By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 61 of 86

• CVE-2026-13508MEDIUM 5.5

  Khoj AI's conversational search platform contains an authorization bypass vulnerability in its conversation sharing feature. By manipulating the conversation.agent parameter, an authenticated user can gain inappropriate access to conversations they shouldn't be able to view or modify. The vulnerability affects Khoj up to version 2.0.0-beta.28 and can be exploited remotely without additional privileges beyond basic authentication. A fix has been proposed but not yet merged into the codebase.

• CVE-2026-13750MEDIUM 5.5

  Snowflake CLI versions before 3.19 inadvertently write authentication credentials—including passwords, API tokens, and private keys—to unencrypted debug log files stored locally on a user's machine. An attacker who gains read access to these logs (either through local system compromise, misconfigured file permissions, or physical access) can extract valid credentials without needing to crack them. The risk is confined to users running affected versions who have active credentials in their CLI session. Upgrading to version 3.19 or later stops this leakage at the source.

• CVE-2026-13769MEDIUM 5.5

  AWS CLI versions before 1.44.78 (v1) and 2.34.29 (v2) create credential files with overly permissive file permissions on Unix-like systems. When a system's umask is not restrictively configured—which is the default on most Linux and macOS installations—other local users with access to the same machine can read sensitive AWS credentials that the CLI writes to disk. This affects three specific CLI subcommands: aws codeartifact login, aws iam create-virtual-mfa-device, and aws deploy register. An attacker with local system access could steal these credentials and use them to access AWS resources.

• CVE-2026-13914MEDIUM 5.5

  Google Chrome on macOS contains a vulnerability in its password handling that could allow a local attacker to read sensitive data from the browser's memory if the user interacts with a specially crafted file. The vulnerability affects Chrome versions before 150.0.7871.47 on Mac systems. An attacker would need local access to the affected system and require user interaction to trigger the vulnerability, but no special privileges are needed to exploit it.

• CVE-2026-13929MEDIUM 5.5

  A flaw in Google Chrome's Developer Tools on Android lets a local attacker trick the browser into ignoring certain navigation restrictions by supplying a malicious file. The attacker needs physical or local access to the device and user interaction (like opening a file), but doesn't require elevated permissions. The impact is limited to unauthorized navigation—not data theft or system crashes—making this a moderate-severity issue.

• CVE-2026-14607MEDIUM 5.5

  CVE-2026-14607 is a memory corruption vulnerability affecting RT-Thread versions up to 5.0.2. The flaw exists in the sys_getaddrinfo function and can be triggered by manipulating the ai_addr argument during local system calls. An attacker with local access can crash the system or trigger undefined behavior through memory corruption. Exploit code has been publicly released, increasing the practical risk despite the medium CVSS score.

• CVE-2026-14867MEDIUM 5.5

  PcVue projects store built-in user credentials in an insecure manner within the User directory. A local attacker with limited system access can retrieve these credentials without elevated privileges. Active Directory-integrated accounts are unaffected. The vulnerability exists in all versions before 17.0.0.

• CVE-2026-14868MEDIUM 5.5

  PcVue, a SCADA/industrial automation platform by ArcInfo, uses weak encryption to protect user account configuration data stored locally in project files. An attacker with local access to a system running PcVue can exploit this weakness to decrypt and modify account settings, potentially escalating their privileges within the application. All versions before 17.0.0 are affected. This is a local-only risk that requires an existing account on the machine, but the consequences—unauthorized administrative access to an industrial control interface—are serious.

• CVE-2026-15163MEDIUM 5.5

  Wireshark, a widely-used network traffic analysis tool, contains multiple bugs in its protocol dissectors—the components that interpret different network protocols—that can cause the application to loop infinitely when processing specially crafted packets. An attacker or malicious file can trigger these infinite loops, freezing Wireshark and making it unresponsive until the process is forcibly terminated. This affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. The vulnerability requires user interaction (opening a malicious capture file or analyzing a malicious packet stream) but does not allow data theft or system compromise—only denial of service.

• CVE-2026-15164MEDIUM 5.5

  A crash vulnerability exists in Wireshark's ciscodump utility affecting versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. The flaw can be triggered locally by an unprivileged user through user interaction, causing the application to crash and denying service to legitimate users. This is a moderate-severity issue with no code execution or data exposure risk.

• CVE-2026-15165MEDIUM 5.5

  Wireshark versions 4.6.0 through 4.6.6 contain a flaw in how they process TLS Encrypted Client Hello (ECH) data that can cause the application to crash when a user opens a maliciously crafted network capture file. This is a denial-of-service issue—an attacker cannot steal data or gain control of your system, but they can disrupt your ability to analyze network traffic. The vulnerability requires user interaction (opening a file) and only affects your local machine.

• CVE-2026-15166MEDIUM 5.5

  Wireshark, a widely-used network traffic analysis tool, contains a flaw in its IEEE 802.11 wireless protocol parser that can cause the application to crash when processing specially crafted network packets. The vulnerability affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. An attacker who can trick a user into opening a malicious packet capture file or viewing live traffic on a compromised network could trigger a denial of service, forcing the analyst to restart their investigation. While the impact is localized to availability rather than exposing sensitive data, this disruption can interfere with incident response workflows and network troubleshooting.

• CVE-2026-15169MEDIUM 5.5

  A vulnerability in Wireshark's UMTS FP protocol dissector can cause the application to crash when processing malformed network packets. This affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. An attacker could exploit this by crafting a specially designed UMTS packet that, when analyzed by Wireshark, triggers a denial of service condition, rendering the packet analysis tool temporarily unavailable.

