account for per-user security settings, a less-privileged user may see the structure and names of fields they shouldn't have access to—even though they can't read the actual values. This leaks information about what properties exist in your data model that the user wasn't meant to know about.

• CVE-2026-50127MEDIUM 5.9

  Weblate, a web-based localization platform, contained a network access control bypass in its VCS_RESTRICT_PRIVATE feature. Between versions 5.15 and before 2026.6, the feature failed to properly recognize certain IPv6 address ranges, IPv4 semi-private ranges, and multicast addresses as restricted. This allowed requests from those network addresses to bypass intended private-range restrictions, potentially enabling unauthorized access to internal resources or services that should have been isolated. The vulnerability has been resolved in version 2026.6.

• CVE-2026-50202MEDIUM 5.9

  Steeltoe is a framework that helps developers build cloud-native applications on platforms like Cloud Foundry. A flaw in its JWT authentication libraries allows JWT signing keys to be cached and reused inappropriately. Specifically, when an application uses multiple authentication schemes pointing to different identity providers, a key validated for one provider could be mistakenly accepted for another. Additionally, keys remain cached indefinitely—even after a provider rotates or revokes them—until the application restarts. This creates a window where compromised or expired keys continue to grant access.

• CVE-2026-52690MEDIUM 5.9

  A DNS resolver can be tricked into believing that a legitimate authoritative nameserver doesn't support EDNS (Extension Mechanisms for DNS), a protocol feature used to transmit larger DNS responses and security information. An attacker can send spoofed DNS replies that cause the resolver to mark a server as EDNS-incapable. When this happens, DNSSEC validation—the cryptographic mechanism that verifies DNS responses haven't been tampered with—fails for records served by that nameserver. The result is that legitimate, signed DNS records become unusable, disrupting name resolution for domains relying on that server.

• CVE-2026-52714MEDIUM 5.9

  Squirrly SEO, a WordPress SEO plugin, contains a flaw that allows unauthenticated attackers to modify content or settings without proper authorization. An attacker does not need login credentials to perform certain privileged actions, bypassing the plugin's access controls. The vulnerability affects versions 12.4.16 and earlier. While the attack requires specific conditions to succeed (reflected in the CVSS score of 5.9), any unauthenticated modification capability represents a meaningful risk to site integrity.

• CVE-2026-53462MEDIUM 5.9

  ImageMagick, a widely-used open-source tool for image manipulation, contains a memory safety flaw that can crash applications processing certain malformed images. When the software attempts to allocate memory during image validation and that allocation fails, it may continue to use memory that has already been freed, leading to a denial of service. The issue affects ImageMagick versions prior to 6.9.13-50 (legacy branch) and 7.1.2-25 (current branch).

• CVE-2026-54040MEDIUM 5.9

  LibreChat versions before 0.8.4-rc1 contain a flaw in their two-factor authentication (2FA) backup code regeneration process. An attacker who obtains a victim's session token can regenerate that user's 2FA backup codes without needing to verify the user's identity through any authentication method. The attacker can then use the newly generated codes to bypass 2FA entirely or disable it altogether. This is a silent attack—the victim receives no notification that their backup codes have been replaced.

• CVE-2026-54068MEDIUM 5.9

  SiYuan, an open-source personal knowledge management system, contains an authentication bypass vulnerability in its icon retrieval API endpoint. The /api/icon/getDynamicIcon endpoint is intentionally excluded from authentication checks but executes server-side Go templates that can query the underlying SQLite database. An attacker without login credentials can exploit this by sending a specially crafted request with a known block ID to extract all of a user's notes, tags, file references, and metadata. The vulnerability affects all versions before 3.7.0 and is resolved in that release.

• CVE-2026-54286MEDIUM 5.9

  Hono, a JavaScript web framework, contains a path traversal vulnerability on Windows systems that allows attackers to bypass file access restrictions. When a request contains an encoded backslash (%5C), Windows path resolution converts it to a literal backslash character, which Windows treats as a path separator. This causes Hono's static file serving functionality to interpret a single URL segment as a nested file path, potentially exposing protected files. An attacker can craft requests to read static files that should be restricted by middleware-based access controls. The vulnerability requires specific conditions—Windows hosting and unprotected static file serving—but poses a confidentiality risk. Hono 4.12.25 and later patch this issue.

• CVE-2026-54291MEDIUM 5.9

  pgjdbc, the official PostgreSQL JDBC driver, contains a flaw in versions 42.7.4 through 42.7.11 where connections explicitly configured to require channel binding security (channelBinding=require) can be silently downgraded to a weaker authentication method. An attacker positioned to intercept TLS traffic can force this downgrade by presenting a certificate with an unsupported signature algorithm, causing the driver to drop the man-in-the-middle protection that channel binding provides. The vulnerability stems from incomplete validation: the driver checks only that the server advertises a secure mechanism but fails to reject empty or missing channel-binding data. Version 42.7.12 and later fix this issue.

• CVE-2026-54323MEDIUM 5.9

  Daytona, a platform for executing AI-generated code and running agent workflows, had a flaw in how it validated TLS certificates when cloning Git repositories. Before version 0.185.0, the daemon would accept any certificate presented by a server, even if it was forged. When a developer provided Git credentials for authentication, those credentials were sent in an HTTP Basic Authorization header over this unvalidated connection. An attacker positioned on the network could intercept the clone request, present a fake certificate, capture the credentials, and inject malicious code into the cloned repository—all transparently from the developer's perspective.

