By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 65 of 86

• CVE-2026-53320MEDIUM 5.5

  A flaw in the Linux kernel's NILFS2 filesystem allows a local user with basic privileges to trigger a warning condition that can degrade system stability. The issue occurs when a corrupted request to mark blocks as dirty is processed with an invalid block number of zero, which should never occur in normal operations. The kernel fails to validate this impossible condition upfront, leading to unexpected behavior downstream. While not a direct path to privilege escalation or data theft, repeated triggering could impact system reliability.

• CVE-2026-53321MEDIUM 5.5

  A flaw in the Linux kernel's io_uring network polling subsystem allows a task to monopolize CPU time without yielding control back to the scheduler. The kernel's NAPI (Network API) polling mechanism, used by io_uring to efficiently check for network events, previously had no upper limit on how long it could poll continuously. This can cause the kernel to complain that a task is stuck, degrading system responsiveness and potentially causing watchdog timeouts. The fix caps the maximum polling duration at 10 milliseconds, which is still generous for performance but low enough to prevent scheduler complaints.

• CVE-2026-53323MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's Distributed Switch Architecture (DSA) subsystem, which manages network switching hardware. When certain network drivers (like fbnic) interact with DSA, calling ethtool diagnostic commands (such as `ethtool -i`) can freeze the kernel. The root cause is that DSA's code attempts to acquire a lock that is already held by the calling function, causing the system to wait indefinitely. This affects systems that combine modern network interface cards with DSA-managed switch ports.

• CVE-2026-53324MEDIUM 5.5

  A flaw in the Linux kernel's MANA network driver causes the system to crash when creating debugfs directories for network devices. The bug stems from unsafe naming logic: the code either uses a hardcoded name that multiple devices can share, or attempts to read device slot information that doesn't exist on virtual machines and some hardware configurations. When the kernel tries to create a debugfs directory with a duplicate or invalid name, the operation fails and triggers a crash. This affects systems using the MANA (Microsoft Azure Network Adapter) driver, particularly in virtualized environments like nested KVM or generic VFIO passthrough setups.

• CVE-2026-53325MEDIUM 5.5

  A vulnerability in the Linux kernel's AMD64 AGP (Accelerated Graphics Port) driver can cause a system crash when running in virtualized environments without physical AMD hardware. The driver's probe function fails to correctly detect when the required hardware is absent, allowing initialization to proceed and eventually triggering a crash when the driver tries to access non-existent hardware. This affects systems running vulnerable kernel versions in virtual machines or cloud environments.

• CVE-2026-53326MEDIUM 5.5

  A timing vulnerability in the Linux kernel's debug object pool management can cause the system to enter a deadlock during early boot on ARM64 systems running PREEMPT_RT (a real-time kernel variant). The issue occurs when hardware interrupts fire before the scheduler is fully initialized, allowing interrupt handlers to attempt memory allocation from the debug object pool. If that interrupt happens to hit code holding a lock needed for allocation, a circular lock dependency forms, freezing the system. The fix restricts pool allocation attempts from hard interrupt context during this early boot window.

• CVE-2026-53327MEDIUM 5.5

  A flaw in the Linux kernel's debug object handling can cause a system crash when the kernel tries to replenish its internal memory pool at an inopportune moment on real-time (RT) enabled systems. Specifically, the kernel's fill_pool() function attempts to acquire a real-time lock without checking whether the current task is already blocked waiting on another lock. Real-time kernels enforce strict priority inheritance rules that prohibit a task from blocking on multiple locks simultaneously, so this condition triggers an assertion failure and brings down the system. The issue is resolved by adding a check to prevent fill_pool() from executing when a task is already in the middle of such a priority-inheritance blocking chain.

• CVE-2026-53328MEDIUM 5.5

  A logic error in the Linux kernel's scheduler extension (sched_ext) subsystem triggers a spurious warning when the systemd user manager modifies control groups while a sched_ext scheduler is running. The warning fires during legitimate internal kernel operations and does not represent an exploitable security flaw—rather, it's a false alarm that can confuse operators and trigger monitoring alerts. The underlying issue stems from a mismatch between how the kernel tracks cgroup and css (control group subsystem) identities during task migration.

• CVE-2026-53331MEDIUM 5.5

  CVE-2026-53331 is a kernel-level deadlock vulnerability in the Linux kernel's Qualcomm SlimBus controller driver. The issue occurs when the system undergoes subsystem restart (SSR) or processor domain restart (PDR) events. During these restart procedures, the driver acquires a transmit lock to protect ongoing DMA transfers, but then attempts to acquire a separate controller lock in a different order than other code paths. This lock ordering inconsistency can cause the system to deadlock, where one thread holds the transmit lock while waiting for the controller lock that another thread already holds while waiting for the transmit lock. The vulnerability has a medium severity rating and could lead to system availability disruptions.

• CVE-2026-53332MEDIUM 5.5

  A race condition in the Linux kernel's Qualcomm SLIMbus NGD controller driver can cause the system to crash or fail to boot. The issue occurs when interrupt handlers or notification callbacks try to use driver data structures that haven't been fully initialized yet. This happens because the driver registers for hardware interrupts and system event notifications before completing its internal setup. Moving the registration of these callbacks to occur after full driver initialization eliminates the race condition.

• CVE-2026-53333MEDIUM 5.5

  A logic ordering issue in the Linux kernel's memory inspection code (mincore) causes it to incorrectly report certain special memory pages as missing or unavailable on systems built without swap support but with migration or memory failure detection enabled. When the kernel checks whether a page resides in memory, it prematurely rejects these special pages before properly identifying them, triggering false warnings and inaccurate reporting. The fix reorders the checks so special pages are recognized before the swap-related restrictions apply.

