By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 68 of 86

• CVE-2026-57294MEDIUM 5.4

  Jenkins users should be aware of a credential-exposure vulnerability in the EC2 Fleet Plugin. An attacker with read-only access to Jenkins can exploit a missing permission check to connect to arbitrary URLs and supply pre-obtained AWS credential IDs, potentially allowing them to retrieve sensitive AWS credentials stored within Jenkins. This affects Jenkins EC2 Fleet Plugin version 4.2.3.539.v8fedff2a_81c3 and earlier.

• CVE-2026-57295MEDIUM 5.4

  Jenkins EC2 Fleet Plugin versions 4.2.3.539.v8fedff2a_81c3 and earlier contain a cross-site request forgery (CSRF) vulnerability that allows authenticated attackers to manipulate Jenkins into connecting to attacker-controlled URLs using AWS credential IDs they've obtained through other means. This can result in the exposure of AWS credentials stored within Jenkins, compromising cloud infrastructure access.

• CVE-2026-57298MEDIUM 5.4

  The Jenkins Contrast Continuous Application Security Plugin contains a CSRF vulnerability that allows an authenticated attacker to trick Jenkins into making unauthorized connections to attacker-controlled servers using credentials of the attacker's choosing. Because Jenkins typically runs with elevated permissions in CI/CD pipelines, an attacker could abuse this to redirect security scanning traffic, exfiltrate credentials, or poison scan results—all without the Jenkins administrator's knowledge or consent.

• CVE-2026-57304MEDIUM 5.4

  A flaw in Jenkins Assembla Plugin version 1.4 and earlier fails to verify that users should be allowed to configure external connections. An attacker with basic read access to Jenkins can exploit this to create or modify connections to any URL using credentials they control, potentially facilitating reconnaissance, credential theft, or lateral movement into connected systems.

• CVE-2026-57305MEDIUM 5.4

  Jenkins Assembla Plugin versions 1.4 and earlier contain a cross-site request forgery (CSRF) vulnerability that allows an attacker with valid Jenkins access to trick an authenticated administrator into executing unintended actions. Specifically, an attacker can force the plugin to connect to an attacker-controlled URL using attacker-supplied credentials, potentially enabling data exfiltration, unauthorized integrations, or further compromise of connected systems.

• CVE-2026-57632MEDIUM 5.4

  A broken access control vulnerability exists in the Email Marketing for WooCommerce plugin by Omnisend, affecting versions 1.19.0 and earlier. An authenticated user can bypass authorization checks to modify subscriber data or perform other restricted actions. While exploitation requires existing login credentials, the weak access controls mean that any logged-in user—including those with minimal permissions—could escalate their capability to alter email subscriber information or related settings.

• CVE-2026-57646MEDIUM 5.4

  Majestic Support versions 1.1.7 and earlier contain an Insecure Direct Object References (IDOR) vulnerability affecting subscriber accounts. An authenticated user can manipulate request parameters to access or modify subscriber data belonging to other accounts without proper authorization checks. This is a classic object-level access control failure where the application trusts user-supplied identifiers without verifying ownership.

• CVE-2026-57953MEDIUM 5.4

  Mythic, an operations management platform, contains an access control flaw that allows users with spectator-only permissions to perform actions they should not be able to do. Spectators are intended to have read-only visibility, but due to a misconfigured endpoint, they can instead create and delete automation workflows. This means someone with limited access can make unauthorized changes to how operations are automated, potentially disrupting or redirecting workflows. The vulnerability affects versions before 3.4.0.60.

• CVE-2026-58028MEDIUM 5.4

  A cross-site scripting (XSS) vulnerability exists in Wikimedia MediaWiki and CentralAuth that allows authenticated users to inject malicious scripts into web pages. An attacker with login credentials can craft input that, when viewed by other users, executes arbitrary JavaScript in their browsers. This could enable session hijacking, credential theft, or defacement depending on the victim's permissions. The vulnerability spans multiple API and rendering functions within the codebase.

• CVE-2026-58031MEDIUM 5.4

  A cross-site scripting (XSS) vulnerability exists in MediaWiki's API Sandbox interface. An authenticated user can inject malicious scripts that execute in another user's browser when they interact with the sandbox feature. The scripts run in the context of the MediaWiki site, allowing the attacker to steal session tokens, perform actions on behalf of the victim, or redirect them to malicious sites. This requires both user authentication and victim interaction, limiting its scope but still posing a meaningful risk to collaborative wiki environments.

• CVE-2026-58055MEDIUM 5.4

  nghttp2's nghttpx proxy (through version 1.69.0) has a flaw in how it handles HTTP upgrade requests when they include both a Content-Length header and a message body. When forwarding these requests to backend servers over persistent connections, the proxy re-adds upgrade-related headers while passing the Content-Length unchanged. If a backend server interprets this ambiguous message differently than the proxy intended, an attacker can inject malicious HTTP requests or poison response queues, causing one client to receive another client's response.

• CVE-2026-58144MEDIUM 5.4

  Cotonti Siena versions 0.9.26 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows authenticated users with file management permissions to inject malicious scripts. By inserting script code into folder titles, attackers can craft payloads that execute in the browsers of other users—including administrators—who view the affected folder listings. The injected scripts remain stored in the database and execute persistently each time the folder is displayed.

• CVE-2026-58211MEDIUM 5.4

  NATS Server versions prior to 2.14.3 and 2.12.12 contain an authentication bypass vulnerability. When a client connects and sends an operation other than the standard CONNECT command first, the parser accepts the connection and registers the client as the configured no_auth_user account. This bypasses user-level restrictions that would normally be enforced during proper authentication, such as connection type limits or proxy requirements. An authenticated attacker could exploit this to assume a privileged account identity without valid credentials.