• CVE-2026-54411MEDIUM 5.9

  Linux-PAM versions up to 1.7.2 contain a timing-based weakness in the pam_userdb authentication module that allows attackers to gradually recover user passwords through careful measurement of how long authentication attempts take to fail. When pam_userdb is configured to compare passwords without encryption (plaintext mode), the module's character-by-character comparison inadvertently reveals password length and individual characters by responding faster or slower depending on where the first mismatch occurs. An attacker with repeated access to an authentication service—either locally or from the network—can exploit this to systematically guess passwords one byte at a time.

• CVE-2026-54590MEDIUM 5.9

  AsyncSSH, a Python library for SSH protocol implementation, contains a path traversal vulnerability in version 2.23.0 that allows attackers to read SSH authorized keys files from outside their intended directory. The vulnerability exists because the code blocks certain path traversal characters (/, comma, and double dots) before substitution, but fails to block tilde (~) and environment variable syntax (${ENV}), which are expanded later in the process. This allows an attacker with network access to potentially retrieve sensitive key data by crafting specially formatted authorized keys file paths. The issue has been patched in version 2.23.1.

• CVE-2026-54753MEDIUM 5.9

  Nx, a popular build and monorepo tool used by TypeScript and polyglot development teams, contains a cross-origin information disclosure vulnerability in its local development server. When developers run `nx graph` to visualize their project structure, the HTTP server it spawns returns overly permissive CORS headers that allow any website the developer visits to read sensitive data from that server—including the full project graph topology and command outputs. In rare configurations, this could escalate to arbitrary command execution. The issue affects versions 17.0.4 through 22.7.1 and early 23.0.0 beta releases.

• CVE-2026-54773MEDIUM 5.9

  CoreWCF, a .NET Core implementation of Windows Communication Foundation, contains a signature verification flaw that allows unauthenticated attackers to bypass message authenticity checks. An attacker can inject a SOAP header before the security header and trick the system into validating a forged signature instead of the legitimate one. This affects versions before 1.8.1 and 1.9.x before 1.9.1, and is primarily a message integrity issue rather than a confidentiality risk.

• CVE-2026-54779MEDIUM 5.9

  CoreWCF, a .NET Core implementation of Windows Communication Foundation, contains a flaw in its SAML token replay protection mechanism. When replay detection is enabled, the system fails to reject tokens that have already been used, allowing an attacker who intercepts a valid token to replay it multiple times. This undermines the security guarantee that tokens should only be valid once, potentially allowing unauthorized access even after the original user's session should have expired.

• CVE-2026-55199MEDIUM 5.9

  libssh2 versions through 1.11.1 contain a vulnerability that allows a malicious SSH server to exhaust CPU resources on a connecting client. During the SSH handshake, an attacker can send specially crafted data that causes the client library to enter an intense processing loop lasting over 60 seconds, effectively freezing the application. This occurs because the library doesn't properly validate server responses and timeout protections don't apply to CPU-intensive operations. The attacker must control the SSH server being connected to, which limits exposure but is significant for organizations connecting to untrusted or compromised servers.

• CVE-2026-55568MEDIUM 5.9

  Guzzle, a widely-used PHP HTTP client library, contains a flaw that causes proxy credentials and encrypted connection metadata to be transmitted unencrypted under specific conditions. When an application configures an HTTPS proxy expecting end-to-end encryption to that proxy, older versions of the underlying libcurl library (prior to 7.50.2) silently downgrade the connection to plain HTTP instead of raising an error. This means proxy usernames, passwords, and the details of HTTPS requests being tunneled through the proxy are exposed in cleartext on the network. The vulnerability only affects applications using Guzzle's built-in cURL handlers (the default) with https:// proxy configurations and outdated libcurl versions.

• CVE-2026-55577MEDIUM 5.9

  ImageMagick, a widely used open-source image manipulation library, contains a heap buffer overflow vulnerability in its MVG (Magick Vector Graphics) decoder. When processing specially crafted images, the decoder can write data beyond allocated memory boundaries, potentially causing the application to crash or become unstable. This flaw affects versions before 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch).

• CVE-2026-55761MEDIUM 5.9

  Portainer Community Edition has a security gap that allows unauthenticated attackers to set up a malicious administrator account or restore a backup file during the initial five-minute setup window on fresh installations. An attacker with network access can exploit this window to gain full administrative control over containerized environments managed by the vulnerable Portainer instance.

• CVE-2026-55950MEDIUM 5.9

  Erlang/OTP's DTLS (Datagram Transport Layer Security) implementation contains a race condition that allows an unauthenticated attacker to crash all active DTLS connections on a server listener by sending rapid reconnection attempts from the same network address. The vulnerability exploits a timing gap in how the shared connection router (demux process) handles concurrent client reconnections, causing it to crash in a way that brings down every session on that listener, not just the attacker's connection. This creates a denial of service affecting all clients simultaneously.

• CVE-2026-56007MEDIUM 5.9

  A stored cross-site scripting (XSS) vulnerability exists in OceanWP's Ocean Product Sharing plugin through version 2.2.2. An attacker with administrative privileges can inject malicious scripts into product sharing features that persist in the database and execute in the browsers of other users who view the affected content. This allows the attacker to steal session tokens, deface pages, or perform actions on behalf of legitimate users.