• CVE-2026-53334MEDIUM 5.5

  CVE-2026-53334 is a Linux kernel memory management bug that can cause a system crash when specific DAMON (Data Access Monitoring) memory optimization features attempt to initialize. The vulnerability occurs because the kernel fails to properly check whether a critical memory allocation succeeded before attempting to use it. If that allocation fails—a theoretically possible but rare event—the kernel tries to access a null pointer, crashing the system. This affects systems where DAMON_RECLAIM or DAMON_LRU_SORT features are enabled.

• CVE-2026-53335MEDIUM 5.5

  A flaw in the Linux kernel's DAMON (Data Access Monitoring) LRU sort module fails to properly handle memory allocation failures. When the system attempts to enable DAMON LRU sort but cannot allocate memory for its context object, the code proceeds as if the allocation succeeded and then attempts to dereference a NULL pointer, causing a kernel crash. An unprivileged local user can trigger this condition to denial-of-service a system.

• CVE-2026-53336MEDIUM 5.5

  A bug in the Linux kernel's EEPROM layout driver causes the system to hang indefinitely when it encounters certain vendor-specific EEPROM entries. The driver fails to skip unknown entry types properly, leaving it stuck in an infinite loop. This affects systems that use ONIE-compliant EEPROMs with non-standard vendor extensions. The fix is straightforward: ensure the driver continues scanning through EEPROM data even when it encounters unrecognized entry types.

• CVE-2026-53337MEDIUM 5.5

  A flaw in the Linux kernel's bonding driver allows a local attacker with network administration privileges to crash the system by attempting to manage a network bond with a non-existent slave interface. The kernel fails to validate that a network interface exists before attempting to log debug information about it, triggering a NULL pointer dereference that causes a kernel panic. The attack requires CAP_NET_ADMIN capability, limiting the blast radius to administrative users or containers with elevated privileges.

• CVE-2026-53338MEDIUM 5.5

  A flaw in the Linux kernel's Airoha network driver can cause the system to crash if a device tree configuration is missing or misconfigured. When the driver initializes certain hardware queues, it looks up a reserved memory region but fails to verify that the lookup succeeded before using the result. This gap allows a local attacker or misconfiguration to trigger a kernel panic, denying service to the system.

• CVE-2026-53339MEDIUM 5.5

  The Qualcomm CCI (Camera Control Interface) I2C controller driver in the Linux kernel has a bug that causes a crash when the driver is unloaded or the device is removed. The issue occurs because the driver attempts to wait for a completion signal from I2C masters that were never properly initialized. On systems where only one of the two available I2C masters is enabled, unloading the driver triggers a NULL pointer dereference, freezing or crashing the kernel. This is a local issue affecting systems with the vulnerable driver installed.

• CVE-2026-53340MEDIUM 5.5

  A flaw exists in the Linux kernel's i2c-imx driver where the order of operations during runtime power suspension can leave the I2C hardware in an inaccessible state. Specifically, the clock is disabled before the pinctrl (pin control) state is switched to sleep mode. If the pinctrl operation fails, the suspend is aborted but the clock remains off, causing a crash when the system tries to use the I2C hardware. The fix reorders these operations so the pinctrl state changes first, ensuring the clock stays enabled if something goes wrong.

• CVE-2026-53342MEDIUM 5.5

  A memory management bug in the Linux kernel's ARM64 architecture causes page-table cleanup to be incomplete when memory is hot-removed from a running system. When the kernel allocates page tables, it sets internal metadata and reserves memory counters; however, when those tables are freed during hot-removal operations, the cleanup steps were skipped. On systems with debug features enabled, this creates corrupt memory state warnings and can leak memory allocated for page-table locks. The fix ensures the cleanup process mirrors the allocation process.

• CVE-2026-53343MEDIUM 5.5

  A bug in the Linux kernel's ARM architecture code causes system crashes when two security features (KASAN memory debugging and virtual memory stack protection) are both enabled. The problem stems from an instruction that tries to read data from memory in a way that ARM processors don't allow—the instruction assumes the address is word-aligned when it may not be. When the kernel switches between processes, it crashes with an alignment exception before the system even fully boots. The fix is straightforward: use a byte-sized read instead of a word-sized read, since KASAN shadow memory tracks bytes anyway.

• CVE-2026-53344MEDIUM 5.5

  A vulnerability in the Linux kernel's mcp23s08 pinctrl driver causes a system crash during device initialization. The issue occurs because two required variables (mcp->dev and mcp->addr) are not set up before the driver attempts to communicate with the hardware. When the communication code runs and tries to use these uninitialized variables, the kernel encounters a NULL pointer reference and crashes. This affects systems using the MCP23S08 GPIO expander chip, particularly in embedded or IoT deployments. The crash happens only during driver probe and requires local system access to trigger.

• CVE-2026-53345MEDIUM 5.5

  CVE-2026-53345 is a memory leak vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) hypervisor that affects systems running SEV-ES (Secure Encrypted Virtualization with Encrypted State) virtual machines. The issue occurs when KVM fails to properly clean up a writable page mapping during virtual machine destruction, particularly when userspace never completes operations after certain VM exits. This leaves memory incorrectly marked as dirty without proper cleanup, resulting in a resource leak. The vulnerability is triggered only during the shutdown sequence of affected VMs and does not allow remote exploitation or privilege escalation beyond the local user's existing permissions.

• CVE-2026-53347MEDIUM 5.5

  The virtio-gpu Linux kernel driver crashes when being unloaded if it was compiled without KMS (Kernel Mode Setting) support. During driver removal, the code attempts to shut down atomic graphics rendering components that were never initialized in the first place, causing the kernel to access invalid memory and crash. This is a local denial-of-service condition that affects systems running custom or minimal Linux kernel builds where virtio-gpu is present but KMS is disabled.

