By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 69 of 86

• CVE-2026-12120MEDIUM 5.3

  The FireBox Popups plugin for WordPress contains a security flaw that allows anyone on the internet to download complete lists of form submissions, including sensitive personal information like email addresses and names, without needing to log in. An attacker simply needs to guess or identify a form ID number to retrieve all submitted data in CSV format. This affects all versions up to and including 3.1.7.

• CVE-2026-12122MEDIUM 5.3

  The Kirki page builder plugin for WordPress has a flaw that allows anyone on the internet to view sensitive builder metadata and HTML code from unpublished draft pages. An attacker can retrieve this information by guessing sequential post IDs, exposing content that website owners intended to keep private—including incomplete pages, design configurations, and internal HTML structures.

• CVE-2026-12127MEDIUM 5.3

  WPForms, a popular WordPress form-building plugin, contains a flaw that allows unauthenticated attackers to secretly redirect copies of form notification emails to attacker-controlled addresses. The vulnerability stems from improper handling of carriage-return and line-feed characters in form field data when constructing email headers. An attacker can craft a form submission using a textarea field configured as the Reply-To display name to inject additional email headers like Bcc:, causing the site to silently blind-copy all notification emails sent by the form to a third party. This data exfiltration occurs without the site owner's knowledge or consent.

• CVE-2026-12189MEDIUM 5.3

  Moovit Bus & Public Transit App version 1.18 on Android contains a flaw in its custom URL scheme handler that allows a local attacker with user-level privileges to bypass authorization controls. An attacker with access to the device could potentially read, modify, or disrupt app functionality by manipulating how the app processes custom URLs. The vulnerability requires local access and user interaction is not needed once access is gained. Public exploit code exists for this issue.

• CVE-2026-12190MEDIUM 5.3

  A vulnerability in Genspark AI Workspace App version 2.8.4 on Android allows a local attacker with user-level access to bypass authorization checks for custom URL scheme handlers. This means an attacker already on the device could potentially redirect the app to perform actions it shouldn't allow, such as accessing sensitive data or triggering unintended operations. The attack requires local access and does not appear in active exploitation records.

• CVE-2026-12201MEDIUM 5.3

  IObit Malware Fighter versions up to 13.2.0 contain a flaw in its DLL Handler component that allows a local attacker with standard user privileges to gain elevated permissions or access sensitive system information. The vulnerability requires an attacker to be already logged into the system; it cannot be exploited remotely. An exploit has been publicly disclosed, increasing the risk of opportunistic attacks in environments where this software is deployed.

• CVE-2026-12203MEDIUM 5.3

  HKUDS AI-Trader contains a flaw in its research export functionality that allows unauthenticated attackers to access sensitive information through the /api/research/agents.csv endpoint. An attacker can remotely exploit this vulnerability without user interaction to retrieve confidential data. The issue stems from insufficient access controls on the export feature. Public exploit code exists for this vulnerability. The vendor has addressed this by enforcing authentication and capability-based authorization on research export endpoints.

• CVE-2026-12208MEDIUM 5.3

  A prototype pollution vulnerability exists in jsonata-js (jsonata library) versions up to 2.2.0. The vulnerability is in the createFrame function within the Function Binding Frame System, allowing attackers to remotely modify object prototype attributes. An exploit has been publicly disclosed, increasing the risk of widespread exploitation. The vendor has not responded to early disclosure attempts.

• CVE-2026-12209MEDIUM 5.3

  RubyLouvre avalon, a popular Ruby templating library, contains a vulnerability in its filter handling mechanism that allows attackers to manipulate JavaScript object prototypes remotely. An attacker can inject malicious code through the template filter system to alter core object properties, potentially affecting application behavior across an entire system. The vulnerability requires no special privileges or user interaction to exploit, making it straightforward to weaponize. Public exploit code is already available, and the vendor has not responded to early disclosure attempts.

• CVE-2026-12216MEDIUM 5.3

  CVE-2026-12216 is a memory corruption flaw in Duktape, a lightweight JavaScript engine, affecting versions up to 2.99.99. An attacker with local access can manipulate function arguments in the bytecode processing component to corrupt memory, potentially leading to crashes or code execution. The vulnerability has been publicly disclosed with proof-of-concept code available, though the vendor has not acknowledged or released a patch.

• CVE-2026-12238MEDIUM 5.3

  WP Go Maps, a popular WordPress mapping plugin, contains a flaw that allows anyone on the internet to add fake map data—including markers, circles, and polygons—to a website's database without logging in. The vulnerability exists because the plugin fails to verify that requests to create these objects come from authorized users. An attacker exploits this by crafting a malicious request that bypasses the plugin's namespace check, resulting in unauthorized database modifications. While the plugin attempts to block suspicious requests by requiring class names to start with 'WPGMZA', attackers can still use legitimate class names like WPGMZA\Map to slip past this check before the actual authorization logic runs.

• CVE-2026-12276MEDIUM 5.3

  The LA-Studio Element Kit for Elementor WordPress plugin contains a flaw that bypasses account registration controls. Even when a WordPress site administrator has disabled user registration site-wide, attackers can create new accounts by exploiting unauthenticated AJAX endpoints in the plugin. This occurs because the plugin fails to verify whether registration is actually enabled before processing account creation requests.