• CVE-2026-56009MEDIUM 5.9

  Bricksable, a plugin for the Bricks Builder page builder, contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with elevated privileges to inject malicious scripts. These scripts are then executed in the browsers of other users who view the affected pages or content. The vulnerability affects Bricksable versions up to and including 1.6.83.

• CVE-2026-56016MEDIUM 5.9

  CGI::Session::ID::md5 versions before 4.49 contain a critical flaw in how session identifiers are generated. Instead of using cryptographically secure random sources, the library constructs session IDs from three predictable inputs: the process ID, the current time, and Perl's built-in rand() function. An attacker who understands this algorithm can predict valid session IDs and hijack user sessions without knowing credentials, effectively bypassing authentication entirely.

• CVE-2026-57022MEDIUM 5.9

  Juniper Networks Junos OS running on certain MX and SRX platforms contains a flaw in how the Packet Forwarding Engine handles exceptional network conditions. An attacker on the network can send a specially crafted packet to an affected device, causing the forwarding engine to crash and restart. During this restart, all traffic and services stop working until the system recovers automatically. This vulnerability requires the device to initiate an outbound connection to the attacker first, which limits exploitability but remains a concern for devices that perform active network operations like traffic inspection or probing.

• CVE-2026-57030MEDIUM 5.9

  Juniper SRX Series firewalls contain a race condition in their packet forwarding engine that can be exploited by sending specially crafted network traffic to cause denial of service. The bug occurs during flow session cleanup—normally flows are removed after 3 seconds of inactivity, but a timing issue can cause the timeout to be set to over 10,000 seconds instead. This prevents flows from being cleaned up properly, causing session tables to accumulate stale entries until the device either stops forwarding traffic entirely or crashes and reboots.

• CVE-2026-57082MEDIUM 5.9

  Net::BitTorrent, a Perl library for BitTorrent protocol support, uses Perl's standard random number generator to create encryption keys for the Message Stream Encryption (MSE) handshake. This is a cryptographic mistake: Perl's rand() is designed for non-security purposes and is entirely predictable once an attacker observes a single connection. An attacker passively listening to the network handshake can recover the encryption key used to protect the subsequent traffic, allowing them to decrypt communications that should be obfuscated from passive observation.

• CVE-2026-57722MEDIUM 5.9

  ShortPixel's Enable Media Replace plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with elevated privileges to inject malicious scripts into web pages. Unlike reflected XSS, stored XSS persists in the application, meaning the attack payload remains in the database and executes automatically whenever affected pages are viewed. This affects all versions through 4.2.1. An attacker would need administrative or editor-level access to inject the payload, but once stored, any user—including site visitors—viewing the compromised content could be affected.

• CVE-2026-57943MEDIUM 5.9

  LibrePhotos versions before 1.0.0 contain an authorization flaw that lets authenticated users view other people's private photos. The vulnerability exists in the SetPhotosShared endpoint, where the application fails to properly verify that only a photo's owner can change who it's shared with. An attacker with a valid LibrePhotos account can manipulate the sharing settings to grant themselves access to private photos belonging to any other user on the system, effectively reading arbitrary private image collections without permission.

• CVE-2026-57959MEDIUM 5.9

  Hi.Events versions through 1.9.0 contain a flaw in how promo codes are validated during ticket reservations. When a customer applies a limited-use promo code at checkout, the system checks how many times it's been used—but this check happens before a background job updates the usage counter. An attacker can exploit this timing gap by sequentially reserving multiple orders with the same restricted code. Each reservation sees the counter at zero and passes validation, even though previous reservations should have incremented it. By completing these reservations one after another (not simultaneously), attackers can redeem a single-use or limited-use promo code many times, obtaining tickets at a discount that should only apply once.

• CVE-2026-58015MEDIUM 5.9

  A security flaw in GLib's D-Bus SASL authentication allows a malicious D-Bus server to trick a client into reading arbitrary files from the system. During the DBUS_COOKIE_SHA1 authentication handshake, the server sends a cookie context parameter that the client does not properly validate. An attacker can embed path traversal sequences in this parameter to force the client to read sensitive files and leak their contents by comparing file data against cryptographic hashes. The attack requires network access and some guessing, but succeeds without user interaction.

• CVE-2026-58471MEDIUM 5.9

  GNU Wget, a widely-used command-line download utility, contains a heap buffer overflow vulnerability in how it processes filenames from remote servers when character set conversion is needed. An attacker controlling a web or FTP server could craft a malicious filename that causes Wget to write beyond allocated memory boundaries, potentially crashing the application or corrupting memory. The vulnerability requires specific conditions: the filename must need character conversion, and user interaction is typically involved (such as accepting a download prompt). The issue was introduced in the filename conversion logic and has been patched in the project's main development branch.

• CVE-2026-58472MEDIUM 5.9

  GNU Wget versions through 1.25.0 contain a critical memory safety flaw in how they process HTML attributes from remote servers. When Wget downloads a webpage containing specially crafted HTML attributes with many characters that need encoding, an internal counter can overflow. This causes the program to allocate less memory than needed, and subsequently writes data beyond the allocated buffer. An attacker can exploit this by hosting malicious HTML that triggers the overflow when Wget parses it, potentially causing the application to crash or allowing code execution in limited scenarios.