• CVE-2026-53348MEDIUM 5.5

  A NULL pointer dereference vulnerability exists in the Linux kernel's SDCA (SoundWire Device Class Audio) subsystem. When audio device registration fails partway through or during cleanup operations, the code attempts to unregister device pointers that have not been initialized, causing the kernel to crash. This occurs in systems using SoundWire audio, particularly when firmware loading fails. The vulnerability requires local access to trigger and impacts system availability.

• CVE-2026-53349MEDIUM 5.5

  A vulnerability in the Linux kernel's netfilter connection tracking system allows a dangling pointer to persist after NAT helper modules (such as H.323) are unloaded. When a pending network connection arrives after the module is removed, the kernel attempts to call code that no longer exists in memory, causing a crash. Triggering this requires the ability to remove kernel modules, limiting the threat to local attackers with elevated privileges, but the underlying issue—leaving stale pointers to freed code—represents a robustness problem that warrants timely patching.

• CVE-2026-53350MEDIUM 5.5

  A bug in the Linux kernel's audio subsystem can cause the system to crash when certain audio firmware controls are removed. The issue occurs because the code tries to clean up data associated with a control without first checking if that data actually exists. This can happen in specific scenarios where audio controls are set up differently than usual—either as system-level controls or when the audio driver has custom handling for controls. While the vulnerability requires local system access to trigger, the impact is a denial of service that could interrupt audio functionality or require a system restart.

• CVE-2026-53351MEDIUM 5.5

  CVE-2026-53351 is a medium-severity defect in the Linux kernel's RISC-V ptrace subsystem that causes a warning condition during core dump operations. When a process crashes and the kernel attempts to generate a core dump file, this bug triggers an abort condition in the ELF core dump handler. While not directly exploitable for unauthorized access, the vulnerability can cause denial of service by preventing core dumps from completing successfully, which disrupts both debugging operations and normal system crash handling.

• CVE-2026-53353MEDIUM 5.5

  CVE-2026-53353 is a medium-severity Linux kernel vulnerability in the HSR (High-availability Seamless Redundancy) networking subsystem. The issue stems from an erroneous assumption in the `hsr_addr_is_self()` function that triggers a kernel warning when the HSR interface is being torn down. The underlying problem is a race condition: the function expects the `self_node` structure to always exist while a device is visible to userspace, but device cleanup operations can clear this structure before the device is fully unregistered, creating a window where the warning fires. The fix removes the incorrect warning check rather than fundamentally altering HSR's operation. Only systems with HSR interfaces configured are affected.

• CVE-2026-53655MEDIUM 5.5

  Node-tar, a popular JavaScript tar archive library, contains a flaw in how it interprets PAX extended headers—a standard mechanism for adding metadata to tar entries. An attacker can craft a malicious tar file that causes node-tar to misalign its reading position within the archive. This misalignment makes node-tar extract a different set of files than other standard tar tools (GNU tar, libarchive, Python's tarfile module). The practical danger: if your organization uses one library to scan an archive for malware or secrets and a different library to actually extract it, an attacker can hide a malicious file from the scanner while ensuring it gets extracted anyway. This creates a gap in security tooling that could allow sensitive or harmful content to slip through undetected.

• CVE-2026-53850MEDIUM 5.5

  OpenClaw versions prior to 2026.4.25 contain a flaw in the focus command that bypasses authorization checks. An authenticated attacker can change focus state in ways the system administrator did not intend, potentially gaining unauthorized influence over gateway operations. The vulnerability requires valid credentials but does not require user interaction, making it a persistent risk in multi-tenant or shared-access deployments.

• CVE-2026-53856MEDIUM 5.5

  OpenClaw versions before 2026.4.24 have a file permissions problem in their configuration recovery feature. When the system restores its main configuration file (OpenClaw.json), it sets permissions too loosely, allowing other local users on shared systems to read it. Since the configuration file typically contains sensitive data like API keys, credentials, or internal settings, this gives unprivileged attackers a way to extract that information without needing special access.

• CVE-2026-53870MEDIUM 5.5

  Hermes Agent versions before 0.16.0 store sensitive application data—including conversation history and authentication secrets—in files that any local user on the system can read. When the application creates its database and configuration files, it sets overly permissive access controls, making this data available to anyone with local filesystem access. An attacker with a regular user account on the same machine can extract conversation records, tool execution payloads, system prompts, and cryptographic HMAC secrets without elevated privileges.

• CVE-2026-54231MEDIUM 5.5

  A local user can inject arbitrary content into system log files processed by the Automatic Bug Reporting Tool (ABRT) in libreport. When a program crashes, ABRT collects diagnostic information from the system journal. However, the scripts that gather this information don't properly filter out special characters that control log formatting. An attacker with local access can embed newline characters in their own log messages, which ABRT then reads and writes to its crash dump directory files without cleaning them up. This allows the attacker to manipulate files that root processes create, potentially altering important diagnostic records or injecting misleading content into crash reports.

• CVE-2026-54530MEDIUM 5.5

  pypdf, a widely-used open-source Python PDF library, contains a flaw that allows an attacker to create a specially crafted PDF file capable of causing an application to hang indefinitely. The vulnerability is triggered when the application attempts to extract text from the PDF in layout mode. This is a denial-of-service condition—the application becomes unresponsive but no data is stolen or corrupted. The flaw has been patched in version 6.13.0.

• CVE-2026-54531MEDIUM 5.5

  pypdf, a popular open-source Python PDF processing library, contains a flaw that allows an attacker to create a specially crafted PDF file that triggers an infinite loop when that file is merged with outlines (hierarchical document structure metadata) into a writer object. An attacker would need local access to the system and the ability to influence which PDFs are processed, making this a localized denial-of-service risk rather than a remote attack vector. The issue is resolved in pypdf version 6.13.0 and later.