• CVE-2026-12300MEDIUM 5.3

  Mozilla has patched a memory safety vulnerability affecting Firefox and Thunderbird that could allow an attacker to read sensitive data from affected systems. The flaw exists in how these applications handle memory, and while exploitation requires network access, it does not need user interaction or elevated privileges. The vulnerability is classified as Medium severity and has been resolved in Firefox 152 and Thunderbird 152.

• CVE-2026-12301MEDIUM 5.3

  A memory safety vulnerability has been identified in Firefox and Thunderbird that could allow an attacker to read sensitive information from a user's system. The flaw stems from improper memory handling and has been resolved in Firefox 152 and Thunderbird 152. While the vulnerability requires a network connection to exploit and does not enable code execution or system crashes, it does pose a confidentiality risk. Mozilla has addressed this issue and users should update to the patched versions.

• CVE-2026-12306MEDIUM 5.3

  A memory safety vulnerability was discovered in Firefox and Thunderbird that could allow attackers to read sensitive information from affected systems. The flaw affects the way these applications handle memory, creating a situation where an attacker could potentially access data they shouldn't be able to reach. Mozilla has addressed this issue in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

• CVE-2026-12307MEDIUM 5.3

  A memory safety vulnerability was discovered in Mozilla Firefox and Thunderbird that could allow an attacker to read limited sensitive data from affected systems. The flaw does not enable code execution or system disruption, but it does create a confidentiality risk. Mozilla has addressed this issue in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

• CVE-2026-12308MEDIUM 5.3

  CVE-2026-12308 is a memory safety vulnerability discovered in Mozilla Firefox and Thunderbird. The flaw allows an attacker on the network to read sensitive information from affected systems without requiring user interaction or special privileges. Mozilla has released patched versions that eliminate the underlying memory handling defect. While the vulnerability does not enable unauthorized modifications or system unavailability, the confidentiality impact warrants timely remediation, particularly for users handling sensitive data.

• CVE-2026-12329MEDIUM 5.3

  A memory safety defect affecting Mozilla Firefox and Thunderbird could allow an unauthenticated attacker to cause the application to crash or become unavailable. The vulnerability requires no user interaction and can be triggered remotely over a network. It does not enable data theft or system compromise, but denial-of-service impact is possible.

• CVE-2026-12349MEDIUM 5.3

  The Premium Addons for KingComposer WordPress plugin allows any unauthenticated visitor to create, modify, or delete custom widget areas (sidebars) without logging in. By sending crafted requests to the plugin's AJAX endpoints, attackers can alter the configuration of where widgets appear on a site, causing existing widgets to disappear from pages. This happens because the plugin fails to verify that the person making the request has permission to make such changes.

• CVE-2026-12404MEDIUM 5.3

  NEX-Forms, a popular WordPress form-building plugin, contains a flaw that allows anyone on the internet—even without a login—to download sensitive form submission data that site administrators have saved as reports. An attacker can guess sequential report IDs and retrieve complete records containing names, emails, phone numbers, addresses, payment information, and file paths. This affects all versions up to 9.2.2. The vulnerability stems from missing authorization checks that should verify a user has permission before accessing stored reports.

• CVE-2026-12406MEDIUM 5.3

  A WordPress plugin called User Frontend (versions up to 4.3.7) allows unauthenticated attackers to delete media files that were uploaded by guests or through registration forms. The vulnerability exists because the plugin exposes a security token (nonce) in publicly visible JavaScript on pages where the plugin is active, and then fails to verify that the person requesting a file deletion actually has permission to do so. Any visitor to an affected site can exploit this without logging in.

• CVE-2026-12418MEDIUM 5.3

  A vulnerability in the User Frontend WordPress plugin (versions up to 4.3.7) allows unauthenticated attackers to modify post content on vulnerable sites. By accessing any WPUF post submission form—which doesn't require a WordPress user account—attackers can overwrite titles, body text, and excerpts of arbitrary posts, including those created by administrators. The attack exploits inadequate permission checks in the plugin's AJAX submission handler.

• CVE-2026-12432MEDIUM 5.3

  A flaw in the WP Full Stripe Free WordPress plugin (versions up to 8.4.3) allows unauthenticated attackers to manipulate payment records. The vulnerable AJAX action accepts requests from anyone, including non-logged-in users, and doesn't verify who is making the request or check if they should be allowed to do so. An attacker who knows a valid Stripe Payment Intent ID—information that is normally visible to customers during checkout—can use this flaw to mark successful payments as failed or alter the failure reason and message. This does not expose customer payment data or allow theft, but it does enable tampering with transaction history.

• CVE-2026-12472MEDIUM 5.3

  The Kirki page builder plugin for WordPress contains a flaw that allows anyone on the internet to send convincing phishing emails to your site's users without needing to log in first. These emails can appear to come from your own domain and can include legitimate-looking password reset links, making them effective social engineering weapons. The vulnerability exists in how the plugin handles email composition without proper access controls.

• CVE-2026-12516MEDIUM 5.3

  The Fediverse Embeds WordPress plugin contains a flaw in its media-proxying feature that fails to restrict which URLs the server can fetch. An attacker without any account or authentication can trick the website into making requests to internal networks or private systems, reading back the responses. This turns the vulnerable site into an open proxy—essentially a tool an attacker can point at targets to gather information or attack internal infrastructure.