• CVE-2026-58501MEDIUM 5.9

  Zeep, a popular Python library for consuming SOAP web services, has a configuration bypass vulnerability affecting versions 4.0.0 through 4.3.2. The library includes a security setting called forbid_external designed to prevent risky automatic fetching of external resources during WSDL and XSD parsing, but this setting is not actually enforced. An attacker can bypass this protection by crafting malicious SOAP schema documents that include references to external XML resources. When a vulnerable application parses these documents, Zeep will automatically fetch attacker-controlled URLs over HTTP or HTTPS without respecting the forbid_external setting, potentially exposing sensitive information or enabling further attacks. The issue is resolved in version 4.3.3.

• CVE-2026-58580MEDIUM 5.9

  LobeChat server deployments up to version 2.2.9 contain an authorization flaw that allows authenticated users to tamper with other users' message metadata. If an attacker learns another user's message ID, they can modify that user's plugin tool settings, error states, text-to-speech configurations, and translation records. The victim would then receive corrupted or attacker-controlled content when accessing their own messages. This is a localized instance attack—it affects users sharing the same LobeChat deployment.

• CVE-2026-59924MEDIUM 5.9

  Mistune, a popular Python Markdown parser, contains a path traversal vulnerability in its Include.parse() function. When processing markdown files that reference external files via include statements, the parser fails to properly validate that included file paths remain within the intended markdown directory. An attacker can craft specially designed include paths to escape the intended directory and read arbitrary files from the system. The vulnerability affects Mistune versions prior to 3.3.0 and is resolved in version 3.3.0 and later.

• CVE-2026-59999MEDIUM 5.9

  OpenSSH versions before 10.4 contain a logic error where the DisableForwarding security setting fails to properly override the PermitTunnel setting. Administrators who configured DisableForwarding=yes expecting to block all forwarding features would find that tunnel functionality remains active if PermitTunnel was also enabled, potentially exposing the system to unauthorized network tunneling.

• CVE-2026-7850MEDIUM 5.9

  The WP Magnific Popup WordPress plugin up through version 1.0 contains a stored cross-site scripting (XSS) vulnerability in its image error handling. An authenticated user with Author-level permissions or higher can inject malicious JavaScript into image load error messages. Because the plugin fails to properly escape URLs before displaying them in the page, the injected code executes in the browsers of any site visitor, including administrators. This is a persistence risk: the malicious payload stays in the database and re-executes every time the affected page loads.

• CVE-2026-9320MEDIUM 5.9

  IBM WebSphere Application Server versions 9.0 and 8.5, along with WebSphere Liberty versions 17.0.0.3 through 26.0.0.6, contain a denial-of-service vulnerability triggered by specially-crafted network requests. An attacker can exploit this remotely without authentication to exhaust server memory, causing service degradation or outages. The vulnerability does not compromise confidentiality or integrity—its impact is purely on availability.

• CVE-2026-9678MEDIUM 5.9

  Undici, a popular Node.js HTTP client library, has a flaw in its caching mechanism that can cause it to incorrectly store and serve cached responses containing sensitive user data. The vulnerability exists when the cache interceptor is enabled in shared-cache mode and an upstream server uses improperly formatted Cache-Control directives—specifically, field names with surrounding whitespace like ` private="authorization"` instead of the standard `private="authorization"`. Because the parser preserves that whitespace, the library fails to recognize that the response should not be cached, and may serve cached authentication data to subsequent requests, potentially exposing one user's credentials or session information to another user or an unauthenticated caller. This only affects applications that have explicitly enabled shared caching, forward Authorization headers, and receive such malformed directives from upstream servers.

• CVE-2026-9679MEDIUM 5.9

  Undici, a popular Node.js HTTP client library, contains a cookie parsing flaw that incorrectly decodes percent-encoded characters in Set-Cookie headers. When applications use undici's cookie parsing functions and then forward the parsed values into HTTP response headers—a common pattern in proxies, middleware, and server-side rendering frameworks—attackers can inject malicious headers into downstream responses. This enables session hijacking, open redirects, or cache poisoning attacks. The vulnerability affects undici versions 7.0.0 through 7.27.x and 8.0.0 through 8.4.x.

• CVE-2026-9793MEDIUM 5.9

  Keycloak has a vulnerability in how it handles encrypted OpenID Connect requests. When a JWE-encrypted request object arrives, Keycloak may skip signature verification on the decrypted JSON claims, allowing an attacker to inject unauthorized claims into the OIDC authorization flow. This bypasses a key security control designed to ensure claims haven't been tampered with. The vulnerability is classified as medium severity because while it compromises data integrity, exploitation requires specific conditions and the redirect URI allowlist provides some defense-in-depth protection.

• CVE-2026-10517MEDIUM 5.8

  Clair, a container image scanning tool, has a server-side request forgery (SSRF) vulnerability in its fetcher component. When processing container manifests, Clair can be tricked into making HTTP requests to attacker-controlled URLs without proper validation. An attacker who is unauthenticated can submit a malicious manifest pointing to internal services or cloud metadata endpoints, causing Clair to reach out to those targets. When the request fails, error messages leak up to 256 bytes of the response, potentially exposing sensitive information like API credentials or internal configuration. Red Hat Quay deployments that are operator-managed are automatically protected because they enable pre-shared key (PSK) authentication by default; self-managed Clair installations without PSK are at risk.

• CVE-2026-13976MEDIUM 5.8

  A flaw in how Google Chrome handles data validation within its storage system creates a pathway for attackers who have already compromised the browser's renderer process to potentially break out of Chrome's security sandbox. The vulnerability requires an attacker to serve a specially crafted HTML page and relies on user interaction, making it a multi-step attack rather than something triggering automatically. Chrome versions before 150.0.7871.47 are vulnerable.