• CVE-2026-15170MEDIUM 5.5

  Wireshark, the widely-used network analysis tool, contains a flaw in how it processes Z39.50 protocol traffic that can cause the application to crash. An attacker or malicious network traffic could trigger this crash, disrupting network troubleshooting and monitoring operations. This affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. The vulnerability requires local access and user interaction to exploit, limiting its attack surface.

• CVE-2026-15171MEDIUM 5.5

  Wireshark, the widely-used network packet analyzer, contains a flaw in its SSH protocol dissector that causes the application to crash when processing certain malformed SSH traffic. An attacker or adversary could exploit this by crafting specially malicious SSH packets that, when analyzed by a vulnerable Wireshark instance, would trigger a denial-of-service condition. The issue affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. While the vulnerability requires local user interaction (opening a file or live capture), it does not lead to data theft or system compromise—only application failure.

• CVE-2026-15172MEDIUM 5.5

  Wireshark, a widely-used network traffic analysis tool, contains a flaw in how it processes FMP/NOTIFY protocol packets. When a user opens a specially crafted network capture file or views malicious traffic, the dissector (the component that parses the protocol) crashes, causing Wireshark to stop responding. This is a local denial-of-service issue affecting versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. An attacker would need to deliver a malicious capture file or convince a user to analyze untrusted network traffic, but no special privileges are required on the target system.

• CVE-2026-15174MEDIUM 5.5

  Wireshark, a widely-used network packet analyzer, contains a flaw in its Catapult DCT2000 protocol dissector that can crash the application when processing malformed network packets. An attacker or malicious network traffic could trigger this crash, effectively denying service to anyone relying on Wireshark for network analysis. The vulnerability affects versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. Users outside these ranges are unaffected.

• CVE-2026-20259MEDIUM 5.5

  A vulnerability in Splunk Enterprise and Splunk Cloud Platform allows authenticated users with the `edit_saved_search_owner` capability to reassign ownership of saved searches to any user, including those outside their normal scope of access. The affected endpoint lacks proper authorization checks, creating an avenue for privilege escalation or lateral movement within Splunk deployments. The vulnerability requires an authenticated attacker with a specific high-privilege role, limiting but not eliminating risk in environments where role delegation is common.

• CVE-2026-20456MEDIUM 5.5

  A flaw in MediaTek's wireless LAN driver allows an authenticated local user to crash the system without any user interaction. The vulnerability stems from missing boundary validation in the wlan STA (Station) driver code, permitting an attacker with user-level access to send crafted input that causes an out-of-bounds write. The impact is denial of service—the device becomes unresponsive until rebooted.

• CVE-2026-21017MEDIUM 5.5

  A privilege-escalation vulnerability exists in Samsung's SecTelephonyProvider component affecting multiple Android devices. A local attacker with basic user privileges can exploit improper access controls to read sensitive files that should be restricted to system-level processes. This is a local-only attack—the attacker must already have some access to the device—but once exploited, it can expose confidential data. Samsung addressed this flaw in the June 2026 SMR (Security Maintenance Release) 1.

• CVE-2026-21025MEDIUM 5.5

  A privilege assignment flaw in Samsung's Telephony component allows local users to read sensitive information on affected Android devices. The vulnerability requires an attacker to already have local access to the device—meaning physical possession or a compromised app—but does not let them modify data or crash the system. Samsung addressed this in the June 2026 Security Maintenance Release 1 (SMR Jun-2026 Release 1).

• CVE-2026-21026MEDIUM 5.5

  SpriteWallpaper, a Samsung Android component, contains a flaw that allows local attackers to read sensitive information stored within the application. The vulnerability stems from improper export of application components—essentially, the app fails to adequately restrict access to data that should be private. An attacker with local device access can exploit this to view confidential information. This is a moderate-severity issue that affects multiple Samsung Android releases prior to the June 2026 Security Maintenance Release (SMR) update.

• CVE-2026-21028MEDIUM 5.5

  A flaw in Samsung's AuditLogService component fails to properly restrict access to sensitive information, allowing local users with basic device access to read data they shouldn't be able to see. The vulnerability is present in Android releases prior to June 2026 Security Maintenance Release 1 and has a moderate severity rating.

• CVE-2026-21036MEDIUM 5.5

  Samsung Internet prior to version 30.0.0.39 contains an authorization flaw that allows a local attacker—someone already with access to the device—to read sensitive information they shouldn't have permission to access. The attacker doesn't need to interact with the user or have elevated system privileges, but they do need to have at least basic local access. This is a confidentiality risk, not a data-destruction or service-disruption issue.

• CVE-2026-21038MEDIUM 5.5

  CVE-2026-21038 is a memory access vulnerability in Samsung's Android USB Driver for Windows. A locally authenticated user can trigger improper input validation to read sensitive data from memory outside the bounds of allocated buffers. The vulnerability requires local access and an authenticated session but does not require user interaction. It affects confidentiality but not integrity or availability.

• CVE-2026-28237MEDIUM 5.5

  AMD uProf, a performance profiling tool used by developers and system administrators, contains a flaw in how it allocates system resources. An authenticated local user can trigger excessive resource consumption—such as memory or CPU—causing the application or system to become unresponsive or crash. This is a localized availability issue that does not expose data or allow privilege escalation, but it can disrupt legitimate work on affected machines.