• CVE-2026-58278MEDIUM 5.4

  A server-side request forgery (SSRF) vulnerability in Microsoft Edge's Chromium-based browser allows attackers to trick the application into making unauthorized network requests on behalf of users. An attacker could exploit this to spoof responses or manipulate what Edge believes it's communicating with, potentially leading to data tampering or service disruption. The attack requires user interaction—such as clicking a malicious link or visiting a compromised website—but does not require the attacker to have prior access to the system.

• CVE-2026-58402MEDIUM 5.4

  Hugo, a popular static site generator, has a vulnerability in how it renders code blocks in Markdown files. When a developer includes a code fence with a specially crafted language identifier (the part that specifies syntax highlighting, like 'python' or 'javascript'), Hugo fails to properly escape HTML characters. An attacker who can contribute Markdown content—such as through a collaborative documentation project or a compromised content repository—can inject malicious JavaScript that executes in the browsers of anyone viewing the generated website. The vulnerability affects all versions from 0.60.0 through 0.163.2; upgrading to 0.163.3 or later closes the gap.

• CVE-2026-58519MEDIUM 5.4

  The Mediawiki Cargo Extension contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into web pages. Once injected, these scripts execute in the browsers of other users who view the affected content, potentially compromising their sessions, stealing credentials, or performing unauthorized actions on their behalf. The vulnerability stems from insufficient input sanitization during web page generation.

• CVE-2026-58524MEDIUM 5.4

  Microsoft Edge (Chromium-based) contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. An attacker can exploit this by crafting a specially designed webpage that, when visited, executes arbitrary JavaScript in the victim's browser context. The vulnerability requires user interaction—specifically clicking a link or visiting a malicious site—but does not require the attacker to be authenticated. Successful exploitation can lead to credential theft, session hijacking, or impersonation of trusted content.

• CVE-2026-58579MEDIUM 5.4

  RAGFlow versions before 0.26.3 contain a stored cross-site scripting (XSS) vulnerability in the agent pipeline editor. When a workspace member with agent creation or editing permissions names a pipeline node, that name is not properly sanitized and is later displayed in a confirmation dialog when other workspace members attempt to rerun a dataflow. If the node name contains malicious JavaScript, that code executes in the victim's browser with their session privileges, potentially allowing the attacker to steal authentication tokens or take over accounts. The vulnerability requires authenticated access and user interaction (clicking rerun), but it crosses trust boundaries within the same workspace.

• CVE-2026-59102MEDIUM 5.4

  Forgejo versions before 15.0.3 have a stored cross-site scripting (XSS) flaw that lets authenticated users inject malicious code into the system. When a user sets their full name to contain HTML or JavaScript, and an Actions workflow run is triggered, other users viewing that run's details page will have the attacker's script execute in their browser. This happens because the system fails to properly escape user-supplied display names when building the run description, and the frontend renders it as raw HTML rather than safe text.

• CVE-2026-59212MEDIUM 5.4

  Open WebUI, a self-hosted AI platform, contains an authorization bypass vulnerability in versions 0.9.6 through 0.9.x that allows users with read-only access to knowledge files to escalate privileges and modify or delete those files. The vulnerability stems from inconsistent access control checks—the system validates read permissions but fails to properly verify write and delete permissions, trusting instead data derived from internal model metadata. An authenticated user can exploit this to upgrade their access level without additional authentication or approval.

• CVE-2026-59225MEDIUM 5.4

  Open WebUI, a self-hosted AI platform, contains an access control bypass that allows authenticated non-admin users to reach restricted AI models they shouldn't have access to. Specifically, a user with read permission to an arena wrapper model (a collection that routes requests to underlying models) can circumvent access checks and interact directly with the underlying models through certain task endpoints. The vulnerability exists because the task route processing skips a critical permission re-check that the normal chat route performs. This issue affects versions 0.8.12 through 0.9.x and is resolved in version 0.10.0.

• CVE-2026-60120MEDIUM 5.4

  Bagisto, an open-source e-commerce platform, has a stored cross-site scripting (XSS) vulnerability that allows attackers to inject malicious code into customer accounts. An unauthenticated attacker can register a customer account and embed JavaScript in the first or last name field. When an administrator later views that customer's order creation page, the malicious code executes in their browser with administrator privileges. This can lead to unauthorized actions, session hijacking, or further compromise of the Bagisto admin panel.

• CVE-2026-6269MEDIUM 5.4

  GitLab has patched an authorization bypass affecting Community and Enterprise editions. An authenticated developer could modify hidden or restricted merge requests that should have been off-limits to them. The flaw stems from insufficient permission checks when accessing merge requests under certain conditions. While it requires valid credentials and developer-level access, it does allow an insider to tamper with code review artifacts intended to remain confidential or locked.

• CVE-2026-6283MEDIUM 5.4

  DivvyDrive, a file collaboration platform by DivvyDrive Information Technologies Inc., contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into the application. When other users view pages containing this injected content, the malicious script executes in their browsers, potentially compromising their sessions or stealing sensitive information. The vulnerability affects versions 4.8.2.23 through 4.8.3.0, and has been patched in version 4.8.3.1.