• CVE-2026-12517MEDIUM 5.3

  The Fediverse Embeds WordPress plugin contains a Server-Side Request Forgery (SSRF) vulnerability that allows unauthenticated attackers to manipulate the plugin's site-info endpoint into fetching internal or private network resources. Because the security nonce protecting this endpoint is exposed on public pages containing embeds, an attacker can craft requests to make the vulnerable site retrieve URLs it shouldn't access—such as internal APIs, cloud metadata endpoints, or private network services—and extract the parsed page metadata returned by those requests. This doesn't require authentication or user interaction.

• CVE-2026-12557MEDIUM 5.3

  The Ninja Forms - File Uploads plugin for WordPress contains an authorization flaw that allows anyone on the internet to read debug log entries or delete them entirely, without needing to log in or have any legitimate access. The vulnerability affects all versions up to and including 3.3.29. While an attacker cannot directly access user data through this flaw, the ability to view or destroy debug logs could expose sensitive application information or disrupt incident investigation efforts.

• CVE-2026-12565MEDIUM 5.3

  CVE-2026-12565 is a path traversal vulnerability in an unarchive module that fails to validate where extracted files are written. When processing malicious archive files on older systems running GNU tar (versions before 1.34, common in Ubuntu 20.04, Debian Buster, CentOS 7, and many Docker images), an attacker can craft an archive that extracts files outside the intended directory. This allows writing to arbitrary locations on the filesystem, potentially overwriting critical application or system files. Unlike the prior CVE-2025-10284 which addressed git-specific attack vectors, this vulnerability affects the core archive extraction logic and remains unfixed.

• CVE-2026-12644MEDIUM 5.3

  ts-deepmerge is a JavaScript utility library for merging nested objects. Versions before 8.0.0 have a critical flaw: when merging objects that contain properties named after built-in JavaScript methods like `toString` or `valueOf` with non-function values, the library corrupts the resulting object. Any attempt to use the merged object in a string context—such as logging, concatenation, or template operations—triggers a TypeError crash. This means an application using vulnerable versions of ts-deepmerge can be made to crash by an attacker providing specially crafted JSON or configuration objects for merging.

• CVE-2026-12657MEDIUM 5.3

  The LatePoint calendar and appointment booking plugin for WordPress contains a flaw that allows anyone on the internet—even without logging in—to bypass restrictions on certain services. Specifically, attackers can create bookings for services that should only be available to administrators and staff, potentially filling up reserved appointment slots and creating unauthorized bookings in the system. The vulnerability exists because the plugin fails to properly validate which services a user is allowed to book.

• CVE-2026-12822MEDIUM 5.3

  A code injection vulnerability exists in Langflow (an AI/LLM orchestration framework) up to version 1.9.3, affecting the Bundle URL Loader component. An authenticated local user can manipulate input to the loader to inject and execute arbitrary code on the affected system. The vulnerability requires local access and valid user credentials, limiting its reach to internal threats or compromised accounts. Langflow's maintainers were notified but did not provide a response or patch timeline.

• CVE-2026-12969MEDIUM 5.3

  dnsmasq, a widely-deployed DNS and DHCP server, contains an out-of-bounds read flaw in how it processes DNS response packets. When a remote attacker controls a DNS zone and sends a specially crafted NXDOMAIN response, the vulnerable code reads 10 bytes beyond the intended buffer boundary in heap memory. This can expose residual data from previous DNS transactions—potentially including DNS queries, cached responses, or other transient information—without crashing the service. The vulnerability requires network access and DNS zone control but does not demand user interaction.

• CVE-2026-13023MEDIUM 5.3

  CVE-2026-13023 is a memory disclosure vulnerability in Google Chrome's GPU handling code. If an attacker has already compromised Chrome's renderer process—the sandboxed component that executes web content—they can craft a malicious HTML page to read uninitialized GPU memory, potentially exposing sensitive data from the browser's process memory. This requires two conditions: prior renderer compromise and user interaction with the malicious page. The vulnerability affects Chrome versions before 149.0.7827.197.

• CVE-2026-13030MEDIUM 5.3

  Google Chrome for Android contains a memory initialization flaw in its GPU component that allows attackers to read sensitive information from the browser process. When a user visits a malicious webpage on an affected Android device, the GPU fails to properly initialize memory regions, potentially exposing data such as cached credentials, session tokens, or other process memory contents to the attacker. This is not a crash or denial-of-service issue—the vulnerability specifically enables information disclosure.

• CVE-2026-13122MEDIUM 5.3

  OpenVPN has a vulnerability in versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 that allows an authenticated attacker to crash the VPN server by sending a specially crafted authentication token when external authentication is enabled. The attack requires valid credentials and succeeds only under specific conditions, but once triggered, it causes a denial of service that disrupts all users relying on that OpenVPN instance.

• CVE-2026-13450MEDIUM 5.3

  The GamiPress gamification plugin for WordPress contains a flaw that lets anyone—without logging in—read private activity logs of any user on the site. These logs include badge earnings, point changes, and integration records from WooCommerce, LearnDash, and BuddyPress. The vulnerability exists because the plugin fails to validate who should access these records, and it broadcasts a security token to all website visitors, making the authentication nearly meaningless.

• CVE-2026-13459MEDIUM 5.3

  JetFormBuilder, a popular WordPress form-building plugin, contains a flaw that allows unauthenticated visitors to extract sensitive data from your website's database. Specifically, attackers can retrieve any customer information, payment details, or confidential data stored in WordPress post metadata—including email addresses, phone numbers, billing information, and even login credentials—as long as at least one form on your site uses the plugin's 'get from database' field. The attacker doesn't need to be logged in, and discovery of the necessary parameters is straightforward by simply viewing your public forms.