• CVE-2026-54557MEDIUM 5.5

  mise is a popular tool for managing development dependencies like Node.js, Python, CMake, and Terraform across projects. A vulnerability in versions before 2026.6.1 allows an attacker to abuse the HTTP backend's symlink creation logic to place executable files or symlinks outside the intended mise installation directory. By crafting a malicious .tool-versions file in a repository, an attacker can trick mise into creating symlinks at arbitrary filesystem locations. If an attacker places a symlink in a directory that appears in a developer's PATH environment variable before legitimate tools, this could lead to execution of attacker-controlled code when developers run common commands.

• CVE-2026-54651MEDIUM 5.5

  pypdf, a widely-used Python library for PDF manipulation, contains a flaw that allows an attacker to craft a malicious PDF file capable of triggering an infinite loop when that file is merged with other PDFs in a writer operation. The vulnerability specifically occurs when processing PDFs containing threads or articles during a merge operation. An attacker with local access could exploit this to cause a denial of service by exhausting system resources and making applications using the library unresponsive. The issue has been patched in version 6.13.1.

• CVE-2026-54679MEDIUM 5.5

  jq, a widely-used command-line tool for processing JSON data, contains an integer overflow vulnerability in its string-handling code that only affects 32-bit systems. When processing specially crafted input, the vulnerable jvp_string_append function can miscalculate buffer sizes, leading to a buffer overrun that crashes the application. Version 1.8.2 and later contain the fix. This is primarily a local denial-of-service risk; the vulnerability does not compromise data confidentiality or integrity.

• CVE-2026-54905MEDIUM 5.5

  A flaw in concurrent-ruby's ReentrantReadWriteLock allows a thread to incorrectly obtain a write lock after repeatedly acquiring a read lock 32,768 times. The lock mechanism uses a single integer to track hold counts, and this specific reentry threshold causes the read count to overflow into a bit flag reserved for write locks. As a result, a thread can be granted write lock status without the library actually preventing other threads from holding read locks simultaneously, breaking the mutual exclusion guarantee that write locks are supposed to provide. This creates a race condition where concurrent read and write access can occur unsafely.

• CVE-2026-55392MEDIUM 5.5

  A vulnerability in NILFS utilities versions up to 2.3.0 allows attackers to crash system administration tools by providing specially crafted NILFS2 disk images. The flaw stems from insufficient validation of a critical superblock field before the tools perform mathematical operations on it. While no remote exploitation is possible, anyone with local access to a system or the ability to provide a malicious disk image can trigger a denial of service.

• CVE-2026-55439MEDIUM 5.5

  Halo, an open-source website building tool, contains a path traversal vulnerability in its backup download feature that allows authenticated administrators to read files outside the intended backup directory. An administrator can craft requests to the backup download endpoint to access arbitrary files on the server by manipulating file paths. Additionally, the backup creation endpoint fails to sanitize status fields, which could enable data manipulation. The vulnerability affects versions prior to 2.24.3 and requires administrator-level access to exploit.

• CVE-2026-55510MEDIUM 5.5

  ImageMagick, a widely-used open-source image processing library, contains a use-after-free vulnerability triggered when the application processes a specially crafted 8BIM profile embedded in an image file. An attacker can exploit this by distributing a malicious image that, when opened or processed by ImageMagick, causes the application to crash or become unstable. The vulnerability affects versions prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch).

• CVE-2026-55597MEDIUM 5.5

  ImageMagick, widely used for image processing tasks, contains a heap buffer overflow vulnerability in its JP2 (JPEG 2000) encoder. When processing specially crafted image files, the software can write data beyond allocated memory boundaries due to improper argument handling. While the vulnerability requires user interaction—someone must open a malicious image—the outcome is a denial of service. The issue affects ImageMagick versions prior to 7.1.2-26 and has been patched in that release.

• CVE-2026-55628MEDIUM 5.5

  ImageMagick's `-concatenate` operation fails to enforce security policies that restrict file access, allowing users to read and write files outside approved paths. This vulnerability affects ImageMagick versions prior to 7.1.2-26 and requires user interaction to exploit—an attacker would need to trick someone into running a specially crafted ImageMagick command. The issue has been resolved in version 7.1.2-26 and later.

• CVE-2026-55892MEDIUM 5.5

  Vim versions before 9.2.0662 contain a stack buffer overflow vulnerability in the spell-checking module. When a user loads a maliciously crafted spell file (.spl) and dumps the word list, the editor can crash. The vulnerability exists because the code that walks through spell-file data structures doesn't validate how deep it descends before writing to fixed-size memory buffers, allowing an attacker to trigger a crash by crafting a spell file with excessive nesting.

• CVE-2026-56074MEDIUM 5.5

  PraisonAI versions before 1.5.128 have a flaw in how they remember user approval decisions for tool commands. The system caches approval based only on the tool's name, not on what specific arguments or parameters are passed to it. An attacker can trick the system by first getting approval for an innocuous command—like listing a directory—then reuse that cached approval to silently run malicious variations of the same tool, such as exfiltrating API keys or credentials, without prompting the user again. This turns a single benign approval into a gateway for unauthorized data theft.

• CVE-2026-56129MEDIUM 5.5

  A Toshiba and Dynabook Generic IO & Memory Access driver for PCs has a security flaw that allows any non-administrator user who can log into the system to directly access the computer's physical memory. The driver exposes a control interface (IOCTL) without properly restricting who can use it. This bypasses normal Windows privilege boundaries and gives an unprivileged user dangerous low-level hardware access.