• CVE-2026-6658MEDIUM 5.4

  Jupyter's nbconvert tool, a widely used utility for converting Jupyter notebooks to other formats including HTML, contains a cross-site scripting (XSS) vulnerability in versions 7.17.0 and earlier. When converting notebooks to HTML, the tool fails to properly sanitize content from Mermaid diagram cells, allowing an attacker who can craft a malicious notebook to inject arbitrary JavaScript code. This code would execute in the browser of anyone viewing the exported HTML file, potentially compromising their session or stealing sensitive information. The attack requires user interaction (opening the exported HTML) and authenticated access to nbconvert, but the impact spreads across security domain boundaries (affecting different sites or applications).

• CVE-2026-7186MEDIUM 5.4

  A stored cross-site scripting (XSS) vulnerability exists in Checkmk's URL dashboard widget that allows authenticated users with dashboard editing permissions to inject malicious scripts. When other users view an affected dashboard, these scripts execute in their browsers without their knowledge. The vulnerability affects Checkmk versions before 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions. An attacker needs valid Checkmk credentials and dashboard edit access to exploit this flaw.

• CVE-2026-8309MEDIUM 5.4

  Armiya Information Technologies' Access Control System (GKS) versions before Version 2 contain a reflected cross-site scripting (XSS) vulnerability. An attacker who tricks a logged-in user into clicking a malicious link can inject arbitrary JavaScript code that executes in the victim's browser session, potentially stealing credentials, session tokens, or sensitive information displayed on the page. The vulnerability requires user interaction and a valid login, limiting its attack scope but not eliminating the risk.

• CVE-2026-8315MEDIUM 5.4

  A stored cross-site scripting (XSS) vulnerability exists in Webbeyaz Web Design Mediküm Web through version 08072026. An authenticated attacker can inject malicious scripts into the application that are stored and later executed in the browsers of other users who view the affected content. This allows the attacker to steal session cookies, redirect users, or perform actions on their behalf. Importantly, the vendor has confirmed this product is no longer supported, meaning patches are unlikely to be released.

• CVE-2026-8378MEDIUM 5.4

  The Frontend File Manager Plugin for WordPress contains a stored cross-site scripting (XSS) flaw in versions up to 23.6. An attacker with even basic subscriber-level permissions can inject malicious code into a filename through the file-rename feature. That code is then stored and executed in the browser of administrators who view the file management interface, potentially allowing the attacker to steal session tokens, modify content, or perform other admin actions.

• CVE-2026-8833MEDIUM 5.4

  Checkmk versions before 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 releases contain a flaw in how they validate URLs. An authenticated attacker can craft a malicious link using HTML encoding tricks to bypass the validation system and inject harmful URLs—such as javascript: links—into the application. When another user clicks or interacts with the crafted link, it can execute arbitrary JavaScript in their browser, compromising their session and data.

• CVE-2026-9278MEDIUM 5.4

  A vulnerability in the Form Builder CP WordPress plugin before version 1.2.47 allows editors and higher-privileged users to inject malicious code into form configurations. When visitors view a page containing the compromised form, the injected code executes in their browsers, potentially compromising their sessions or stealing sensitive information. This is a stored attack, meaning the malicious payload persists in the database and affects all subsequent visitors.

• CVE-2026-9308MEDIUM 5.4

  Firefox for iOS Reader View had a template injection vulnerability where malicious web pages could exploit the order of placeholder substitution to inject JavaScript. When the app converted page content into Reader View, it processed user-controlled content before handling internal JSON-LD data placeholders. An attacker could craft a webpage with a specially-formatted string that, after substitution, becomes executable JavaScript code. This requires user interaction—the victim must open the malicious page and enable Reader View.

• CVE-2026-9309MEDIUM 5.4

  Firefox for iOS Reader View had a vulnerability that failed to properly sanitize HTML tags embedded in JSON-LD metadata on web pages. An attacker could craft a malicious website that injects markup into Reader View, disrupting its normal behavior and extracting sensitive URL parameters—such as authentication tokens or session identifiers—that users might not realize were being exposed. In certain scenarios, this could allow an attacker to redirect those parameters toward internal endpoints, potentially enabling arbitrary JavaScript execution within a privileged origin. Mozilla fixed this issue in Firefox for iOS version 151.2.

• CVE-2026-9522MEDIUM 5.4

  Devolutions Server versions 2026.1.19 and earlier contain an access control weakness in the PAM (Privileged Access Management) account discovery feature. An authenticated user without admin rights can delete network discovery scan configurations that they shouldn't be able to modify. This means non-privileged users can disrupt the organization's ability to discover and inventory network accounts, potentially hindering PAM operations and compliance visibility.

• CVE-2026-9811MEDIUM 5.4

  Mautic 7 contains a stored cross-site scripting (XSS) flaw in its project selector component. An authenticated user with project creation permissions can inject malicious JavaScript into a project name. When an admin later opens an entity editor that displays that project in a dropdown, the script runs in the admin's browser—potentially allowing the attacker to steal sessions, manipulate data, or access sensitive dashboard information. The vulnerability requires user interaction (admin opening the editor) and valid authentication to exploit, making it a medium-risk issue that is not currently tracked as actively exploited in the wild.

• CVE-2026-9971MEDIUM 5.4

  A vulnerability in Google Chrome on iOS allows attackers to inject malicious scripts or HTML code into web pages when a user performs specific interactions with the browser. An attacker would need to craft a deceptive webpage and convince a user to engage with it in particular ways—such as specific taps or gestures—to trigger the injection. Once successful, the attacker gains the ability to run arbitrary code in the context of the webpage, potentially stealing data or modifying what the user sees.