• CVE-2026-13501MEDIUM 5.3

  ANTLR4, a widely-used parser generator framework, contains a command injection vulnerability in its Go code generation component. The vulnerability exists in how the GoTarget module processes input when invoking the Go formatter (gofmt). An attacker with local system access can craft malicious input that breaks out of the intended command context, allowing arbitrary command execution with the privileges of the user running ANTLR4. This affects ANTLR4 versions up to and including 4.13.2.

• CVE-2026-13503MEDIUM 5.3

  ANTLR4, a widely-used parser generator framework, contains a path traversal vulnerability in how it handles grammar vocabulary imports. An attacker can craft a malicious grammar file that, when processed by the vulnerable tokenVocab handler, reads files outside the intended directory. The flaw requires no authentication and can be exploited remotely by providing a specially constructed grammar option. While the direct impact is limited to information disclosure (reading files the attacker shouldn't access), the vulnerability is now publicly known and actively exploitable.

• CVE-2026-13533MEDIUM 5.3

  Cockpit CMS versions up to 0.12.2 contain a vulnerability in its YAML configuration handler that allows unauthorized file access. An attacker can remotely read sensitive files or access restricted directories without authentication. The issue stems from improper handling of YAML parsing in the configuration module, and exploit code is publicly available. This is a disclosure made without vendor cooperation.

• CVE-2026-13571MEDIUM 5.3

  SourceCodester Simple Food Ordering System version 1.0 contains a vulnerability in its shopping cart functionality that allows attackers to manipulate product prices. By modifying the item_price parameter in the /cart.php file, an attacker can alter the cost of items in a customer's cart, leading to incorrect order totals and potential financial losses. This attack requires no authentication and can be executed over the network by anyone with access to the application.

• CVE-2026-13874MEDIUM 5.3

  A race condition exists in Google Chrome's DataTransfer mechanism that allows attackers to leak sensitive information from process memory. An attacker can craft a malicious HTML page that, when visited by a user, exploits timing vulnerabilities to read data that should be protected. While the attack requires user interaction (visiting a malicious website) and careful timing, the potential exposure of process memory contents makes this a meaningful privacy risk.

• CVE-2026-13875MEDIUM 5.3

  A flaw in how Google Chrome processes graphics instructions on Windows systems could allow an attacker who has already compromised your browser's rendering process to steal sensitive data from your computer's memory. The vulnerability requires the attacker to have already gained control of the renderer—the part of Chrome that displays web pages—and requires you to visit a specially crafted webpage. This is not a direct entry point for attackers, but rather a privilege escalation or lateral movement risk for those already inside your browser sandbox.

• CVE-2026-13877MEDIUM 5.3

  A vulnerability in Google Chrome's ANGLE graphics library allows an attacker who has already gained control of the browser's renderer process to read sensitive data from the browser's memory by tricking a user into viewing a specially crafted webpage. The attacker cannot exploit this directly from the internet—they must first compromise the renderer, making this a secondary attack that increases the severity of other browser vulnerabilities. Chrome versions before 150.0.7871.47 are affected.

• CVE-2026-13890MEDIUM 5.3

  A memory safety flaw in Google Chrome's Chromecast component allows an attacker who has already compromised the browser's renderer process to read sensitive data from process memory. The vulnerability requires user interaction (clicking a malicious link or visiting a crafted website) but does not lead to code execution or system crashes. Chrome versions prior to 150.0.7871.47 are affected across Windows, macOS, and Linux platforms.

• CVE-2026-13911MEDIUM 5.3

  A vulnerability in Google Chrome's spell-check feature allows an attacker who has already compromised the browser's rendering engine to read sensitive data from the Chrome process memory by tricking a user into visiting a malicious webpage. The vulnerability requires the attacker to have already gained control of the renderer process and the user to interact with the crafted page, making it a secondary exploitation target rather than a direct entry point. Chrome version 150.0.7871.47 and earlier are affected.

• CVE-2026-13933MEDIUM 5.3

  A vulnerability in Google Chrome versions before 150.0.7871.47 could allow an attacker who has already compromised Chrome's renderer process to read sensitive information from the browser's memory by tricking a user into visiting a malicious webpage. The attacker needs to have control of the renderer process first, limiting the scope of direct risk, but the ability to extract password-related data from memory represents a meaningful escalation once that foothold exists.

• CVE-2026-13947MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a memory safety issue in the Extended Reality (XR) feature that could let an attacker read sensitive data from the browser's rendering process. The attack requires two preconditions: the renderer process must already be compromised, and the user must interact with a malicious webpage. An attacker cannot exploit this vulnerability through the network alone—they need initial code execution within Chrome's sandbox first.

• CVE-2026-13950MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in GPU memory handling that could allow an attacker who has already compromised your browser's renderer process to read sensitive data from memory. The attacker would need to trick you into viewing a specially crafted web page. This is a medium-severity issue that affects confidentiality but not integrity or availability.