• CVE-2026-56288MEDIUM 5.5

  GNU patch, a widely-used utility for applying code changes, contains a flaw that can be triggered by a specially crafted patch file. When the tool processes consecutive newline markers at the end of a file in an unexpected way, it can crash instead of applying the patch. An attacker who can supply a malicious patch file to a user or system running patch could exploit this to disrupt workflow or prevent legitimate patching operations.

• CVE-2026-56289MEDIUM 5.5

  GNU patch, a standard utility for applying source code changes, contains a denial-of-service vulnerability triggered by maliciously crafted patch files. An attacker can supply a patch with an impossibly large line number reference, causing the tool to consume CPU in a near-infinite loop while searching for that line. The application becomes unresponsive and must be killed manually. This affects systems where patch processing is automated or where users apply untrusted patches without oversight.

• CVE-2026-56301MEDIUM 5.5

  Nuxt, a popular Vue.js framework, has a security issue in its development server that exposes sensitive files on Linux systems. When developers run `nuxt dev`, the framework creates an unprotected communication channel that other users on the same machine can access. An attacker with local access to the server can read private files like environment variables and SSH keys. This only affects development environments; production deployments are safe.

• CVE-2026-56692MEDIUM 5.5

  NanoClaw versions before 2.1.17 contain a symlink-following vulnerability that allows malicious container agents to read sensitive files from the host system. When the host processes file attachments, it validates filenames using a safety check but then copies files without verifying whether those filenames point to symlinks. An attacker controlling a container agent can craft a symlink with a seemingly benign name to trick the host into copying and exposing arbitrary files it can access, leading to information disclosure.

• CVE-2026-56693MEDIUM 5.5

  NanoClaw versions before 2.1.17 contain a privilege escalation flaw in how it handles agent creation requests. The vulnerability allows confined agent containers—which are supposed to operate with restricted permissions—to bypass those restrictions and create new agent groups, modify container configurations, and add arbitrary destinations. This happens because the system doesn't properly verify that the requesting container has permission to perform these privileged operations before writing changes to the central database. An attacker with local access and the ability to operate within a confined agent container can exploit this to escape their intended security boundary.

• CVE-2026-57025MEDIUM 5.5

  A flaw in Juniper Networks Junos OS and Junos OS Evolved can crash a layer-2 network service when a low-privileged user runs specific diagnostic commands. The crash is temporary—the service restarts automatically—but causes a brief outage affecting all layer-2 switching and learning functions on EX, QFX, and MX series devices. This is a local attack requiring existing user access, not a remote threat.

• CVE-2026-57452MEDIUM 5.5

  Vim, the widely-used open source text editor, has a vulnerability affecting encrypted files. When Vim tries to open a file encrypted using the VimCrypt~04! or VimCrypt~05! encryption methods (which rely on the xchacha20poly1305 algorithm, only active if Vim was compiled with the +sodium feature), a flaw in how the editor handles very small encrypted files causes it to read far beyond the file's actual contents. This memory read crash affects Vim versions before 9.2.0671 and is remedied in that release.

• CVE-2026-58198MEDIUM 5.5

  ChatterBot versions before 1.2.14 contain a local privilege escalation vulnerability in how it extracts training data. The vulnerability exists because the software creates a predictable directory in a user's home folder and extracts compressed files into it without properly validating the destination. A local attacker who already has access to the system can create a symbolic link at the expected directory location, tricking the software into writing files to any directory they choose on the system. This requires an attacker to already have local access and knowledge of when the extraction will occur, limiting the immediate risk—but it can lead to unauthorized file manipulation within the system.

• CVE-2026-58468MEDIUM 5.5

  NocoBase versions up to 2.1.20 contain a server-side request forgery (SSRF) vulnerability in its serverRequest wrapper. Authenticated administrators can trick the application into making arbitrary outbound HTTP requests by injecting malicious URLs into workflow request nodes, custom request action buttons, or the AI plugin. This allows attackers to probe internal networks, discover hidden hosts, enumerate open ports, and—most critically—retrieve sensitive IAM role credentials from cloud instance metadata endpoints. The vulnerability requires admin-level access to exploit but creates a significant bridge from internal compromise to lateral movement and credential theft.

• CVE-2026-59089MEDIUM 5.5

  GIMP, a widely-used open-source image editor, contains a flaw in its PlayStation TIM image file handler that can crash the application when processing certain malicious image files. The vulnerability stems from incorrect math when the software calculates how much memory to allocate for color data, causing it to misinterpret file contents and ultimately fail. While an attacker cannot steal data or gain system access through this flaw, they can disrupt a user's work by triggering a denial-of-service condition.

• CVE-2026-59857MEDIUM 5.5

  Vim, the widely-used command-line text editor, contains a buffer overflow vulnerability in its spell-checking feature. When Vim processes spell-file rules to suggest corrections for misspelled words, a crafted word of exactly the right length can cause the editor to write one byte past the end of an internal buffer. This corrupts Vim's memory, typically crashing the editor. The vulnerability only affects spell-checking in single-byte (non-Unicode) encodings and requires user interaction—opening a file or triggering spell suggestions on a malicious word. An attacker cannot remotely exploit this or gain code execution; the impact is denial of service through editor crashes.

• CVE-2026-61431MEDIUM 5.5

  PraisonAI versions before 4.6.78 contain a path traversal vulnerability in its context-gathering feature. When processing configuration files (.praisoncontext and .praisoninclude), the application does not properly validate file paths, allowing attackers to read sensitive files outside the intended workspace directory. An attacker who can influence these configuration files can trick the system into including arbitrary file contents in the generated context bundle, potentially exposing credentials, source code, or other sensitive data stored on the same system.