• CVE-2016-20083MEDIUM 5.3

  The More Fields plugin for WordPress version 2.1 has a cross-site request forgery (CSRF) flaw that allows attackers to trick site administrators into unknowingly modifying custom fields and boxes. An attacker would create a malicious webpage; when an authenticated admin visits it, the attacker's site can silently submit requests to change WordPress settings on behalf of the admin, without the admin's knowledge or consent. The vulnerability stems from insufficient CSRF token validation in the plugin's code.

• CVE-2018-25387MEDIUM 5.3

  HaPe PKH 1.1 contains a cross-site request forgery (CSRF) vulnerability that enables attackers to change administrator passwords without needing to log in. An attacker can trick an authenticated administrator into visiting a malicious website or clicking a crafted link, which silently submits a forged request to modify admin credentials. This allows complete account takeover of administrative users.

• CVE-2018-25397MEDIUM 5.3

  PHP-SHOP 1.0 is vulnerable to cross-site request forgery (CSRF), a class of attack where malicious actors craft hidden web forms designed to trick authenticated administrators into unknowingly adding new admin accounts. An attacker creates a deceptive webpage containing a concealed form that automatically submits admin account creation requests when an authenticated admin visits the page. This allows the attacker to gain administrative control without needing the victim's credentials.

• CVE-2018-25435MEDIUM 5.3

  ZeusCart 4.0 is vulnerable to a cross-site request forgery (CSRF) attack that allows an attacker to trick administrators into unknowingly deactivating customer accounts. By crafting a malicious webpage or email link, an attacker can force an admin to submit a request that disables customer access without their knowledge or consent. The attack requires only that an administrator visit an attacker-controlled page while logged into their ZeusCart admin panel.

• CVE-2020-25900MEDIUM 5.3

  HelloTalk, a language exchange and social networking application, contains a privacy flaw in versions through 3.4.1 where the app stores precise GPS coordinates even when users intend to share only their country or city location. These full-precision coordinates are inadvertently saved to a local database accessible by other users' clients. While the client-side database was encrypted in a 2019 update, the vulnerability persists in how location data is initially processed and stored, creating an unintended disclosure of user whereabouts to a level of granularity the user did not authorize.

• CVE-2023-33854MEDIUM 5.3

  IBM's Db2 database platform, when deployed on Cloud Pak for Data, contains a weakness that allows authenticated users to bypass client-side security checks and alter input data through man-in-the-middle (MITM) attacks. The vulnerability affects Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data across versions 4.8 through 5.3. While this requires an attacker to already have valid credentials and network positioning, successful exploitation could lead to unauthorized data modification without detection by client-side safeguards.

• CVE-2023-40200MEDIUM 5.3

  A WordPress plugin called WP Logo Showcase Responsive Slider and Carousel contains a flaw that allows attackers to bypass access controls by manipulating user-controlled parameters. An attacker can exploit this to perform unauthorized actions—specifically modifying content—without needing to authenticate or interact with a legitimate user. The vulnerability affects all versions through 3.6.

• CVE-2024-21944MEDIUM 5.3

  CVE-2024-21944 is a medium-severity memory integrity flaw tied to how systems validate Serial Presence Detect (SPD) metadata on memory modules. An attacker with privileged access (ring0 code execution), physical access to hardware, or control over firmware update mechanisms could bypass input validation and corrupt guest virtual machine memory. The impact is data integrity loss for virtual machines—a guest's memory contents could be overwritten without authorization. This is not an easy exploit to execute in typical environments, requiring either high system privileges, hands-on access to the machine, or compromise of the firmware update chain.

• CVE-2024-27891MEDIUM 5.3

  Arista EOS devices that simultaneously use MACsec (a security protocol encrypting layer 2 traffic) and egress Access Control Lists (ACLs) on the same network interfaces may fail to enforce the intended ACL policies on outgoing traffic. This means packets that should be blocked by policy could be allowed to leave the device, or conversely, traffic that should be permitted might be incorrectly denied—effectively breaking the network's egress filtering controls.

• CVE-2024-33909MEDIUM 5.3

  Avirtum iPages Flipbook versions up to and including 1.5.1 contain a missing authorization flaw that allows unauthenticated attackers to read sensitive information by bypassing access control security levels. An attacker can access data they should not have permission to view without needing to authenticate or interact with a user. This is a straightforward but serious vulnerability that requires immediate attention if you deploy this software.

• CVE-2025-10268MEDIUM 5.3

  The Printcart Web to Print Product Designer plugin for WooCommerce, a WordPress extension used for customizable product design workflows, contains a path traversal vulnerability affecting versions through 2.4.8. An attacker can exploit this flaw to browse and retrieve directory listings from arbitrary locations on the affected web server without authentication. While the vulnerability does not allow file modification or system disruption, it exposes the directory structure and potentially sensitive file names that could inform further reconnaissance or attacks.

• CVE-2025-12714MEDIUM 5.3

  A widely used WordPress SEO plugin has a security hole that allows anyone on the internet—even without a WordPress account—to change critical SEO settings and site metadata. An attacker could modify your site's homepage title, meta descriptions, breadcrumb labels, and social media preview information without permission. This creates two problems: it can tank your search engine rankings, and it opens the door to injecting malicious content that visitors see across your site.

• CVE-2025-15657MEDIUM 5.3

  CVE-2025-15657 is a security flaw in School Management software (versions 93.1.0 and earlier) that allows unauthenticated attackers to view data they shouldn't have access to. The vulnerability stems from improper access controls on specific resources—an attacker can directly request or manipulate object identifiers in URLs or API calls to retrieve sensitive information without logging in. While the flaw enables unauthorized information disclosure, it does not permit modification of data or system unavailability.