• CVE-2026-13961MEDIUM 5.3

  Google Chrome on Windows contains a flaw in its Developer Tools that fails to properly validate user input. An attacker can craft a malicious webpage that, when visited by a user, tricks them into performing specific interactions with DevTools. This manipulation allows the attacker to read sensitive data stored in the browser's process memory, such as authentication tokens, cached credentials, or other confidential information. The vulnerability requires social engineering—convincing a user to engage with DevTools in a particular way—which makes it moderately difficult to exploit in the wild, but the potential information disclosure is significant.

• CVE-2026-13969MEDIUM 5.3

  A vulnerability in Google Chrome for Android allows attackers who have already compromised Chrome's renderer process to read sensitive information from memory through a specially crafted webpage. The flaw stems from the use of uninitialized memory in the UI component, which can leak data that was previously stored in that memory location. An attacker would need to first gain control of the renderer process—typically through a separate compromise—making this a secondary attack vector rather than a direct entry point.

• CVE-2026-13970MEDIUM 5.3

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how the browser handles uninitialized memory in media processing. An attacker who has already compromised Chrome's renderer process—the component that interprets web content—can craft a malicious HTML page that leaks sensitive information from the browser's memory to the attacker. This is not a vulnerability that allows initial system compromise; it requires a prior breach of the renderer process, typically through another security flaw. Once that foothold exists, however, an attacker could extract passwords, authentication tokens, private keys, or other confidential data residing in memory.

• CVE-2026-13971MEDIUM 5.3

  Google Chrome contains a memory safety issue in its Skia graphics library that could allow an attacker to leak sensitive information from the browser's renderer process. If an attacker first compromises the renderer (the part of Chrome that processes web content), they can craft a malicious web page that reads uninitialized memory—data left over from previous operations that shouldn't be accessible. This could expose passwords, session tokens, or other sensitive data. The vulnerability requires the attacker to already have compromised the renderer and requires user interaction to visit the malicious page, making it a secondary concern in most attack chains.

• CVE-2026-13975MEDIUM 5.3

  A memory safety vulnerability exists in the ANGLE graphics library within Google Chrome on macOS that could allow an attacker to read sensitive data from Chrome's memory. The vulnerability requires two conditions: the attacker must first compromise Chrome's renderer process (the part that displays web content), and the user must visit a malicious web page. Once both conditions are met, an attacker could potentially extract sensitive information such as passwords, session tokens, or other data present in Chrome's memory at the time of exploitation.

• CVE-2026-13989MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the PageInfo feature displays information to users. An attacker who has already compromised Chrome's rendering engine can craft a malicious webpage that tricks users into believing they are interacting with a legitimate interface element, when in fact they are not. This is a UI spoofing attack—the attacker cannot steal data or crash the browser, but can deceive users about what they're seeing on screen.

• CVE-2026-14012MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a side-channel vulnerability in how the browser processes CSS that could allow an attacker to leak sensitive information from the browser process's memory. By crafting a malicious HTML page and tricking a user into viewing it, an attacker could potentially extract data that should remain private. The flaw is specific to how CSS rendering interacts with memory access patterns, creating a timing or behavioral difference that leaks information—a classic side-channel attack vector.

• CVE-2026-14049MEDIUM 5.3

  Google Chrome contained a flaw in how it handled GPU operations that could allow an attacker to read sensitive data from memory. The attacker would need to first compromise Chrome's renderer process (the component that processes web page content) and then trick a user into visiting a malicious webpage. If successful, they could extract information that should have remained private. This issue affected Chrome versions before 150.0.7871.47 across Windows, macOS, and Linux systems.

• CVE-2026-14112MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser handles certain user interactions on web pages. An attacker who tricks a user into performing specific gestures (like clicking or dragging) on a malicious webpage can potentially read sensitive data from Chrome's memory. While the Chromium team rates this as low severity, the ability to extract process memory elevates the practical risk. The vulnerability requires active user participation—it cannot be exploited passively.

• CVE-2026-14117MEDIUM 5.3

  A weakness in Google Chrome's developer tools on Windows allows a remote attacker to trick a user into performing specific actions that could leak sensitive information from the browser's process memory. An attacker would craft a malicious webpage and convince a user to interact with it in a specific way—typically involving the DevTools interface—to extract data. This is not a widespread, easily exploitable flaw; it requires user interaction and specific gestures to trigger.

• CVE-2026-14153MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a UI spoofing vulnerability in the Glic component. An attacker can craft a malicious HTML page that, when viewed by a user who performs specific UI gestures (like clicks or interactions), displays fake interface elements that deceive the user into believing they're interacting with legitimate browser controls or content. This is a social engineering attack that relies on user interaction but can expose sensitive information through misdirection.

• CVE-2026-14391MEDIUM 5.3

  An integer overflow vulnerability exists in ANGLE (a graphics abstraction layer used by Chrome) that could allow an attacker who has already compromised your browser's renderer process to read sensitive data from memory. The flaw affects Google Chrome on Windows versions before 150.0.7871.46 and requires both a successful initial compromise and user interaction with a malicious webpage to trigger. While the bar to exploitation is moderately high, the potential exposure of process memory contents warrants timely patching.

• CVE-2026-14414MEDIUM 5.3

  A flaw in Skia, the graphics library used by Google Chrome, allows an attacker who has already compromised Chrome's renderer process to read sensitive information from memory by tricking a user into visiting a malicious webpage. The vulnerability requires the attacker to control the renderer—a significant prerequisite—but once achieved, could leak data like passwords, tokens, or other secrets stored in memory.