• CVE-2026-8636MEDIUM 5.5

  IBM Datacap and Datacap Navigator versions 9.1.7, 9.1.8, and 9.1.9 contain a memory exposure vulnerability that allows authenticated local users to extract sensitive credentials and encryption keys from the application's memory space. Once extracted, an attacker can use these keys to decrypt stored passwords, gain unauthorized access to the application, and retrieve sensitive data from the backend database. This is a local-privilege attack that requires existing system access but yields high-value credentials.

• CVE-2026-8643MEDIUM 5.5

  pip, the Python package installer, has a path traversal vulnerability that can cause entry point scripts to be installed in unintended locations outside the target installation directory. When a package specifies console or GUI scripts without proper path sanitization, an attacker could craft a malicious package that installs executable scripts to arbitrary filesystem locations—potentially system directories or locations with higher privilege—allowing code execution with the privileges of the installing user.

• CVE-2026-9106MEDIUM 5.5

  GitHub Enterprise Server contained a vulnerability where an OAuth application scope related to runner management was not displayed to users during authorization. This allowed an attacker to trick a user into granting an application access to manage organization runners without the user's informed consent. The vulnerability affected all versions prior to 3.22 and has been patched in multiple maintenance releases across supported version lines.

• CVE-2026-9735MEDIUM 5.5

  MongoDB servers can accidentally write authentication credentials to log files when connection health metric logging is enabled. During SASL authentication, the full authentication parameters—including usernames and passwords—may be recorded without being masked or redacted. An attacker with local access to the server could read these log files and obtain valid credentials, bypassing the need for network-based attacks.

• CVE-2026-9751MEDIUM 5.5

  MongoDB has a logging issue where LDAP passwords are exposed in plain text. When an administrator uses the runtime setParameter command to configure LDAP authentication (specifically the ldapQueryPassword parameter), the new password is written directly to the mongod.log file instead of being masked or encrypted. Any user with local access to the server or log files can read this sensitive credential, defeating password protection. This is a configuration-time mistake rather than a network-exploitable flaw, but it creates a direct path to credential compromise.

• CVE-2018-25384MEDIUM 5.4

  Wikidforum 2.20 has a stored cross-site scripting (XSS) flaw that lets authenticated users inject malicious JavaScript into forum replies. When other users view those compromised posts through the rpc.php endpoint, the injected code executes in their browsers, potentially stealing session cookies, redirecting to phishing pages, or performing unauthorized actions on their behalf.

• CVE-2019-25739MEDIUM 5.4

  GigToDo version 1.3 is vulnerable to a stored cross-site scripting (XSS) attack. An authenticated user can inject malicious JavaScript or HTML code into a proposal description field. When other users—particularly administrators—view that proposal, the attacker's code executes in their browser, potentially stealing session cookies or redirecting them to malicious sites. The vulnerability requires an attacker to already have valid login credentials, but the impact affects anyone who later views the compromised proposal.

• CVE-2019-25742MEDIUM 5.4

  The Zoner Real Estate WordPress theme version 4.1.1 has a stored cross-site scripting (XSS) flaw in its property creation form. Authenticated real estate agents can inject malicious JavaScript into the property's address field, and that script will execute when site administrators review the property for approval. This could allow attackers to steal admin session cookies or hijack their accounts.

• CVE-2019-25743MEDIUM 5.4

  WordPress Soliloquy Lite version 2.5.6 contains a stored cross-site scripting (XSS) vulnerability in its post editing functionality. An authenticated attacker can inject malicious JavaScript code into a post's title field, which persists in the WordPress database. When other users—particularly administrators or editors—preview that post, the injected script executes in their browser, potentially compromising their session or enabling further attacks. The vulnerability requires an attacker to have valid WordPress credentials but does not require tricking users into clicking malicious links, making it a genuine persistence risk in multi-user WordPress environments.

• CVE-2019-25744MEDIUM 5.4

  WordPress Popup Builder version 3.49 contains a stored cross-site scripting (XSS) flaw that allows authenticated users to inject malicious JavaScript into posts or pages. An attacker with WordPress login credentials can craft a specially formatted post title containing script code that breaks out of HTML option tags, causing the malicious script to execute in the browsers of site visitors viewing popup selections. This is a persistence vulnerability—the injected code remains in the database and executes repeatedly.

• CVE-2020-37256MEDIUM 5.4

  Grav, a popular flat-file CMS, contains a cross-site scripting (XSS) flaw in its Admin plugin page editor affecting versions before 1.6.30. An authenticated user with page editing rights can embed malicious scripts into page content. When another user (typically an administrator) views or interacts with that page, the injected script executes in their browser context, potentially allowing the attacker to escalate privileges, modify site content, or install unauthorized plugins that grant deeper system access.

• CVE-2022-42479MEDIUM 5.4

  TemplateHouse Soledad contains a missing authorization check that allows authenticated users to access functionality they should not have permission to use. An attacker with valid login credentials can bypass access controls to perform actions or view information restricted to higher-privilege accounts. The vulnerability affects Soledad versions up to and including 8.2.5.

• CVE-2022-45813MEDIUM 5.4

  BeRocket Advanced AJAX Product Filters versions up to 1.6.3.3 contain a missing authorization flaw that allows authenticated users to perform actions they should not be permitted to access. An attacker with valid login credentials can exploit improperly configured access controls to read or modify data they don't own, though without disrupting service availability. This is a privilege escalation issue affecting WooCommerce sites using this plugin.

• CVE-2023-25969MEDIUM 5.4

  A security flaw in ThemeHunk Contact Form & Lead Form Elementor Builder versions up to 1.8.4 fails to properly verify user permissions before allowing certain actions. This means an unauthenticated attacker could potentially manipulate form data or disrupt form functionality by exploiting weak access controls. The vulnerability requires user interaction (such as clicking a malicious link) to be triggered, limiting but not eliminating the risk.