• CVE-2026-28573MEDIUM 5.5

  CVE-2026-28573 is a medium-severity vulnerability in Android's manifest configuration that allows a local attacker with limited user privileges to repeatedly crash or disable Android system functionality without needing to interact with the device directly. The flaw stems from missing permission validation in the AndroidManifest.xml processing, making it trivial to exploit once an attacker gains basic system access.

• CVE-2026-28575MEDIUM 5.5

  A logic error in Android's package installation code allows a locally authenticated attacker to exhaust device memory, causing the system to become unresponsive or crash. The vulnerability exists in how the system handles file transfers during app installation and requires only local access—no special permissions or user interaction needed to trigger the denial of service.

• CVE-2026-28576MEDIUM 5.5

  A SQL injection flaw in Android's Contacts Provider allows a local attacker with basic user permissions to read sensitive contact information from the device's contacts database without needing special privileges or user interaction. The vulnerability is limited to information disclosure—attackers cannot modify or delete data, but they can extract the entire contacts database contents.

• CVE-2026-28578MEDIUM 5.5

  A flaw in Android's device policy management system allows a local attacker to cause the device to become unstable or unresponsive by exploiting improper input validation in DevicePolicyManagerService. An attacker with basic user-level access can trigger this issue without user interaction, potentially disrupting device functionality. This is a local denial-of-service vulnerability with no remote attack vector.

• CVE-2026-28587MEDIUM 5.5

  CVE-2026-28587 is a local information disclosure vulnerability in Android's MmsSmsProvider component that allows an authenticated attacker to retrieve sensitive information without additional privileges or user interaction. The vulnerability stems from a missing permission check in the MmsSmsProvider.java file, potentially exposing SMS and MMS data to unauthorized local access.

• CVE-2026-3196MEDIUM 5.5

  A flaw in the virtio-snd (virtual sound device) component allows a guest operating system to trick the host hypervisor into allocating excessive memory by sending specially crafted PCM (Pulse Code Modulation) stream count requests. This can exhaust host resources and render the system unresponsive—a denial-of-service condition. The vulnerability requires local access (the attacker must be running code on the guest VM), but poses meaningful risk in multi-tenant cloud or shared virtualization environments.

• CVE-2026-32315MEDIUM 5.5

  motionEye versions before 0.44.0 store sensitive configuration files with overly permissive file access controls. Any user on the system can read the admin password hash and camera credentials from plain-text configuration files. An attacker with local access could extract these credentials, crack the password hash offline, and use it to impersonate an administrator—potentially combining this with other known flaws in motionEye to take complete control of the system.

• CVE-2026-33802MEDIUM 5.5

  A local authentication bypass in Juniper EX Series switches allows an already-logged-in user without special privileges to run a sensitive CLI command that crashes network traffic, effectively disabling the switch until it recovers on its own. The attacker must already have console or SSH access, but does not need administrative rights to cause the outage.

• CVE-2026-34657MEDIUM 5.5

  CAI Content Credentials, a library used to manage and verify digital content authenticity, contains a path traversal flaw in versions [email protected], c2pa-v0.80.1 and earlier. The vulnerability allows an attacker to write files to arbitrary locations on a system by crafting a malicious archive that, when extracted by a user, exploits insufficient pathname validation. This is a local attack requiring user interaction—an end user must actively extract or open the malicious file for the attack to succeed.

• CVE-2026-34703MEDIUM 5.5

  A flaw in Adobe InDesign versions 21.3, 20.5.3 and earlier can cause the application to crash when a user opens a specially crafted malicious file. The vulnerability stems from improper handling of null pointer references in memory, which an attacker could weaponize by distributing a booby-trapped document. While this doesn't allow an attacker to steal data or take control of your system, it does enable denial-of-service attacks that interrupt work and productivity.

• CVE-2026-34704MEDIUM 5.5

  InDesign Desktop has a vulnerability that causes the application to crash when a user opens a specially crafted malicious file. While the crash itself doesn't expose data or allow an attacker to take control of the system, it does disrupt work by forcing the application to shut down unexpectedly. Versions 21.3, 20.5.3, and earlier are affected. An attacker must trick someone into opening the malicious file—the vulnerability does not spread on its own or affect systems remotely.

• CVE-2026-34705MEDIUM 5.5

  Adobe InDesign has a memory-reading vulnerability that can expose sensitive data stored in the application's working memory. When a user opens a specially crafted file, the vulnerability allows an attacker to read beyond the intended boundaries of memory, potentially revealing passwords, encryption keys, or other confidential information. This is a local attack that requires user interaction—the victim must be tricked into opening a malicious file. The vulnerability affects InDesign versions 21.3, 20.5.3, and earlier on both Windows and macOS systems.

• CVE-2026-36907MEDIUM 5.5

  A stack overflow vulnerability exists in Bento4, a multimedia framework used for MP4 file processing. The flaw resides in how the AP4_StsdAtom component handles crafted MP4 files, allowing an attacker to trigger a denial-of-service condition by causing the application to crash. The vulnerability requires local access and user interaction (opening a malicious file), but does not allow data theft or system modification—only service disruption.

• CVE-2026-36908MEDIUM 5.5

  Bento4, a popular MP4 multimedia library, contains a stack overflow flaw that crashes applications when processing specially crafted MP4 files. An attacker can trigger this denial-of-service condition by tricking a user into opening a malicious video file. The vulnerability affects Bento4 versions before 1.8.9 and is moderately severe because it requires user interaction but can reliably disable affected services.