• CVE-2026-44046MEDIUM 5.8

  Apache APISIX contains a vulnerability in its wolf-rbac plugin that allows an attacker to inject false identity information into logs and bypass IP-based access controls. The plugin uses insufficiently trusted data sources to make security decisions, enabling an attacker to spoof their identity and potentially circumvent network-level access restrictions. This affects versions 1.2.0 through 3.16.0 and is resolved in version 3.17.0.

• CVE-2026-46447MEDIUM 5.8

  OpenStack Ironic versions before 35.0.2 contain a vulnerability that allows an attacker with elevated privileges to inject malicious iPXE boot scripts by modifying node configuration data. An attacker who can alter the driver_info or instance_info fields of a node can supply a specially crafted iPXE script that will execute during the boot process, potentially compromising the integrity of deployed systems. This attack requires authenticated access with administrative or operator-level permissions, but once achieved, can affect multiple systems across a cloud environment.

• CVE-2026-46467MEDIUM 5.8

  Dell PowerProtect Data Domain contains a flaw that causes sensitive information to be written to log files where it should not be. An attacker with local system access and limited privileges could read these logs to obtain confidential data. This is a local-access vulnerability—the attacker must already have a foothold on the affected system.

• CVE-2026-46552MEDIUM 5.8

  NocoDB, a database-as-spreadsheet application, contains a flaw in how it enforces access control for shared bases. An attacker who obtains a shared-base link identifier (xc-shared-base-id) can impersonate a legitimate viewer, enumerate the members of that database, and send invitations to arbitrary email addresses. Those invitations, when accepted, grant persistent authenticated access to the database—access that persists even if the original shared link is revoked. The vulnerability stems from the application failing to distinguish between genuine authenticated users and those accessing via a shared session, allowing the latter to perform actions restricted to real members.

• CVE-2026-46690MEDIUM 5.8

  A memory safety vulnerability exists in unbounded_spsc versions 0.2.0 and earlier, a Rust library for lock-free message passing. The flaw occurs when the sender transmutes a pointer as a value and then sends it, which can cause the receiver to read memory outside the intended bounds or incorrectly drop a reference-counted object if the sender and receiver operate concurrently. This could lead to information disclosure or denial of service. No public patches are currently available.

• CVE-2026-48821MEDIUM 5.8

  Shaarli, a self-hosted bookmarking application, has a cross-site scripting (XSS) vulnerability in its thumbnail synchronization feature affecting versions 0.16.1 and earlier. When administrators use the thumbnail update tool, the system retrieves bookmark data from the server and displays it on the page without properly cleaning the content first. An attacker who controls bookmark titles can inject malicious scripts that execute when an administrator runs the thumbnail sync. The scripts run with the administrator's permissions, potentially allowing unauthorized access to accounts, elevation of privileges, or installation of persistent backdoors. The vulnerability has been patched in version 0.16.2.

• CVE-2026-48822MEDIUM 5.8

  Shaarli, a personal bookmarking service, contains a stored cross-site scripting (XSS) vulnerability in how it processes bookmark descriptions. An authenticated attacker can craft a specially-formatted bookmark that executes malicious JavaScript in the browsers of other users who view that bookmark. The vulnerability exists because the application's sanitization logic overlooks a specific Markdown syntax variant—reference-style links—allowing dangerous protocols like javascript: to slip through unfiltered. This affects versions 0.16.1 and earlier.

• CVE-2026-48982MEDIUM 5.8

  pam_usb is a Linux authentication system that uses removable media (like USB devices) as a hardware security token. The vulnerability exists in how pam_usb creates temporary files when updating its one-time pad—a counter that prevents the same authentication credential from being reused. The flaw: the temporary file is created without atomic guarantees, meaning two processes updating the pad simultaneously could both write to the file, with the second write erasing the first. This race condition could cause authentication failures or, in a worst-case scenario, create a window where an attacker could replay a previously-used credential. The issue is resolved in version 0.9.2.

• CVE-2026-48983MEDIUM 5.8

  pam_usb is a Linux authentication tool that uses USB devices or removable media as a hardware security key. A timing vulnerability allows a local attacker with basic user privileges to manipulate how the system creates directories that store authentication data. By exploiting a narrow window between the system checking if a directory exists and actually creating it, an attacker can trick pam_usb into writing sensitive authentication tokens to a location under their control. This could expose future authentication codes or prevent legitimate users from logging in. The vulnerability was fixed in version 0.9.2.

• CVE-2026-49129MEDIUM 5.8

  Music Player Daemon (MPD) versions before 0.24.11 contain a server-side request forgery (SSRF) vulnerability in its URL-fetching code. An attacker can craft a malicious HTTP server that redirects MPD to access protocols like FTP, LDAP, or others that the application should not reach. By triggering MPD commands that fetch remote content—such as adding tracks, reading metadata, or loading playlists—an attacker can probe or interact with internal network services on vulnerable systems, potentially exposing sensitive information or enabling further attacks. No authentication is required, and the attack works over the network.

• CVE-2026-50134MEDIUM 5.8

  Hugo, a popular static site generator, contains a vulnerability in its remote resource fetching mechanism that allows attackers to bypass URL access control policies through HTTP redirects. When a Hugo site is configured to restrict which servers it can fetch content from, an attacker who controls an allowed server (or compromises its DNS) can redirect Hugo to fetch from a forbidden server instead. Hugo will follow these redirects without re-checking them against the security policy, enabling data exfiltration or content injection from otherwise blocked hosts. This affects versions 0.91.0 through 0.161.x and is resolved in 0.162.0.