• CVE-2024-30476MEDIUM 5.4

  PowerStore Manager contains a vulnerability that allows authenticated users with low-level permissions to inject malicious scripts into the application. When other users access affected areas, their browsers execute these scripts, potentially allowing the attacker to steal sessions, modify data, or perform actions on their behalf. The attack requires an authenticated account and user interaction to succeed.

• CVE-2025-15546MEDIUM 5.4

  The Iptanus File Upload WordPress plugin versions before 5.1.7 contain a race condition vulnerability that allows authenticated users to overwrite files uploaded by other users when the "maintain both" duplicate file policy is enabled. An attacker must be logged in and the victim must actively upload a file at nearly the same moment the attacker attempts their action, making exploitation difficult but possible in environments with concurrent file uploads.

• CVE-2025-33128MEDIUM 5.4

  IBM Engineering Workflow Management contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript into the Web UI. An attacker with valid credentials could craft a payload that executes in the browser of other users viewing the same application, potentially stealing session credentials or performing unauthorized actions on their behalf. The vulnerability requires user interaction (a victim must view the attacker's injected content) but spreads through a trusted application interface, making it a meaningful risk in collaborative engineering environments.

• CVE-2025-36323MEDIUM 5.4

  IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript into the Web UI. An attacker with valid credentials could craft a payload that executes in the browser of other users viewing the application, potentially stealing session credentials or manipulating application behavior within that trusted session. This requires user interaction—the victim must click a malicious link or visit a compromised page—but operates within the security perimeter of an already-authenticated application.

• CVE-2025-53648MEDIUM 5.4

  A SQL misconfiguration in Apache Gravitino's web interface allows authenticated users to read or delete files on the server. This vulnerability exists in version 1.0.0 and earlier. While an attacker must have valid login credentials, the impact is significant—they can extract sensitive data or destroy critical files without elevated permissions.

• CVE-2025-62198MEDIUM 5.4

  Apache Atlas, a metadata governance platform, contains a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. An attacker with valid credentials can craft requests that execute arbitrary JavaScript in the browsers of other users who interact with the application. This is a browser-based attack that relies on user interaction to succeed; the attacker cannot directly access or modify data on the server, but can steal session tokens, deface content, or redirect users to malicious sites.

• CVE-2025-63041MEDIUM 5.4

  A broken access control vulnerability in the Forget About Shortcode Buttons WordPress plugin (versions 2.1.3 and earlier) allows authenticated users with the contributor role to perform unauthorized actions they should not have permission to execute. This weakness stems from insufficient permission checks on certain functions, enabling contributors to modify or delete content beyond their intended scope.

• CVE-2026-10213MEDIUM 5.4

  AstrBot version 4.23.6 contains a path traversal vulnerability in its API endpoint that handles skill deletion. An authenticated attacker can manipulate the Name parameter to traverse the file system and read or modify files outside the intended directory structure. The vulnerability is network-accessible and does not require user interaction beyond the attacker having valid credentials. Public exploit code is available, increasing the risk of active exploitation.

• CVE-2026-10218MEDIUM 5.4

  A security flaw exists in nextlevelbuilder GoClaw versions up to 3.11.3 that allows authenticated users to perform actions they shouldn't be authorized to perform. The vulnerability resides in the authentication logic of the application and can be exploited remotely by someone with valid login credentials. Because the flaw has been publicly disclosed, there's elevated risk that attackers may attempt to exploit it.

• CVE-2026-10284MEDIUM 5.4

  A security flaw in DevaslanPHP project-management versions up to 2.0.0-beta1 allows authenticated users to bypass authorization controls when editing or deleting comments in ticket management workflows. An attacker with login credentials can manipulate comment-related functions to perform actions they shouldn't be authorized to perform, such as deleting or modifying comments belonging to other users. The issue resides in the Livewire handler component and can be exploited remotely without requiring additional user interaction.

• CVE-2026-10285MEDIUM 5.4

  DevaslanPHP project-management versions up to 2.0.0-beta1 contain an authorization flaw in the ticket handler component. An authenticated user can manipulate ticket records in ways they should not be permitted to perform, potentially modifying or deleting ticket data without proper access controls. The vulnerability requires an existing login but can be exploited remotely over the network.

• CVE-2026-10531MEDIUM 5.4

  A stored cross-site scripting (XSS) vulnerability exists in the AI Share & Summarize WordPress plugin versions before 2.0.4. The plugin fails to properly sanitize and escape certain shortcode attributes before displaying them on pages. This allows users with Contributor role or higher permissions to inject malicious scripts that persist in the database and execute when other users view the affected pages. The vulnerability requires an authenticated attacker with at least Contributor-level access, limiting the immediate risk to multi-user WordPress installations where internal users pose a threat.

• CVE-2026-10585MEDIUM 5.4

  A vulnerability in GitHub Enterprise Server allows an authenticated user to inject malicious code into discussion titles that executes in other users' browsers. The flaw stems from improper handling of user input in Q&A discussions—specifically, the system failed to sanitize discussion titles before embedding them in structured data markup, creating an opening for attackers to break out of that context and run arbitrary JavaScript. An attacker would need valid credentials and would need to trick another user into viewing the malicious discussion, but the payload could then access that victim's session or sensitive information.

• CVE-2026-10601MEDIUM 5.4

  A vulnerability in Grafana's Tempo and Loki data source plugins allows users with basic Viewer permissions to bypass intended access controls and reach backend endpoints they shouldn't be able to access. By crafting specially designed requests, an authenticated attacker can potentially steal database credentials, extract sensitive internal information, or execute administrative commands on the connected backend system. While the attack requires valid user credentials, the low barrier to entry (Viewer level is a basic permission tier) and the potential exposure of sensitive infrastructure credentials make this a meaningful risk for most organizations.