• CVE-2026-36910MEDIUM 5.5

  MPC-BE, a media player application, contains a flaw in how it reads MP4 video files. An attacker can craft a specially designed MP4 file that triggers an access violation when the player tries to read it, causing the application to crash. This is a local attack that requires a user to open the malicious file, but once they do, the player becomes unavailable until restarted.

• CVE-2026-36911MEDIUM 5.5

  A division-by-zero bug in MPC-BE, a popular open-source media player, can be triggered by opening a specially crafted MP4 file. The vulnerability crashes the application, denying service to the user. An attacker would need local access or the ability to trick a user into opening a malicious file, but no special privileges are required.

• CVE-2026-39031MEDIUM 5.5

  Lansweeper's credential encryption in lsrunase 2.0 and lsencrypt 2.0 relies on a weak cryptographic approach: all encrypted passwords use the same hardcoded 142-byte key derived from RC4. Because an 8-character prefix of each encrypted credential is stored unencrypted, an attacker with local system access can recover any plaintext password by performing a single SHA-1 hash and RC4 decryption—no guessing, no brute force. This is a local privilege/credential exposure issue affecting users who depend on Lansweeper for credential management on compromised or physically accessible systems.

• CVE-2026-39243MEDIUM 5.5

  decompress before version 4.2.2 contains a vulnerability that allows attackers to create hardlinks to arbitrary files on a system during archive extraction. When a malicious archive is extracted, an attacker can craft hardlink entries that point to sensitive files elsewhere on the filesystem, creating a link inside the extraction directory that shares the same underlying file. This enables the attacker to read the contents of files they shouldn't have access to, or potentially modify those files. The vulnerability requires user interaction (extracting an archive) but doesn't require elevated privileges to exploit.

• CVE-2026-40257MEDIUM 5.5

  OP-TEE, a Trusted Execution Environment for ARM processors, contains a critical memory corruption bug in its SHA-3 cryptographic implementation when using ARM Crypto Extensions. The vulnerability stems from an off-by-one error in the SHA-3 accelerated code path that triggers a heap overflow, potentially corrupting the entire TEE kernel memory. This affects deployments running OP-TEE versions 3.21.0 through 4.10.x on ARMv8.2+ platforms with SHA3 Crypto Extensions enabled. Organizations must upgrade to version 4.11.0 or disable the affected acceleration feature.

• CVE-2026-40722MEDIUM 5.5

  Yoast SEO Premium contains a missing authorization flaw that allows authenticated administrators to perform actions they shouldn't be able to perform, potentially modifying content or causing service disruption. The vulnerability affects versions up to and including 26.6. While exploitation requires administrative-level access and doesn't compromise confidentiality, it does enable unauthorized modification of system state and availability.

• CVE-2026-41047MEDIUM 5.5

  qSnapper, a snapshot management tool from Presire, contains a missing authentication control in its snapshot diff feature. This allows a local user to view sensitive information that should be restricted, even if they lack normal read permissions. The vulnerability affects versions prior to 1.3.3 and requires local system access to exploit.

• CVE-2026-41155MEDIUM 5.5

  CVE-2026-41155 is a medium-severity flaw in a GPU kernel module that allows a local attacker to interfere with secure GPU processes running on the same system. By exploiting how the kernel manages shared secure memory between GPU workloads, an attacker can either pass unauthorized data between isolated processes or deliberately corrupt GPU memory, causing image corruption and triggering hardware recovery. The vulnerability requires local access and valid user privileges, but does not enable direct data theft—the damage is primarily availability-focused.

• CVE-2026-41979MEDIUM 5.5

  CVE-2026-41979 is a permission control vulnerability in a print module that could allow an attacker with local access to modify or read sensitive data. The vulnerability requires user interaction to exploit but does not require elevated privileges beforehand. While the impact is limited to data integrity and confidentiality concerns, it represents a meaningful risk in multi-user or shared-system environments where print functionality is commonly accessed.

• CVE-2026-41980MEDIUM 5.5

  A permission control flaw in a file preview module allows unauthorized access to sensitive file contents. An attacker with local access to a system can bypass intended access restrictions and view files they should not be able to preview, potentially exposing confidential information. The vulnerability requires user interaction to trigger but does not require special privileges to exploit.

• CVE-2026-42906MEDIUM 5.5

  CVE-2026-42906 is a moderate-severity information disclosure vulnerability in Windows Shell that allows an authenticated attacker with local access to read sensitive information on a system. The flaw does not enable privilege escalation, system modification, or denial of service—it is purely about unauthorized data exposure. An attacker must already have valid login credentials and local system access to exploit it, which limits the attack surface but remains a realistic threat in environments where user account compromise is a concern.

• CVE-2026-42915MEDIUM 5.5

  Windows VMSwitch, the virtual networking component in Windows, contains a flaw in how it calculates memory buffer sizes. An attacker with local access to an affected system can exploit this miscalculation to crash the VMSwitch service, causing a denial of service. The attacker needs valid credentials to trigger the issue, so this is not a remote or unauthenticated attack vector. The vulnerability affects Windows 10, Windows 11, and Windows Server 2022/2025.

• CVE-2026-42968MEDIUM 5.5

  Windows Telephony Service contains a flaw that allows a local, authenticated user to read data from a portion of memory that the program doesn't properly protect. An attacker must already have legitimate login credentials and local system access; they cannot exploit this remotely. The leaked information could include sensitive data, but the attacker cannot modify systems or prevent them from functioning. This affects a wide range of Windows 10 and Windows 11 versions, as well as Windows Server 2012 through 2025.