• CVE-2026-14500MEDIUM 5.3

  The Bulk Order Update for WooCommerce plugin contains a flaw that allows unauthenticated attackers to read the first line of files stored on affected WordPress servers. The vulnerability exists because an administrative function that processes CSV file uploads accepts user-supplied file paths without proper validation, and doesn't require authentication or verification of the user's identity. This creates two distinct risks: attackers can extract sensitive information (like system configuration files), and they can probe which files exist on the server without triggering alarms.

• CVE-2026-14610MEDIUM 5.3

  Assimp, a widely-used 3D model import library, contains a heap-based buffer overflow flaw in its CSM file handler that allows a local attacker with basic user privileges to corrupt memory and potentially crash the application or cause information disclosure. The vulnerability requires local access and does not grant remote execution, but public exploit code now exists, elevating practical risk.

• CVE-2026-14628MEDIUM 5.3

  NousResearch's hermes-agent contains a path traversal vulnerability in its Live Webhook Endpoint that allows remote attackers to manipulate file paths without authentication. By crafting specific requests to the extract_media function, an attacker can read sensitive files from the server, potentially exposing configuration data, credentials, or other confidential information. The vulnerability affects versions up to 2026.5.16, and exploit code is publicly available.

• CVE-2026-14631MEDIUM 5.3

  webpack-dev-server versions 5.2.5 and earlier can be crashed by an unauthenticated attacker sending a specially crafted HTTP request or WebSocket upgrade message. The vulnerability exists in the host validation logic, which fails to handle malformed headers gracefully. When triggered, it terminates the entire Node.js process running the dev server, causing a denial of service. This affects only development environments and does not expose sensitive data or allow code execution.

• CVE-2026-14687MEDIUM 5.3

  A flaw in 666ghj BettaFish versions up to 1.2.1 allows remote attackers to manipulate how the InsightEngine search-result deduplication function compares strings, potentially causing partial or incomplete string matching. This could lead to incorrect or misleading search results being presented to users. The vulnerability requires no special privileges or user interaction to exploit, and proof-of-concept code has been publicly shared.

• CVE-2026-14723MEDIUM 5.3

  AD-Security's AD_Miner version 1.9.0 contains a flaw in its cache analysis component that allows a local user with basic system access to execute arbitrary code by manipulating how the tool processes cached data. An attacker would need to already have a user account on the system to exploit this; remote attacks are not possible. The vulnerability stems from unsafe handling of serialized data without proper validation.

• CVE-2026-14757MEDIUM 5.3

  An integer overflow flaw exists in radare2, a popular open-source reverse engineering framework, affecting versions up to 6.1.6. The vulnerability resides in the core analysis function and can be exploited by an authenticated local user to trigger memory corruption. While the technical mechanics involve integer overflow, the practical impact is limited to local attackers with existing system access, reducing the immediate risk in typical enterprise environments. Public disclosure has occurred, meaning the general security community now has awareness of the issue.

• CVE-2026-14940MEDIUM 5.3

  A flaw in 389 Directory Server allows an attacker to send specially crafted LDAP search requests that cause the server to write data beyond the boundaries of allocated memory. The vulnerability specifically affects how the server processes certain types of directory names (DNs) containing legacy formatting with nested attributes. An unauthenticated attacker on the network can trigger this condition without logging in, potentially crashing the directory service or corrupting its memory. This is not a weakness that grants unauthorized data access, but rather a stability issue that can disrupt service availability.

• CVE-2026-15035MEDIUM 5.3

  A command injection vulnerability exists in bentoml OpenLLM 0.6.30 where attackers with local access can manipulate the `cmd` argument passed to the `async_run_command` function, allowing them to execute arbitrary system commands. The vulnerability requires local system access and valid credentials, limiting its immediate threat scope but posing risk to multi-tenant or shared development environments. Public exploit information is available.

• CVE-2026-15182MEDIUM 5.3

  GNU LibreDWG versions up to 0.13.4 contain a heap-based buffer overflow vulnerability in the BMP image handling code. An attacker with local access can exploit this flaw to read, modify, or crash sensitive data by manipulating how the application processes BMP files. Upgrading to version 0.14 resolves the issue.

• CVE-2026-15193MEDIUM 5.3

  AidanPark's openclaw-android application, in versions up to 0.4.0, contains a local command injection flaw in its Android WebView Bridge component. A user with local access to the device can craft malicious input through the JsBridge.kt interface to execute arbitrary operating system commands with the privileges of the application. While the vulnerability requires local interaction and does not propagate remotely, it could allow an attacker who has already gained a foothold on a device to escalate capabilities or compromise sensitive data accessible to the app.

• CVE-2026-15204MEDIUM 5.3

  A path traversal vulnerability exists in TOTOLINK X5000R routers that allows an unauthenticated remote attacker to access files outside the intended directory structure through the OpenVPN export feature. An attacker can craft requests to the vulnerable CGI endpoint to read sensitive files on the device, potentially exposing configuration data, credentials, or other confidential information stored on the router.

• CVE-2026-15302MEDIUM 5.3

  The ARMember plugin for WordPress has a directory traversal vulnerability that allows unauthenticated attackers to upload files outside the intended upload directory. By manipulating the 'X-FILENAME' HTTP header, an attacker can place malicious files—such as modified CSS files—into directories they shouldn't normally access, potentially compromising site appearance, injecting malicious scripts, or overwriting legitimate files. The vulnerability affects all versions through 4.0.27.