• CVE-2025-15666MEDIUM 5.3

  Open Asset Import Library (Assimp) versions up to 5.4.3 contain a heap buffer overflow vulnerability in the model file handler's scene combining function. An attacker with local system access can manipulate image dimension parameters (width/height) to trigger memory corruption. The vulnerability requires local access and user-level privileges to exploit, making it primarily a concern in environments where untrusted users can execute code or submit malicious 3D model files to applications using Assimp.

• CVE-2025-46308MEDIUM 5.3

  Apple has addressed an authorization flaw affecting iOS, iPadOS, and macOS that could allow installed apps to access sensitive user information without proper permission checks. The vulnerability stems from inadequate state management in the platform's authorization framework. While the issue requires a malicious or compromised app to be present on a device, the potential for information disclosure makes this a meaningful security concern for users managing sensitive data. This is not currently known to be exploited in the wild, but the low barrier to exploitation (no user interaction required, network accessible) warrants timely patching.

• CVE-2025-53302MEDIUM 5.3

  CVE-2025-53302 is a missing authorization vulnerability in Anton Shevchuk's Constructor framework that allows unauthenticated attackers to access functionality that should be restricted by access control rules. An attacker can reach protected features without proper credentials or permissions, potentially exposing sensitive operations or data. The vulnerability affects Constructor versions up to and including 1.6.5.

• CVE-2026-10029MEDIUM 5.3

  The Event Koi Lite plugin for WordPress has a flaw that allows anyone on the internet to view sensitive details about events that are supposed to be hidden. Specifically, attackers can retrieve meeting links, venue addresses, coordinates, and RSVP settings for draft, pending, and private events through a function called get_events. No login is required. This affects all versions up to 1.3.13.1.

• CVE-2026-10034MEDIUM 5.3

  The WP DSGVO Tools (GDPR) plugin for WordPress contains a flaw that allows attackers to bypass authentication safeguards and obtain sensitive personal data of any WordPress user without permission. By manipulating request parameters, an unauthenticated attacker can trigger the plugin's Subject Access Request (SAR) processing feature for an arbitrary victim email address, receive direct download links to archives containing that person's data, and then access it without proving they own the account. The vulnerability exists because the plugin's CSRF token—which should act as a security gate—is publicly visible in the SAR form and reused across all visitors, rendering it ineffective.

• CVE-2026-10075MEDIUM 5.3

  DreamMaker, a product from Interinfo, contains a path traversal flaw that lets unauthenticated attackers list or read filenames from any directory on the affected system without requiring authentication or user interaction. An attacker can craft requests using absolute path manipulation to traverse the filesystem and discover file structures that should remain hidden. While this does not allow direct file content theft or system modification, it exposes the directory layout and naming conventions, which can aid reconnaissance in a broader attack chain.

• CVE-2026-10098MEDIUM 5.3

  A flaw in wolfSSL's OCSP (Online Certificate Status Protocol) certificate revocation checking allows an attacker to cause the library to report incorrect revocation status for a certificate. Specifically, if an OCSP response contains status information for a certificate whose serial number is shorter and matches the beginning of another certificate's serial number (both issued by the same CA), wolfSSL could incorrectly report the wrong certificate's revocation status. This happens because the code compared serial numbers byte-by-byte without first checking that they were the same length. An attacker controlling an OCSP responder or intercepting OCSP traffic could exploit this to make a revoked certificate appear valid or vice versa.

• CVE-2026-10200MEDIUM 5.3

  Assimp, a popular open-source 3D model import library, contains a heap-based buffer overflow vulnerability in its glTF file format parser. An attacker with local access to a system can craft a malicious glTF file with a specially crafted 4x4 matrix to overflow memory and trigger a crash, information disclosure, or potential code execution. The vulnerability affects Assimp versions up to 6.0.4 and has been publicly disclosed.

• CVE-2026-10224MEDIUM 5.3

  A vulnerability in NousResearch's hermes-agent allows an attacker to consume resources on a server by sending specially crafted requests to a webhook endpoint. The vulnerability affects versions up to 2026.4.30 and can be triggered remotely without authentication. While the technical complexity is low, the impact is limited to availability rather than data breach or system compromise. Public exploit information exists, though NousResearch has not responded to early vendor disclosure attempts.

• CVE-2026-10229MEDIUM 5.3

  Assimp, a widely-used 3D model import library, contains a heap-based buffer overflow in its Half-Life 1 MDL file loader. An attacker with local system access can craft a malicious .MDL file that, when processed by an application using vulnerable Assimp versions up to 6.0.4, triggers memory corruption. This could lead to information disclosure, data corruption, or process crash. The vulnerability requires local execution and has been publicly disclosed.

• CVE-2026-10230MEDIUM 5.3

  Assimp, a popular open-source 3D model import library, contains a heap buffer overflow vulnerability in its Half-Life 1 MDL file loader. The vulnerability exists in the animation-reading function and can be triggered by a malicious or crafted MDL file. An attacker with local access can exploit this to read sensitive memory, modify data, or crash the application. The vulnerability affects Assimp versions up to 6.0.4.

• CVE-2026-10231MEDIUM 5.3

  Assimp, a popular open-source 3D model importing library, contains a heap buffer overflow vulnerability in its Half-Life 1 MDL file loader. By crafting a malicious MDL file that manipulates the animation value counter, an attacker with local system access can trigger memory corruption. This flaw requires the attacker to be already present on the system and execute code that processes a specially crafted model file, making it a local-origin threat rather than a remote network attack.