• CVE-2026-42969MEDIUM 5.5

  CVE-2026-42969 is a local information disclosure vulnerability in Windows Push Notifications that affects an authorized user's ability to access sensitive data on their own system. An attacker who already has local access and user-level privileges can exploit uninitialized memory in the Push Notifications service to read information they shouldn't normally see. This is not a remote vulnerability—the attacker must already have a foothold on the machine. The issue carries medium severity because it requires pre-existing access but can leak confidential data.

• CVE-2026-42970MEDIUM 5.5

  A flaw in Windows Push Notifications can allow a user with local access to a computer to read sensitive information that should be protected. An attacker with an existing local account on the system could potentially view data in the push notification system without authorization. This is not a remote vulnerability and requires the attacker to already have some level of access to the machine.

• CVE-2026-42971MEDIUM 5.5

  A vulnerability in Windows Push Notifications can allow an authorized user on a system to access sensitive information they should not be able to see. The flaw requires local access and valid credentials, but once those conditions are met, an attacker can read confidential data without further user interaction. This is a local information disclosure issue affecting multiple Windows versions from Windows 10 through Windows 11, as well as Windows Server 2016 through 2025.

• CVE-2026-42972MEDIUM 5.5

  A flaw in Windows Hyper-V can leak sensitive information to users who already have local access to a system. An attacker with a standard user account on the machine could exploit this to read data they shouldn't be able to access. While the vulnerability requires existing local privileges, the information exposure is significant enough to warrant attention, particularly in multi-tenant or shared system environments.

• CVE-2026-42973MEDIUM 5.5

  CVE-2026-42973 is a Windows Push Notifications vulnerability that allows an authorized user on a local machine to read sensitive information they should not have access to. This is not a remote attack—an attacker must already have a valid user account on the system. The flaw exposes confidential data without modifying or disabling any systems, making it a disclosure risk rather than a system-breaking vulnerability.

• CVE-2026-4367MEDIUM 5.5

  CVE-2026-4367 is a flaw in libXpm, the X Window System image library, that allows a local attacker with basic user privileges to crash applications by crafting or providing a malformed XPM image file. The vulnerability stems from improper validation in the xpmNextWord() function, which can read memory beyond the file boundary, triggering denial of service. An attacker needs local access and user interaction (or the ability to supply a file to a vulnerable application) to exploit it.

• CVE-2026-43722MEDIUM 5.5

  A vulnerability in Apple's operating systems allows apps running on a device to access sensitive information stored in the kernel—the core of the operating system. An attacker would need to already have an app installed on the target device to exploit this issue. The vulnerability stems from insufficient validation of user-supplied input before the kernel processes it. Apple has patched this across iPhone, iPad, and Mac by improving how the system sanitizes input data.

• CVE-2026-44018MEDIUM 5.5

  Docling, a document processing library that integrates with AI systems, contains a vulnerability in how it handles METS-GBS (a specialized XML-based document archive format) files. Versions 2.45.0 through 2.90.x lack proper security checks when parsing these archives. An attacker could create a malicious METS-GBS file that, when opened by a user in an application using vulnerable Docling, could read files from the system, consume excessive memory or CPU, or crash the application. The vulnerability requires user interaction—the file must be opened—but doesn't require special privileges to trigger.

• CVE-2026-44022MEDIUM 5.5

  Docling, a document processing library, contains a path traversal vulnerability in how it handles LaTeX file inclusion commands. An attacker can craft a malicious LaTeX document that, when processed by Docling, reads arbitrary files from the system and includes them in the converted output. This affects versions 2.73.0 through 2.90.x. The vulnerability requires user interaction—someone must process the attacker-supplied LaTeX document—but once triggered, the attacker gains read access to any file the Docling process can access, potentially exposing credentials, configuration data, or other sensitive information.

• CVE-2026-44119MEDIUM 5.5

  Apache HTTP Server versions 2.4.67 and earlier contain a privilege escalation vulnerability that allows local users who can author .htaccess files to read arbitrary files with the permissions of the httpd daemon user. This is a local-only vulnerability requiring existing system access and the ability to modify .htaccess configuration files, but it can expose sensitive application data and system files to unprivileged users.

• CVE-2026-44362MEDIUM 5.5

  OP-TEE, a security-focused execution environment used in Arm-based systems, contains a flaw that bypasses protections against loading outdated or revoked code signing keys. When Trusted Applications (TAs)—sensitive code components that run in the secure environment—are loaded, the system should verify that the signing keys used haven't been revoked or rolled back to older versions. However, a bug in the key loading process discards version information, causing the system to forget it ever saw a particular key version. This allows attackers to load TAs that were signed with deliberately downgraded or revoked keys, undermining a critical security boundary. The flaw affects OP-TEE versions 3.20.0 through 4.10.x, with a fix available in version 4.11.0.

• CVE-2026-44512MEDIUM 5.5

  ONNX (Open Neural Network Exchange), a widely-used standard for sharing machine learning models across frameworks, contains a vulnerability in its version converter tool. When this tool processes a specially crafted model file—specifically one with an Upsample component that lacks the required inputs—the software crashes due to a null pointer dereference. An attacker can exploit this by distributing a malicious model file; anyone who attempts to convert it using affected ONNX versions will experience a denial-of-service condition. The vulnerability affects ONNX versions 1.9.0 through 1.21.x and is resolved in version 1.22.0.