• CVE-2026-53723MEDIUM 5.8

  Guzzle Services, a popular PHP library for building API clients, has a flaw in how it writes untrusted data into XML requests. When an application serializes user-supplied input as XML element text (not attributes), an attacker can inject the string `]]>` to break out of the CDATA section and insert malicious XML elements. This only affects *outgoing* requests your application sends—not responses it receives. The attacker can manipulate what the downstream service sees, potentially bypassing security boundaries, injecting privileged fields, or creating duplicate elements. The fix is available in version 1.5.3 and later.

• CVE-2026-53944MEDIUM 5.8

  Ghost, a popular Node.js-based content management system, contains a vulnerability in versions 6.0.9 through 6.21.0 that allows attackers to bypass security filters intended to prevent requests to internal services. The flaw exploits IPv6 address formats that resolve to private IPv4 addresses, enabling an attacker to potentially access or interact with backend services that should be protected from external requests. This is a network-accessible vulnerability requiring no authentication, though the direct impact is limited to integrity violations rather than data exposure or service disruption.

• CVE-2026-54250MEDIUM 5.8

  K3s, a lightweight Kubernetes distribution, contains a path traversal vulnerability in how it handles compressed etcd snapshots. When an administrator restores a backup, a maliciously crafted zip file can write files to unintended locations on the filesystem. An attacker would need to supply a malicious snapshot file and have an administrator decompress it, but the impact could include overwriting system files or creating files in sensitive directories. This has been patched in versions 1.35.3+k3s1, 1.34.6+k3s1, and v1.33.10+k3s1.

• CVE-2026-54764MEDIUM 5.8

  Traefik's ForwardAuth middleware has a header validation flaw that allows attackers to spoof authorization checks. When an attacker sends a specially crafted HTTP request with a fake HTTPS header, Traefik incorrectly forwards a port number (443) to the authentication service—even when the actual connection is plain HTTP. This mismatch can trick the auth service into granting access to users who should be blocked based on port-level restrictions. The vulnerability exists because Traefik uses the attacker-controlled header instead of the actual connection details, bypassing the trustForwardHeader safety setting that administrators may have configured.

• CVE-2026-55430MEDIUM 5.8

  Coder, a platform for provisioning remote development environments, contains a host-header validation weakness in its workspace app proxy that allows an authenticated user to redirect traffic intended for one application to a different application within the same Coder deployment. An attacker can exploit this by crafting a malicious link to a shared app and manipulating the `X-Forwarded-Host` HTTP header—something JavaScript running in a browser can do natively. The vulnerability requires specific configuration (subdomain-based app routing) and depends on the upstream infrastructure not filtering this header. Versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 fix the issue by validating the header only from trusted proxies.

• CVE-2026-55438MEDIUM 5.8

  Coder, a platform for provisioning remote development environments, contains a CORS (Cross-Origin Resource Sharing) bypass vulnerability in its workspace app proxy. The flaw allows an attacker to craft a malicious URL that tricks the CORS validation logic into approving cross-origin requests it should reject. This only works when the workspace identifier in the subdomain can be parsed as a UUID and the attacker can convince an authenticated user to visit their crafted link. The vulnerability requires subdomain-based app routing to be enabled and direct user interaction—it does not represent a silent or automatic compromise. Coder has patched this in recent maintenance releases across all supported version branches.

• CVE-2026-55599MEDIUM 5.8

  phpseclib, a widely-used PHP library for cryptographic operations and secure communications, contains a server-side request forgery (SSRF) vulnerability in how it validates X.509 certificates. When an application uses phpseclib to validate a certificate, the library automatically fetches and connects to a URL embedded in the certificate's Authority Information Access extension—without any restrictions on where that URL points. An attacker who controls a malicious certificate can force a validating server to make connections to internal resources it should never reach, such as localhost services, cloud metadata endpoints, or internal-only infrastructure. This happens by default with no configuration required, making it a dangerous insecure default.

• CVE-2026-55706MEDIUM 5.8

  A flaw in OpenBSD's serialized-line-protocol (SPPP) implementation allows attackers on an adjacent network to bypass authentication by supplying specially crafted zero-length values during the PAP (Password Authentication Protocol) exchange. The vulnerability resides in the input validation logic of the sppp_pap_input function and requires local network access but no user interaction to exploit. Successful exploitation leads to unauthorized access to authenticated services, potentially compromising confidentiality, integrity, and availability.

• CVE-2026-55767MEDIUM 5.8

  Guzzle, a popular PHP HTTP client library, has a flaw in how it validates cookie attributes. The library incorrectly permits cookies with a domain attribute that is either completely empty or contains only whitespace, after normalization. When an attacker-controlled web server sets such a malformed cookie, Guzzle stores it and then sends it to any downstream host that the application requests using the same cookie jar—regardless of domain matching rules. This cookie injection could be leveraged for session fixation or other cookie-based attacks against services downstream from the vulnerable application.

• CVE-2026-57054MEDIUM 5.8

  Juniper Networks MX Series routers running Junos OS contain a flaw in their web filtering plugin that allows attackers to bypass security controls and reach restricted web resources. The vulnerability stems from improper name or URL resolution logic—specifically, if configured to block certain destinations, a specially crafted URL request can slip past the filter and reach downstream systems that should be inaccessible. An attacker on the network does not need authentication to exploit this, making it a straightforward attack vector for network-based threats.