• CVE-2026-20457MEDIUM 5.3

  A vulnerability exists in Modem that can crash the system when it receives specially crafted input that is not properly validated. An attacker controlling a rogue cellular base station could exploit this to deny service to connected users. No special privileges or user interaction are required—the attack triggers automatically when a device connects to the malicious base station.

• CVE-2026-20459MEDIUM 5.3

  A flaw in cellular modem firmware allows an attacker operating a rogue base station to crash a device's modem, temporarily knocking it offline. The vulnerability requires no special privileges and occurs automatically when a user connects to the attacker's malicious network. It does not lead to data theft or system compromise, but causes service disruption.

• CVE-2026-20460MEDIUM 5.3

  A modem vulnerability allows attackers to remotely extract sensitive information when a user connects to a compromised wireless base station. The flaw stems from improper validation of network input, enabling an attacker controlling a rogue base station to read confidential data without needing any special privileges or user interaction. Exploitation requires the target device to connect to the attacker's malicious network, but once connected, data disclosure occurs automatically.

• CVE-2026-20461MEDIUM 5.3

  A memory safety vulnerability exists in modem firmware that allows an attacker to crash the device remotely. By setting up a rogue base station, an attacker can trigger an out-of-bounds memory write that denial-of-services any connected device. No special privileges or user interaction are required—the attack succeeds simply by a user connecting to the malicious base station. The severity is moderate because exploitation requires proximity (the attacker must operate a base station) and doesn't grant further system access or data exposure.

• CVE-2026-20909MEDIUM 5.3

  Gitea, a self-hosted Git service platform, contains a permission validation flaw in its time tracking feature. Versions before 1.25.5 allow unauthenticated or low-privileged users to view time entries that should be restricted to authorized personnel. An attacker can enumerate sensitive project timing data without proper authorization, potentially exposing work patterns, project schedules, or other operational details that should remain confidential within a repository.

• CVE-2026-2128MEDIUM 5.3

  The Breeze WordPress plugin through version 2.5.2 contains a flaw that allows attackers to view content meant only for administrators. When the "Cache Logged-in Users" feature is enabled, the plugin trusts cookie information without properly verifying it belongs to a real, authenticated user. An attacker can craft a fake cookie claiming to be an administrator, and the plugin will serve them the cached pages generated for that admin—exposing private posts, administrative controls, security tokens, and other sensitive data. No authentication or special privileges are required to attempt this attack.

• CVE-2026-21368MEDIUM 5.3

  A memory corruption flaw exists in how Qualcomm processors and connectivity modules parse JPEG commands. During validation checks, the code writes extra data to a buffer beyond what is accounted for, potentially corrupting memory. An attacker with local access and user-level privileges can exploit this to read sensitive data, modify system behavior, or cause a crash. The vulnerability affects a broad range of Qualcomm chipsets used in smartphones, AR/XR devices, and networking hardware.

• CVE-2026-21369MEDIUM 5.3

  A memory corruption vulnerability exists in Qualcomm firmware and chipsets that control LED indicators on wireless and audio devices. The flaw occurs when an application modifies LED count values in memory, but the firmware continues using stale (outdated) count information when processing flash commands. This mismatch can cause the firmware to write data to incorrect memory locations, potentially corrupting device state or enabling further attacks. The vulnerability requires local access and moderately difficult conditions to exploit, but affects a broad range of Qualcomm connectivity and audio chipsets used in mobile devices, routers, and accessories.

• CVE-2026-21370MEDIUM 5.3

  Qualcomm Wi-Fi and cellular chipset firmware contains a memory corruption vulnerability that can be triggered when input validation fails to properly check batch size and buffer plane count parameters. An attacker with local access and low privileges can exploit this flaw to read or write memory, potentially affecting system stability or confidentiality. The vulnerability affects dozens of Qualcomm chipsets across FastConnect, G3X, IQ, and QCA product lines.

• CVE-2026-21384MEDIUM 5.3

  A memory corruption vulnerability exists in multiple Qualcomm wireless and connectivity chipsets when processing prepared commands with incorrect port index values supplied by local users. The flaw allows a user with local system access to trigger out-of-bounds memory writes, potentially compromising system confidentiality, integrity, and availability. This is a medium-severity local attack that requires specific knowledge of the affected firmware interfaces and cannot be exploited remotely.

• CVE-2026-2238MEDIUM 5.3

  GitLab has patched a flaw that allowed unauthenticated users to view confidential issue references on public projects. The vulnerability stems from insufficient authorization checks in the application, meaning someone without a GitLab account could potentially discover sensitive issue information that should have been restricted. The issue affects multiple recent versions of GitLab Community and Enterprise editions.

• CVE-2026-25440MEDIUM 5.3

  Essential Addons for Elementor versions prior to 6.6.0 contain a vulnerability that allows unauthenticated users to modify data without proper authorization checks. Because the plugin fails to validate user permissions before processing certain requests, an attacker can make unauthorized changes to website content or settings without needing valid credentials. This is a server-side access control failure rather than a client-side bypass.

• CVE-2026-25782MEDIUM 5.3

  Gitea, a popular self-hosted Git service, has a flaw in how it validates permissions when users attempt to delete time-tracking entries. The vulnerability allows an attacker to delete time entries that belong to a different issue than the one being accessed, bypassing the expected scope restriction. This occurs in versions before 1.25.5 and requires no special privileges or user interaction to exploit.