• CVE-2026-10232MEDIUM 5.3

  CVE-2026-10232 is a use-after-free vulnerability in Assimp, an open-source 3D model import library, affecting versions up to 6.0.4. The flaw exists in the ASE file parser component and can be triggered by a local attacker with user-level privileges when processing specially crafted ASE (ASCII Scene Export) files. Exploitation could allow an attacker to read sensitive data, modify application state, or crash the process. Because exploitation requires local access and user permissions, the risk is primarily relevant in multi-user systems or scenarios where untrusted ASE files are processed by privileged applications.

• CVE-2026-10254MEDIUM 5.3

  SourceCodester Pet Grooming Management Software version 1.0 contains a vulnerability that exposes file and directory information to unauthenticated remote attackers. An unknown function in the /admin/ path fails to properly restrict access to sensitive filesystem metadata, allowing adversaries to enumerate files and directories without authentication. While this does not permit direct modification or service disruption, the information disclosure can serve as reconnaissance for subsequent targeted attacks. Public exploit code is available.

• CVE-2026-10255MEDIUM 5.3

  A remote access control weakness exists in SourceCodester Pharmacy Sales and Inventory System version 1.0. An unauthenticated attacker can exploit the sell_statement function in the application's form controller to bypass authorization checks and gain unauthorized read access to sensitive pharmacy data. The vulnerability requires no special interaction from users and can be triggered over the network. Because exploit code has already been publicly disclosed, active exploitation risk is elevated.

• CVE-2026-10530MEDIUM 5.3

  The Pie Register WordPress plugin generates account verification tokens using insufficiently random values, meaning attackers can predict valid tokens without knowing a user's email password. This allows an attacker to activate any account by guessing the token, potentially taking over user accounts before the legitimate owner receives their verification email.

• CVE-2026-10548MEDIUM 5.3

  NousResearch's hermes-agent contains a flaw in how it synchronizes Anthropic API credentials from local credential files. An attacker with local access can exploit this to bypass authentication controls, potentially gaining unauthorized access to Anthropic services or resources protected by those credentials. The vulnerability affects versions up to 2026.4.23, and exploit code has already been made public, increasing the practical risk.

• CVE-2026-10566MEDIUM 5.3

  A vulnerability exists in FoundationAgents MetaGPT versions up to 0.8.2 that allows local attackers with user-level privileges to trigger unsafe deserialization through manipulation of function arguments in the Message.check_instruct_content handler. An attacker with local access and basic user permissions can exploit this to potentially read, modify, or disrupt system operations. Public exploit code is available, increasing near-term risk for organizations running affected versions.

• CVE-2026-10592MEDIUM 5.3

  A certificate validation flaw in wolfSSL allowed digital certificates with wildcard DNS names (like *.example.com) to bypass security constraints that should have rejected them. Certificate authorities use name constraints to limit which domains a certificate can be used for—this vulnerability meant those restrictions could be circumvented by using a wildcard entry, potentially allowing an attacker to use a certificate in ways the CA never intended to permit.

• CVE-2026-10597MEDIUM 5.3

  OMICARD EDM, a product developed by ITPison, contains a vulnerability that allows attackers without credentials to access user email addresses by manipulating a specific parameter in a web request. No authentication is required, making this a direct and accessible attack surface. While the vulnerability does not allow attackers to modify data or disrupt service, the unauthorized disclosure of email addresses poses a clear privacy and information-gathering risk.

• CVE-2026-10647MEDIUM 5.3

  A bug in the Zephyr RTOS USB network driver causes the device to freeze and lose network connectivity when the USB host suspends the bus while the Zephyr device is trying to send data. The driver fails silently when the USB hardware rejects a transmission request, then waits forever for a completion signal that never arrives, effectively deadlocking the network stack. Recovery requires a reboot. This is a denial-of-service issue affecting any Zephyr device using USB-based networking that connects to a typical host that implements USB suspend (such as a PC entering sleep mode).

• CVE-2026-10650MEDIUM 5.3

  A flaw in libwebsockets (a widely-used WebSocket and networking library) allows attackers to exhaust server resources by manipulating a specific message length parameter in the SSH protocol handler. The vulnerability requires network access but no authentication, and an exploit has already been published. This is a denial-of-service issue that can make affected systems unresponsive without compromising data confidentiality or integrity.

• CVE-2026-10740MEDIUM 5.3

  AWS's s2n-quic library contains a memory management flaw in its QUIC protocol handler that can be triggered by specially crafted network packets. An unauthenticated attacker can exploit this remotely to degrade service availability by exhausting server memory, without needing credentials or user interaction. The vulnerability affects versions before 1.8.2.

• CVE-2026-11004MEDIUM 5.3

  CVE-2026-11004 is a memory disclosure vulnerability in Google Chrome's ANGLE graphics library. An attacker who has already compromised Chrome's renderer process can craft a malicious HTML page to read sensitive data from the browser's memory. While this requires prior compromise of the renderer, the ability to extract potentially sensitive information makes it a meaningful security concern for organizations running Chrome.

• CVE-2026-11005MEDIUM 5.3

  A flaw in ANGLE, the graphics abstraction layer used by Google Chrome on Windows, allows a remote attacker to read sensitive data from Chrome's renderer process memory. The attacker must first compromise the renderer process and trick a user into visiting a malicious webpage. Once those conditions are met, the attacker can extract potentially sensitive information from memory that they shouldn't have access to. This is an out-of-bounds read vulnerability—the code accesses memory locations it wasn't intended to reach.