• CVE-2026-57323MEDIUM 5.8

  A vulnerability in Flash & HTML5 Video versions 2.11.0 and earlier allows unauthenticated attackers to access restricted resources without proper permission checks. The flaw stems from broken access control logic that fails to enforce authentication requirements, potentially exposing sensitive video content or configuration data to unauthorized parties over a network. Exploitation does not require user interaction or special privileges.

• CVE-2026-59101MEDIUM 5.8

  AutoBangumi versions before 3.2.8 contain a server-side request forgery (SSRF) vulnerability in an unprotected setup endpoint. An unauthenticated attacker can probe internal network services and systems by sending specially crafted requests to the test-downloader endpoint during the initial setup phase. The vulnerability leaks information about internal systems through error messages, allowing reconnaissance of services that should not be accessible from the internet.

• CVE-2025-36321MEDIUM 5.7

  IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 contain an HTML injection vulnerability that allows authenticated users to inject malicious HTML code into the application. When other users view the affected pages, the injected HTML executes in their browsers within the security context of the hosting site, potentially enabling credential theft, session hijacking, or malware distribution. The vulnerability requires an authenticated attacker and user interaction (viewing the injected content), but poses a meaningful risk in shared or collaborative environments.

• CVE-2026-0165MEDIUM 5.7

  CVE-2026-0165 is a medium-severity vulnerability in Android's RTCP (Real-Time Control Protocol) packet decoder that allows an attacker to read sensitive information from device memory without needing special permissions. The flaw stems from missing boundary checks that permit out-of-bounds memory access. Exploitation requires user interaction—such as accepting a call or media stream—but once triggered, the vulnerability can leak confidential data like encryption keys, authentication tokens, or other sensitive information stored in adjacent memory regions.

• CVE-2026-0269MEDIUM 5.7

  An authenticated attacker can cause a Palo Alto Networks PAN-OS firewall to reboot by sending specially crafted packets that exploit a memory corruption flaw in tunnel traffic processing. Sending multiple malicious packets repeatedly forces the firewall into maintenance mode, rendering it unavailable until manual intervention occurs. This is not a remote unauthenticated attack—the attacker must already have network access and valid credentials.

• CVE-2026-14063MEDIUM 5.7

  CVE-2026-14063 is a memory disclosure vulnerability in Google Chrome's Chromecast component that allows a local attacker to read sensitive data from the browser process. The flaw requires the attacker to be on the same network and the user to interact with malicious network traffic, but does not require elevated privileges. While individual impact is modest, this type of information leak can enable reconnaissance for more sophisticated attacks. Google rated the underlying issue as low severity, but the combination of local network access, user interaction requirement, and memory disclosure capability warrants MEDIUM priority in most enterprise environments.

• CVE-2026-20254MEDIUM 5.7

  A vulnerability in Splunk Enterprise and Splunk Cloud Platform allows low-privileged users to create malicious dashboards that steal sensitive data when viewed by administrators or power users. The attack works by injecting CSS code into dashboard styling that bypasses Splunk's security controls designed to prevent outbound connections to untrusted servers. An attacker without admin privileges can craft a specially designed 'classic' dashboard that, when opened by someone with higher permissions, silently sends sensitive information—including credentials—to a server they control.

• CVE-2026-20255MEDIUM 5.7

  Splunk Enterprise and Splunk Cloud Platform contain a vulnerability that allows low-privileged users to create malicious dashboards capable of stealing sensitive data. An attacker without admin or power user roles can craft a dashboard that bypasses URL validation protections, tricking users into sending data to external servers they control. The flaw stems from incomplete validation of URLs in the external content dialog, meaning attackers can direct requests to untrusted domains when legitimate users view the compromised dashboard.

• CVE-2026-20256MEDIUM 5.7

  A vulnerability in Splunk Enterprise and Splunk Cloud Platform allows a low-privileged user without admin or power roles to trick other users into visiting attacker-controlled websites through specially crafted dashboard links. The flaw exploits a gap in URL validation: Splunk's security check only blocks URLs starting with 'http://' or 'https://', but misses protocol-relative URLs like '//attacker.com'. When a victim clicks a malicious drill-down link in a classic dashboard, they are silently redirected without the warning dialog that normally appears for external navigation. This can lead to credential theft, malware infection, or data exfiltration if the attacker's site mimics a trusted service.

• CVE-2026-20257MEDIUM 5.7

  A vulnerability in Splunk Enterprise and Splunk Cloud Platform allows a low-privileged user to create a malicious dashboard that can steal sensitive data from higher-privileged users who view it. The attack works by bypassing security controls on dashboard styling, enabling the dashboard to send data to external websites. However, the attacker cannot trigger the theft automatically—they must trick a target into visiting the dashboard, typically through phishing. Once the target views it, their browser could leak information to attacker-controlled servers.

• CVE-2026-25624MEDIUM 5.7

  A cross-site scripting (XSS) vulnerability exists in Arista Next Generation Firewall's administrative dashboard. An attacker with administrative credentials can inject malicious code into web form fields that are then reflected back to other administrators viewing the dashboard, potentially allowing them to steal session tokens, modify firewall rules, or perform other administrative actions on behalf of legitimate users. This is a stored or reflected XSS issue that requires an attacker to have already compromised an admin account or trick an admin into clicking a malicious link.