• CVE-2026-26053MEDIUM 5.3

  CVE-2026-26053 is a privilege escalation flaw in Allegro's Command Centre Server that allows authenticated operators with limited access rights to perform administrative or otherwise restricted actions they shouldn't normally be able to execute. An attacker must already have a valid login account with restricted permissions to exploit this; the vulnerability does not grant unauthenticated access. The risk is rated medium severity because it requires prior authentication and involves integrity impact rather than data confidentiality loss.

• CVE-2026-26825MEDIUM 5.3

  A use-of-uninitialized memory vulnerability in libxls 1.6.3 allows attackers to craft malformed XLS files that trigger memory safety issues during file parsing. When the library processes these files, uninitialized heap memory from the OLE (Object Linking and Embedding) layer may be read, leading to unpredictable behavior, incorrect file interpretation, or disclosure of sensitive data from memory. This does not require authentication and affects any application using the vulnerable library to open untrusted XLS files.

• CVE-2026-27409MEDIUM 5.3

  Webba Booking, a WordPress plugin, contains a missing authorization flaw that allows unauthenticated attackers to modify certain data or functionality due to incorrectly configured access controls. An attacker can exploit this vulnerability over the network without authentication or user interaction, though the impact is limited to data integrity—not confidentiality or availability. Versions up to and including 6.4.13 are affected.

• CVE-2026-27435MEDIUM 5.3

  WofficeIO Woffice contains a missing authorization vulnerability that allows attackers to exploit improperly configured access controls. An unauthenticated attacker can bypass security level restrictions to modify data or functionality within the application. This affects Woffice versions before 5.4.33.

• CVE-2026-28705MEDIUM 5.3

  Gitea, a popular self-hosted Git service, contains a path traversal vulnerability in how it handles release asset exports. When Gitea dumps release assets, it uses the release tag name and asset file name directly as path components without proper sanitization. An attacker can craft specially named release tags or assets to manipulate where files are written on the server's filesystem, potentially writing outside the intended directory. This could allow unauthorized information disclosure if sensitive files become readable, though the vulnerability does not grant write or delete capabilities to arbitrary locations.

• CVE-2026-28898MEDIUM 5.3

  Swift-NIO-HTTP2, Apple's open-source networking library for HTTP/2 protocol handling, contains a validation gap in its HTTP/2-to-HTTP/1.1 converter. The library failed to check pseudo-header values (like :path, :authority, :scheme, :method, and :status) for control characters—specifically carriage return (CR), line feed (LF), and null (NUL) bytes—before translating HTTP/2 frames into HTTP/1.1 messages. An attacker could craft malicious HTTP/2 requests or responses containing these characters to bypass security controls or potentially inject unintended content into downstream systems that process the converted HTTP/1.1 messages. Version 1.44.1 and later reject such messages at the connection level.

• CVE-2026-29007MEDIUM 5.3

  U-Boot versions through 2026.04-rc3 contain a flaw in how they process incoming TCP network packets when TCP networking is enabled. An attacker can send a specially crafted packet with mismatched length fields to trick U-Boot into reading data beyond the actual packet boundaries. This can corrupt internal TCP connection variables, potentially disrupting network communication and causing denial of service. The vulnerability requires no authentication and can be triggered from any network-connected attacker.

• CVE-2026-31983MEDIUM 5.3

  CVE-2026-31983 is a missing authentication vulnerability in the SSH keys synchronization endpoint of Nozomi Networks products. An attacker without credentials can query this endpoint to retrieve sensitive information: a complete list of users who have uploaded SSH keys, their group memberships, and the actual public SSH keys themselves. This is a straightforward authentication bypass that exposes information an attacker would typically need valid credentials to access.

• CVE-2026-33463MEDIUM 5.3

  Kibana contains a flaw where access tokens that should expire at a specific time continue to work indefinitely. An attacker who obtains one of these tokens—even after it should have stopped being valid—can use it to read sensitive information they shouldn't have access to. The vulnerability stems from improper validation of token expiration times, allowing the system to forget when a token was supposed to stop working.

• CVE-2026-34198MEDIUM 5.3

  Coolify, an open-source server and application management tool, contains a vulnerability that allows unauthenticated attackers to hijack user accounts by manipulating password reset emails. The vulnerability stems from weak proxy trust settings and a broken host validation mechanism that together allow an attacker to redirect password reset links to their own domain, capturing the reset token and gaining access to victim accounts. The flaw affects Coolify versions prior to 4.0.0-beta.471.

• CVE-2026-35159MEDIUM 5.3

  Dell Client Platform BIOS has a security flaw that bypasses authentication controls. An attacker with physical access to the computer could circumvent security checks, potentially exposing sensitive information stored in system memory or BIOS settings. This is not a remote vulnerability—the attacker must have hands-on access to the machine.

• CVE-2026-3640MEDIUM 5.3

  The STRABL checkout plugin for WordPress has a critical flaw in how it handles webhook communications. The plugin exposes a REST API endpoint that accepts incoming order notifications without verifying that requests actually come from STRABL's servers. This means anyone on the internet can craft fake webhook messages to create bogus orders, modify existing orders, create user accounts, issue refunds, or cancel sales—all without authorization. The vulnerability affects all versions of the plugin up to and including 4.5.