• CVE-2026-11098MEDIUM 5.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in GPU handling that allows an attacker with control of the renderer process to extract sensitive data from other websites. The vulnerability requires user interaction and a compromised renderer, making it a targeted risk rather than a mass-exploitation vector. The issue stems from insufficient validation when processing untrusted input, permitting cross-origin information disclosure.

• CVE-2026-11145MEDIUM 5.3

  A race condition in Google Chrome's geolocation feature on Android devices allows attackers to steal sensitive information across website boundaries. By crafting a malicious webpage, an attacker can exploit a timing vulnerability to extract data from other origins—websites or apps—that the user has visited or is logged into. The vulnerability requires user interaction (visiting the malicious page) and specific technical conditions to trigger, but successful exploitation could expose authentication tokens, personal information, or other confidential data from legitimate services.

• CVE-2026-11174MEDIUM 5.3

  CVE-2026-11174 is a Site Isolation bypass vulnerability in Google Chrome that allows an attacker who has already compromised a browser's renderer process to read sensitive data from other websites. The flaw stems from improper implementation of Chrome's Site Isolation feature, a critical security boundary that normally prevents one website from accessing another's data. An attacker would need to first gain control of the renderer process—typically through a separate vulnerability—and then use a specially crafted HTML page to circumvent this protection. While the attack requires a prior compromise, the consequence of success is confidentiality loss across site boundaries.

• CVE-2026-11246MEDIUM 5.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in IndexedDB—a browser feature for storing data locally—that fails to properly validate user input. If an attacker compromises the renderer process (the part of Chrome that displays web pages), they can craft a malicious HTML page to bypass the same-origin policy, a critical security boundary that normally prevents one website from accessing another's data. This requires the attacker to already control the renderer process, which limits the immediate threat but remains a meaningful integrity risk.

• CVE-2026-11379MEDIUM 5.3

  GitLab Enterprise Edition contains an authorization flaw in its DAST (Dynamic Application Security Testing) site profile feature that allows developers to access secrets they shouldn't be able to reach. Under specific circumstances, a user with a Developer role can retrieve sensitive credentials stored in DAST site profiles—such as authentication tokens or API keys—that are meant to be restricted to higher-privilege users. This affects multiple recent versions of GitLab EE and requires patching to resolve.

• CVE-2026-11398MEDIUM 5.3

  The LatePoint calendar booking plugin for WordPress contains a flaw that allows unauthenticated visitors to change customer account information—including names, phone numbers, and notes—without any authorization checks. An attacker can target any existing customer record by submitting a booking form with a known email address. The vulnerability only affects sites where guest bookings are enabled (a common configuration for public-facing appointment systems). This is a medium-severity issue that requires active user interaction on the attacker's part but poses a direct risk to customer data integrity.

• CVE-2026-11458MEDIUM 5.3

  A flaw in erzhongxmu JeeWMS allows unauthenticated attackers to access sensitive information through an exposed Boot Actuator Endpoint at /base-boot/actuator. The vulnerability requires no special conditions to exploit and can be triggered over the network. While the issue is rated MEDIUM severity and does not allow data modification or system disruption, the information disclosure risk warrants prompt remediation. Public exploit code is available, increasing the likelihood of opportunistic attacks.

• CVE-2026-11487MEDIUM 5.3

  Neovim versions up to 0.12.2 contain a command injection vulnerability in the secure.lua module's path-handling function. An authenticated local attacker can manipulate the path argument to execute arbitrary commands with the privileges of the Neovim process. The vulnerability requires local access and user-level privileges, making it a risk primarily in multi-user systems or environments where untrusted users have shell access to machines running Neovim.

• CVE-2026-11497MEDIUM 5.3

  A vulnerability exists in D-Link DCS-5615 network camera firmware version 1.01.00 affecting the Boa web server configuration. An unauthenticated remote attacker can manipulate the web server settings to escalate privileges or modify system functionality without proper authorization. The vulnerability requires no special interaction from the user and can be exploited over the network. While the technical impact is bounded to integrity violations, the ability to alter web server configuration on a networked device introduces operational risk, particularly in environments where the camera serves as a network endpoint with security implications.

• CVE-2026-11515MEDIUM 5.3

  A hard-coded password vulnerability has been discovered in SourceCodester Barangay Resident Profiling and Information Management System version 1.0. The flaw exists in the password reset handler, allowing an attacker to reset user passwords to a predictable hard-coded value rather than the intended new password. This can be exploited remotely without authentication, potentially leading to unauthorized account takeover. The vulnerability has been publicly disclosed and is actively exploitable.

• CVE-2026-11552MEDIUM 5.3

  A remote authentication bypass vulnerability exists in SourceCodester's Online Examination & Learning Management System (also marketed under an alternate name, Syllabus-aligned Learning Management and Examination System) version 1.0. An unauthenticated attacker can manipulate a password parameter in the user import function to trigger use of a hard-coded credential, gaining unauthorized access without valid authentication. The vulnerability requires no user interaction and can be exploited from the network. Public exploit details are available.

• CVE-2026-11620MEDIUM 5.3

  TOTOLINK has released a vulnerability in the EX200 router (version 4.0.3c.7646) that allows an attacker to manipulate vsftpd configuration files remotely without authentication, potentially bypassing security restrictions. The flaw resides in how the device handles file permissions or access controls for the FTP service configuration, enabling an unauthenticated attacker over the network to make unauthorized changes that could weaken the router's security posture.

• CVE-2026-11669MEDIUM 5.3

  A flaw in Google Chrome's media handling on ChromeOS allows an attacker who has already compromised the browser's renderer process to read sensitive information from memory using a specially crafted webpage. The attacker gains access to data that should not be accessible—such as passwords, cryptographic keys, or other process memory contents—without being able to modify or crash the system. This is a memory disclosure vulnerability that requires the renderer process to be already compromised, making it part of a multi-stage attack chain.