• CVE-2026-44805MEDIUM 5.5

  A use-after-free vulnerability exists in Windows Network Controller Host Agent that allows a logged-in user to crash or hang the affected service, disrupting network configuration and management capabilities. The attacker must already have local user privileges on the system to exploit this flaw. While this is not currently known to be exploited in the wild, it represents a local denial-of-service risk that can render critical network infrastructure management unavailable.

• CVE-2026-44814MEDIUM 5.5

  A flaw in Windows Desktop Window Manager (DWM) Core Library allows an authorized local user to read memory they shouldn't have access to. The vulnerability doesn't let attackers modify data or crash the system, but it does enable unauthorized disclosure of sensitive information resident in memory. This is a local-only issue—remote exploitation isn't possible—and requires the attacker to already have user-level access to the system.

• CVE-2026-44821MEDIUM 5.5

  CVE-2026-44821 is a medium-severity memory flaw in Microsoft Office products that allows an attacker with local access to read sensitive information from memory without user interaction beyond opening a file. The vulnerability does not enable modification of data or disruption of the application, but the confidentiality risk is significant—particularly in multi-user or shared-device environments where an attacker can extract information resident in Office's memory footprint.

• CVE-2026-44885MEDIUM 5.5

  Portainer Community Edition versions 2.33.0 through 2.33.7 contain a directory traversal flaw in the backup restore function. When administrators upload a .tar.gz backup file to restore Portainer's configuration, the extraction process fails to properly validate file paths. A malicious backup archive can exploit this to write files outside the intended directory, potentially placing them anywhere on the server filesystem—for instance, in cron job directories or other sensitive locations. An attacker with high-level privileges (such as admin access) can craft a backup to inject malicious files into the host system during restoration. The vulnerability is resolved in version 2.33.8.

• CVE-2026-44918MEDIUM 5.5

  OpenStack Ironic, a service that manages bare metal computing resources, contains an authorization flaw that allows privileged users to create or modify compute nodes belonging to other projects without proper access controls. An attacker with administrative credentials in one project could gain visibility and control over infrastructure resources that should be isolated to separate projects or organizations, though they cannot read sensitive data or cause service outages directly.

• CVE-2026-45078MEDIUM 5.5

  Synapse, an open-source Matrix homeserver, contains a denial-of-service vulnerability affecting versions prior to 1.152.1. An authenticated local user can craft requests that consume excessive CPU resources, starving other legitimate requests and causing service degradation for other users. The attack requires valid credentials and local system access but does not require user interaction.

• CVE-2026-45256MEDIUM 5.5

  A permission-checking flaw in FreeBSD's thr_kill2() system call allows unprivileged local users to send signals to processes they shouldn't be able to reach. The kernel performs a permission check but ignores the result before actually delivering the signal, meaning the signal arrives even though it was denied. An attacker with local access can exploit this to stop or crash critical system processes, causing service outages. The vulnerability is made more practical because thread IDs are assigned sequentially and globally, allowing attackers to discover targets through brute-force enumeration without needing detailed system knowledge.

• CVE-2026-45287MEDIUM 5.5

  OpenTelemetry-Go versions prior to 0.0.17 contain a resource leak that causes file descriptor exhaustion. When an application repeatedly parses OpenTelemetry schema files using the `ParseFile` function, each call opens a file but fails to close it. In a long-running service, an attacker who can trigger repeated schema parsing—such as by supplying attacker-controlled file paths—can exhaust the process's file descriptor limit, forcing a denial of service. The vulnerability requires the consuming application to expose schema parsing to external input; it is not a direct remote attack vector.

• CVE-2026-45581MEDIUM 5.5

  A logging flaw in Hyperledger Fabric's Java chaincode implementation exposes TLS private key passwords in plaintext when running in chaincode-as-a-service mode with TLS enabled. Affected versions 2.3.1 through 2.5.9 write sensitive credential material to INFO-level logs, which could allow attackers with log access to extract the password and, if they also obtain the private key itself, impersonate the chaincode server. The vulnerability has been resolved in version 2.5.10.

• CVE-2026-45594MEDIUM 5.5

  CVE-2026-45594 is a medium-severity information disclosure vulnerability in Windows Application Identity (AppID) Subsystem. An attacker who already has local access to a Windows machine can exploit this flaw to read sensitive information that should not be accessible to them. The vulnerability requires the attacker to have user-level privileges and does not involve any user interaction. It affects Windows 10 and Windows 11 across multiple versions, as well as Windows Server 2016 through 2025.

• CVE-2026-45604MEDIUM 5.5

  A flaw in Windows Application Identity (AppID) Subsystem allows an already-logged-in user to read memory they shouldn't have access to, potentially exposing sensitive information. An attacker would need legitimate local credentials and active system access to exploit it. This is a local-only disclosure issue with no ability to crash the system or modify data.

• CVE-2026-45606MEDIUM 5.5

  A flaw in Microsoft's UxTheme Library (uxtheme.dll) can be exploited by a user with local access to cause a denial of service. The vulnerability stems from reading data outside the bounds of allocated memory. An attacker would need existing login credentials or physical access to the machine to trigger the issue, which could crash or hang the affected application, disrupting work but not exposing sensitive data.