• CVE-2026-10850MEDIUM 5.4

  Plane CE version 1.3.1 contains a stored cross-site scripting (XSS) vulnerability in its API. A user with low-level project membership can inject malicious HTML and JavaScript code into the description field when creating intake work items through the REST API. This code is then stored and executed in the browsers of other users who view that work item, potentially allowing attackers to steal session tokens, redirect users to phishing sites, or perform actions on behalf of victims.

• CVE-2026-10984MEDIUM 5.4

  Google Chrome on Android contains a flaw in how it handles accessibility features that allows attackers to trick users with a fake interface. By hosting a malicious webpage, an attacker can make Chrome display misleading or fraudulent content that mimics legitimate UI elements, potentially deceiving users into performing unintended actions. The vulnerability requires user interaction—specifically, a user must visit the crafted page—but does not require special privileges or complex setup.

• CVE-2026-11157MEDIUM 5.4

  A script injection vulnerability in Google Chrome's accessibility features allows attackers to inject arbitrary scripts and HTML into web pages if a user installs a malicious extension. The vulnerability, tracked as CVE-2026-11157, requires user interaction (installing an extension) to exploit, making it a social engineering vector rather than a network-based attack. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-11232MEDIUM 5.4

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the TabGroups feature handles network input, allowing attackers to deceive users through fake or misleading visual elements in the browser interface. An attacker would need to trick a user into visiting a malicious website or intercepting network traffic, but the actual attack surface is relatively narrow—the vulnerability requires user interaction and does not enable data theft or system crashes on its own.

• CVE-2026-11243MEDIUM 5.4

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles downloads that allows an attacker to bypass navigation restrictions by serving a specially crafted web page. When a user visits the malicious page, the browser's normal safeguards that prevent unwanted navigation can be circumvented, potentially allowing redirection to unintended destinations or other restricted actions. The vulnerability requires user interaction (clicking or visiting a page) and affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11372MEDIUM 5.4

  IBM TRIRIGA Application Platform versions 5.0.2 and 5.0.3 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript into the web interface. An attacker with valid credentials can manipulate the application's behavior and potentially steal session credentials from other users. This requires an existing account but does not need user interaction to execute once injected.

• CVE-2026-11466MEDIUM 5.4

  Zilliz's deep-searcher library contains an access control vulnerability in its collection routing logic. An authenticated attacker can manipulate function arguments to bypass intended restrictions, gaining unauthorized read access to data or causing service disruption. The issue affects versions up to 0.0.2, and exploit code is now publicly available, raising the risk of opportunistic attacks.

• CVE-2026-11467MEDIUM 5.4

  A path traversal vulnerability exists in jishenghua jshERP versions up to 3.6. An authenticated attacker can manipulate the fileName parameter in the addAccountHeadAndDetail endpoint to write or access files outside the intended directory. Because the vulnerability requires valid credentials to exploit, the immediate risk is constrained to insider threats or compromised accounts. However, the public disclosure of the issue increases the likelihood of exploitation attempts.

• CVE-2026-11533MEDIUM 5.4

  A vulnerability in the imvks786 student_management_system allows an authenticated user to bypass authorization controls on the student deletion function. By manipulating a parameter called 'del' in the /see.php endpoint, an attacker with login credentials can perform unauthorized deletions of student records. The vulnerability requires valid authentication but does not need special privileges, meaning any logged-in user—including those with limited access—could exploit it. Public disclosure has occurred, increasing the likelihood of active exploitation.

• CVE-2026-11569MEDIUM 5.4

  Quay, a container image registry platform, contains a vulnerability in its file upload endpoint that fails to properly validate file types. An authenticated user with write access to a repository can exploit this to upload a malicious SVG file containing embedded JavaScript code. Because the file is stored and then served inline by the CDN without proper content-type restrictions, any user visiting the archive URL will have that JavaScript execute in their browser—a stored cross-site scripting attack. The vulnerability requires an attacker to already have repository write permissions and the victim to click a link, which limits but does not eliminate risk in collaborative development environments.

• CVE-2026-11666MEDIUM 5.4

  Google Chrome versions prior to 149.0.7827.103 contain a flaw where the browser fails to properly validate user-supplied input in certain UI elements. An attacker can exploit this by crafting a malicious HTML page that, when visited, displays fake browser UI components or dialogs—a technique known as UI spoofing. This could trick users into believing they're interacting with legitimate Chrome interface elements, potentially leading to credential theft, social engineering attacks, or other user-directed compromise. The vulnerability requires user interaction (visiting the crafted page) but no special privileges, making it a concern for general web browsing.

• CVE-2026-11701MEDIUM 5.4

  Google Chrome versions before 149.0.7827.103 contain a flaw in how the Guest View feature handles crafted HTML pages, allowing attackers to trick users with fake or misleading interface elements. An attacker would need to host a malicious webpage and convince a user to visit it while Chrome's Guest View is active. The vulnerability does not allow data theft or system compromise on its own, but the spoofed interface could be used to deceive users into taking actions they wouldn't otherwise take.

• CVE-2026-11778MEDIUM 5.4

  A WordPress plugin called CURCY – Multi Currency for WooCommerce has a security flaw that allows attackers to execute WordPress shortcodes without proper authorization. Shortcodes are a WordPress feature that lets users insert dynamic content into pages and posts; in the wrong hands, they can be abused to inject malicious content or trigger unintended actions. The vulnerability affects all versions up to 2.2.14 and exploits a gap in input validation that fails to sanitize user-supplied data before processing shortcodes.