• CVE-2026-11678MEDIUM 5.3

  An integer overflow vulnerability exists in libyuv, an image processing library bundled with Google Chrome. The flaw allows an attacker who has already compromised Chrome's renderer process to read sensitive information from memory by serving a specially crafted HTML page. Because the attack requires prior renderer compromise, real-world exploitation involves a multi-stage attack chain rather than direct network exploitation.

• CVE-2026-11696MEDIUM 5.3

  Google Chrome on Windows contains a memory safety bug where uninitialized video-handling code can leak sensitive data from the browser's renderer process. An attacker who has already compromised Chrome's renderer (the process that executes web page code) can craft a malicious HTML page to read uninitialized memory, potentially exposing passwords, session tokens, or other data. The flaw requires the renderer to be under attacker control and user interaction to trigger, making it a secondary attack component rather than a direct entry point. Chrome versions prior to 149.0.7827.103 are vulnerable.

• CVE-2026-11848MEDIUM 5.3

  CVE-2026-11848 is a missing authentication vulnerability in IEI Integration Corp's iRM-IEI Remote Management platform. An attacker on the network can access certain system configuration information without needing valid credentials. While the exposed data is limited to partial configuration details rather than sensitive secrets, the ability to query system state without authentication creates an information disclosure pathway that could support reconnaissance for further attacks.

• CVE-2026-11869MEDIUM 5.3

  The WP DSGVO Tools plugin, used by WordPress sites to manage GDPR data subject access requests, has a flaw that lets anyone request and download a user's personal data without logging in. An attacker only needs to know someone's email address to retrieve their name, address, phone number, email, and website comments. This affects all versions before 3.1.40.

• CVE-2026-11875MEDIUM 5.3

  A widely-used WordPress support ticket plugin fails to properly secure session cookies used by guest users. This means an attacker can forge a guest session to impersonate someone else, gaining access to that person's support tickets without needing credentials. The attacker can read ticket contents, reply on behalf of the ticket owner, and close tickets—but cannot modify the underlying plugin or escalate to administrator access.

• CVE-2026-11896MEDIUM 5.3

  The My Calendar plugin for WordPress has a flaw that allows anyone on the internet to secretly peek at calendar events they shouldn't be able to see. By manipulating a web request parameter, an attacker can view the full details of non-public, draft, trashed, and personal calendar events—including titles, descriptions, dates, locations, and organizer information—without needing to log in or have permission. The vulnerability affects all versions up to 3.7.14 and stems from the plugin failing to properly validate user input before retrieving calendar data.

• CVE-2026-11990MEDIUM 5.3

  KiviCare, a WordPress plugin for managing medical clinics and patient records, contains a flaw that allows attackers to bypass security checks. An attacker can mark pending appointments as confirmed and create fake payment records without actually paying, essentially allowing them to schedule appointments and forge evidence of payment. This works on standard installations because the plugin shows all payment methods even those disabled by administrators, making it easy to exploit.

• CVE-2026-12015MEDIUM 5.3

  A use-after-free vulnerability in Google Chrome's autofill feature allows attackers who have already compromised the browser's renderer process to leak sensitive information from memory. An attacker would need to trick a user into visiting a specially crafted webpage while the renderer is in a vulnerable state. This is not a remote code execution risk on its own, but represents a significant information disclosure threat once an attacker has a foothold in the rendering engine.

• CVE-2026-12025MEDIUM 5.3

  Google Chrome versions before 149.0.7827.115 contain a flaw in how the browser validates input within its Network component. An attacker who has already compromised Chrome's renderer process—the sandboxed environment that executes web content—can craft a malicious HTML page to leak sensitive data across security boundaries that normally prevent one website from accessing another's information. This is a privilege-escalation scenario: it requires the renderer to already be compromised, but then allows the attacker to exfiltrate data that should be protected by the browser's same-origin policy.

• CVE-2026-12033MEDIUM 5.3

  Google Chrome versions prior to 149.0.7827.115 contain an out-of-bounds memory read vulnerability in the VideoCapture component. An attacker who has already compromised Chrome's GPU process can exploit this flaw by serving a specially crafted webpage, allowing them to read sensitive data from the process's memory. This is a post-compromise attack requiring prior GPU process compromise and user interaction.

• CVE-2026-12093MEDIUM 5.3

  The Simple Membership WordPress plugin contains a flaw that allows attackers to forcibly deactivate user accounts without authentication. An attacker can forge a fake payment refund notification that the plugin trusts, causing it to disable a victim's membership account. This only affects websites running version 4.7.5 or earlier that haven't manually configured Stripe webhook security—which is the default setup most sites use out of the box.

• CVE-2026-12094MEDIUM 5.3

  The Advanced Contact Form 7 - Compact DB WordPress plugin up to version 1.0.0 allows unauthenticated attackers to delete contact form submissions. The plugin's deletion function lacks security checks—no authentication requirement, no permission verification, and no ownership validation. An attacker can exploit this by sending requests with sequential form submission IDs to systematically erase user-submitted data without any authorization.

• CVE-2026-12097MEDIUM 5.3

  A WordPress plugin called User Management contains a flaw that allows anyone on the internet—even visitors who are not logged in—to change how the plugin exports user data. Specifically, unauthenticated attackers can manipulate which user fields (including password hashes) get included in CSV exports and how data is mapped during imports. The plugin fails to verify that the person making these configuration changes actually has permission to do so.