• CVE-2026-45634MEDIUM 5.5

  CVE-2026-45634 is a memory reading flaw in Windows DHCP Server that allows a logged-in attacker to extract sensitive information from the system. An attacker with local access and standard user privileges can exploit an out-of-bounds read condition to leak data in memory, potentially exposing credentials, encryption keys, or other confidential information. This is not a remote vulnerability and does not enable code execution, but it can compromise the confidentiality of data stored on affected systems.

• CVE-2026-45647MEDIUM 5.5

  Microsoft Defender for Endpoint contains a time-of-check time-of-use (TOCTOU) race condition that allows an authorized local user to escalate their privileges. An attacker with valid credentials on a system running the affected software can exploit a window between a security check and a subsequent action to bypass protections and gain elevated access. This is not an unauthenticated remote attack; the attacker must already have local system access.

• CVE-2026-45676MEDIUM 5.5

  OpenTelemetry eBPF Instrumentation, a tool that uses eBPF technology to gather observability data, contains a flaw in how it parses ELF executable files. An attacker with local access can craft a malicious executable that tricks the instrumentation agent into reading invalid memory locations or accessing incorrect parts of files, causing the agent to crash. This prevents the agent from operating until it's restarted, which could disrupt monitoring visibility in affected environments. The issue affects all versions prior to 0.9.0.

• CVE-2026-45792MEDIUM 5.5

  RTK (Rust Token Killer), a tool that filters and compresses command outputs for large language models, contains a configuration trust vulnerability in versions before 0.32.0. An attacker who gains write access to a repository can place a malicious filter configuration file (.rtk/filters.toml) that automatically loads with highest priority, allowing them to silently modify or suppress command outputs—such as file contents, code diffs, or security scan results—before they reach an LLM. This could enable concealment of malicious code during AI-assisted code review or development workflows without the developer's knowledge.

• CVE-2026-46104MEDIUM 5.5

  A flaw exists in how the Linux kernel's SELinux security module accesses socket security data when multiple security modules are stacked together. The vulnerability occurs because SELinux directly reads socket security information from a hardcoded memory location, assuming it will always find its own data there. When another security module is loaded first, SELinux reads the wrong data instead, potentially using invalid security identifiers in permission checks. This can cause the kernel to crash due to invalid memory access or improper security decisions.

• CVE-2026-46106MEDIUM 5.5

  A race condition in the Linux kernel's eventfs subsystem can cause memory corruption or system crashes when users simultaneously remount the tracefs filesystem (which hosts performance monitoring tools) while creating or deleting tracepoints. The vulnerability arises because the kernel walks through a list of event structures during remount without proper synchronization, allowing concurrent operations to corrupt data structures or access freed memory. This is a local issue affecting only users with permission to remount filesystems and modify tracing events.

• CVE-2026-46108MEDIUM 5.5

  A flaw in the Linux kernel's IPMI serial interface (SI) driver can leave the system in an abnormal state when message allocation fails. Normally, failed operations trigger cleanup routines that reset the driver to a ready state. This vulnerability occurs because certain error paths skip that reset logic, potentially causing the driver to remain hung or unresponsive. An attacker with local system access could trigger memory allocation failures under specific conditions, degrading system availability until the driver is manually restarted or the system reboots.

• CVE-2026-46109MEDIUM 5.5

  A memory leak exists in the Linux kernel's USB ULPI (UTMI Low Pin Interface) driver registration code. When certain initialization steps fail early in the device registration process, allocated memory is not properly freed, allowing memory to accumulate over repeated failures. This is a residual issue from a prior fix that addressed a different memory safety problem. The vulnerability requires local access and elevated privileges to trigger.

• CVE-2026-46118MEDIUM 5.5

  A flaw in the Linux kernel's PAPR hypervisor pipe driver can cause the kernel to crash when attempting to create a device handle. The issue stems from a recent code refactoring that changed how the driver manages memory allocation and cleanup. When the driver tries to reuse a data structure after it has been cleared, the kernel attempts to access invalid memory, leading to a null pointer dereference and system panic. An unprivileged local user with ioctl access can trigger this crash, resulting in a denial of service.

• CVE-2026-46126MEDIUM 5.5

  CVE-2026-46126 is a memory cleanup bug in the Linux kernel's RDMA/mana driver that occurs during queue pair creation with RSS (Receive Side Scaling) support. When certain operations fail during setup, the kernel fails to properly release allocated work queue objects, leaving dangling resources. An unprivileged local user can trigger this condition to cause a denial of service by exhausting kernel resources or crashing the system.

• CVE-2026-46127MEDIUM 5.5

  A local memory safety issue exists in the Linux kernel's RDMA over Converged Ethernet (OCRDMA) driver. During certain error conditions in the protection domain setup function, the code attempts to dereference a null pointer instead of using a valid reference, potentially crashing the system. The vulnerability requires local access and specific user privileges to trigger, making it a moderate-severity issue affecting system stability rather than confidentiality or integrity.

• CVE-2026-46128MEDIUM 5.5

  A vulnerability in the Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem allows local authenticated users to cause a denial of service. The issue stems from insufficient validation of event message buffer responses from Baseboard Management Controllers (BMCs). Some BMCs may return empty or malformed event messages instead of proper error responses, which the kernel fails to validate immediately. This can lead to kernel crashes or hangs when processing these invalid responses. The vulnerability requires local access and authenticated privileges to trigger, limiting its immediate blast radius but requiring attention in environments where untrusted local users have system access.