• CVE-2026-31267MEDIUM 5.7

  Mercusys MW302R routers running firmware version 1.4.10 (build 231023) contain a buffer overflow flaw in the administrative web interface that allows authenticated administrators to crash the device. An attacker with admin credentials can send a specially crafted request that overwrites memory on the stack, causing the router to stop functioning. This is a denial-of-service issue—the attacker cannot steal data or gain higher privileges, but they can disrupt network operations by making the router unavailable.

• CVE-2026-35067MEDIUM 5.7

  Dell PowerFlex Manager versions before 5.1.0.1 contain a flaw in how access is controlled that could allow someone already on your network with limited user privileges to gain higher-level administrative access or view sensitive data they shouldn't see. An attacker would need to be on the same network segment as the system and have at least basic user credentials to attempt this attack.

• CVE-2026-35069MEDIUM 5.7

  Dell PowerFlex Manager versions before 5.1.0.1 contain a SQL injection flaw that allows a low-privileged attacker on the same network to inject malicious SQL commands. This could enable script injection attacks, potentially compromising data confidentiality or system integrity depending on the attacker's follow-up actions. The vulnerability requires adjacent network access and valid credentials to exploit, which limits its immediate exposure but remains a real risk in internal environments.

• CVE-2026-40425MEDIUM 5.7

  A vulnerability in the Danelec MacGregor Voyage Data Recorder web interface allows an authenticated administrator to directly modify sensitive authentication-related files on the system. This could enable an attacker with admin credentials to alter the root password and gain elevated system control. While exploitation requires existing administrative access, the ability to change root credentials represents a critical privilege escalation path that should be addressed promptly.

• CVE-2026-40639MEDIUM 5.7

  Dell Client Platform BIOS contains a weakness in how it encodes passwords, allowing an attacker with physical access to a machine to bypass authentication controls and gain elevated privileges. This is not a remote vulnerability—an attacker must have hands-on access to the device. The risk is real but requires a meaningful obstacle (physical presence) that limits the pool of potential attackers in most enterprise environments.

• CVE-2026-40989MEDIUM 5.7

  Spring Cloud Function versions across multiple release lines contain a flaw in the routing layer that can trigger infinite recursion during request handling. This recursion exhausts available memory, causing an out-of-memory (OOM) error that crashes the application. The vulnerability requires either physical access to the system or authenticated local access to exploit, which limits its immediate risk in cloud-native deployments but remains a concern for containerized environments or systems with weak internal network segmentation.

• CVE-2026-40990MEDIUM 5.7

  A resource exhaustion flaw exists in Spring Cloud Function that allows an attacker to trigger out-of-memory (OOM) errors by registering an excessive number of functions in the Function Registry. The vulnerability requires local or adjacent network access and user interaction, making it a medium-severity concern primarily affecting development and hybrid deployment environments. Multiple versions across Spring Cloud Function 3.2 through 5.0 are vulnerable.

• CVE-2026-41918MEDIUM 5.7

  RUGGEDCOM RST2428P industrial switches store sensitive configuration data in the web browser's cache when authenticated users make changes. An attacker with valid credentials and access to the same system could potentially retrieve this cached data, exposing sensitive operational information. The vulnerability affects all versions prior to V4.0.

• CVE-2026-44696MEDIUM 5.7

  OpenProject, a widely-used open-source project management platform, contains a vulnerability in how it sanitizes user-supplied CSS in formatted text fields. Versions prior to 17.4.0 fail to properly restrict CSS properties when users add styling to work package descriptions, comments, project descriptions, and news items. Any authenticated user with write permissions can inject arbitrary CSS, potentially enabling visual deception attacks, credential harvesting through fake login forms overlaid on legitimate content, or other client-side manipulation. The vulnerability requires an attacker to have valid account access and user interaction (clicking or viewing the malicious content), which limits its immediate threat scope but makes it a meaningful risk for organizations where internal users may be adversarial or where guest/contractor accounts have write access.

• CVE-2026-45359MEDIUM 5.7

  ImageMagick, a widely-used image editing library, contains a memory safety flaw in its connected components operation. When the connected-components:keep-top parameter receives an invalid value, the software can read beyond allocated memory boundaries. While the vulnerability requires specific input conditions and local system access, it may allow an attacker to extract sensitive data or crash the application. Versions 6.9.13-48 and 7.1.2-22 patch this issue.

• CVE-2026-45610MEDIUM 5.7

  WWBN AVideo, an open-source video hosting platform, contains a cross-site request forgery (CSRF) flaw that allows an attacker to disable two-factor authentication (2FA) on a victim's account without their knowledge. If a logged-in AVideo user visits a malicious website controlled by an attacker, that site can silently turn off the victim's 2FA protection in a single HTTP request. This happens because the vulnerable endpoint doesn't validate the origin of the request or require re-authentication. Once 2FA is disabled, the account becomes significantly easier to compromise if credentials are later leaked or guessed.

• CVE-2026-47166MEDIUM 5.7

  ImageMagick, a widely-used image editing tool, contains a memory safety flaw in its distributed caching service. An attacker with local access who can connect to the magick -distribute-cache service can trigger the server to read beyond allocated heap memory, potentially exposing sensitive data or causing a denial of service. The vulnerability affects versions before 6.9.13-48 (legacy branch) and 7.1.2-23 (current branch).