• CVE-2026-46131MEDIUM 5.5

  A flaw exists in the Linux kernel's virtualization layer (KVM) where the hypervisor incorrectly validates guest memory operations in nested virtual machines. The vulnerability occurs when checking whether a guest is running nested virtualization—the code currently checks only whether an L2 guest exists, but fails to verify that nested EPT (Extended Page Tables) or NPT (Nested Page Tables) is actually enabled. This mismatch allows a local process running inside a nested guest to trigger denial-of-service conditions by invoking hypercalls that attempt invalid memory translations. The impact is limited to availability; an attacker cannot read or modify data.

• CVE-2026-46132MEDIUM 5.5

  CVE-2026-46132 is a kernel memory leak in the Linux networking subsystem that allows unprivileged local users to read up to 26 bytes of uninitialized kernel stack memory per virtual function (VF) per request. The vulnerability exists in the rtnetlink interface handler that reports virtual NIC configuration. When a user requests virtual function information, the kernel fails to zero-initialize a buffer before partially filling it with MAC broadcast data, leaving residual stack contents exposed to userspace. An attacker needs only basic local network namespace access to trigger repeated information leaks.

• CVE-2026-46134MEDIUM 5.5

  A Linux kernel vulnerability in the Chrome OS Embedded Controller (cros_ec) Thunderbolt registration code fails to initialize a mutex lock, causing the system to crash when the uninitialized lock is later accessed. This affects devices that use the affected kernel code path during Thunderbolt device registration and mode switching. An unprivileged local user can trigger the crash by interacting with Thunderbolt/USB-C functionality, resulting in a denial of service.

• CVE-2026-46139MEDIUM 5.5

  A flaw in the Linux kernel's SMB client code leaves a security descriptor buffer partially uninitialized when building access control lists. Specifically, a 2-byte reserved field in the ACL structure—which must be zero according to the SMB protocol specification—is left containing whatever garbage data happened to be in that heap memory. When Samba or other SMB servers validate the descriptor, they reject it if those bytes are non-zero, causing file permission operations like chmod to fail with an invalid argument error. The fix is straightforward: replace the memory allocation function with one that zeroes the buffer before use.

• CVE-2026-46141MEDIUM 5.5

  A memory leak vulnerability exists in the Linux kernel's PowerPC XIVE interrupt handling code. When allocating MSI-X interrupt vectors for NVMe devices, the kernel creates interrupt data structures but fails to properly clean them up when the interrupt domain is freed. This occurs because the code looks for the data in the wrong place during cleanup, causing allocated memory to be abandoned. While this is a localized memory management issue, repeated device allocation and deallocation cycles could gradually consume system memory and degrade performance.

• CVE-2026-46142MEDIUM 5.5

  A flaw in the Linux kernel's libwx network driver allows a virtual machine or container running as a non-privileged user to trigger a system hang by reading a hardware register that should only be accessible to the physical device owner. During virtual function (VF) initialization, the driver incorrectly attempts to access a restricted register (WX_CFG_PORT_ST), causing the system to hang. The issue stems from the driver not properly distinguishing between physical function (PF) and virtual function device contexts when accessing low-level hardware state.

• CVE-2026-46143MEDIUM 5.5

  CVE-2026-46143 is a memory leak vulnerability in the Linux kernel's QCOM audio subsystem. The issue occurs in the ASoC (ALSA System on Chip) driver for QCOM Q6APM LPASS audio interfaces, where the prepare function can be invoked multiple times. Each invocation opens a new graph for the playback path without checking if one is already open, resulting in cumulative resource exhaustion. While the vulnerability requires local access and low-privilege execution context, the impact is availability disruption through memory exhaustion.

• CVE-2026-46144MEDIUM 5.5

  A memory cleanup issue exists in the Linux kernel's RDMA/mana driver when creating RSS (Receive-Side Scaling) queue pairs. If an error occurs during queue pair creation, a virtual port steering configuration is not properly freed, leading to a resource leak. While this is a memory management issue rather than a direct data breach risk, it can degrade system stability under error conditions or be exploited to exhaust kernel memory resources on systems with RDMA/mana network adapters.

• CVE-2026-46146MEDIUM 5.5

  A vulnerability exists in the Linux kernel's USB audio driver that could cause the system to hang indefinitely when processing a specially crafted USB device descriptor. The flaw is in the convert_chmap_v3() function, which processes audio channel mapping information without properly validating the descriptor size field. An attacker with local access could trigger this endless loop, causing a denial of service. The issue affects multiple versions of the Linux kernel and requires local access to exploit.

• CVE-2026-46147MEDIUM 5.5

  A flaw in the Linux kernel's ARM64 KVM (virtualization) implementation can cause system resource leaks and expose partially initialized virtual CPU objects to concurrent access. When vCPU initialization encounters an error partway through, cleanup code fails to release pinned memory references, accumulating leak over time. Additionally, the vCPU object is published to shared state without proper synchronization barriers, risking observers seeing an incompletely initialized structure. This affects hypervisor deployments using ARM64-based KVM virtualization.

• CVE-2026-46148MEDIUM 5.5

  A flaw in the Linux kernel's Microchip CoreQSPI SPI controller driver causes incorrect chip select (CS) line management when multiple SPI devices are connected. The hardware's built-in CS is automatically controlled by design, but this automatic behavior conflicts with proper operation when GPIO-based chip selects are also in use. The driver was modified to manually control the CS line instead, allowing correct behavior for both active-low and active-high devices, and preventing the built-in CS from being asserted while other GPIO-controlled devices are being accessed.