By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 71 of 86

• CVE-2026-49472MEDIUM 5.3

  FreeSWITCH versions prior to 1.11.0 contain a flaw in their embedded XML parsing library that can cause the application to stop responding to requests. The vulnerability stems from code that was copied from an older, unpatched version of libexpat and never received the security fix that libexpat itself received. An authenticated user with local or network access could trigger this denial-of-service condition, though the attack requires specific conditions to succeed.

• CVE-2026-49843MEDIUM 5.3

  FreeSWITCH versions before 1.11.1 contain a session hijacking vulnerability in the mod_verto JSON-RPC handler. An unauthenticated attacker with knowledge of a legitimate user's session ID can forcibly disconnect that user by claiming the same session identifier, causing the legitimate connection to be dropped and any active calls to be terminated. The vulnerability stems from the application binding incoming connections to user-supplied session IDs before verifying authentication credentials.

• CVE-2026-4986MEDIUM 5.3

  The WPForms WordPress plugin fails to validate PayPal webhook authenticity, enabling attackers to forge payment notifications and alter transaction states without any credentials. This means an attacker could trick a WordPress site into believing a payment succeeded or failed when it didn't, potentially disrupting order fulfillment or revenue reconciliation.

• CVE-2026-49949MEDIUM 5.3

  CodexBar versions before 0.33.0 are vulnerable to credential interception through a flaw in how the application's shared HTTP transport handles redirects. A network-adjacent attacker can trick the application into following a redirect to a different host or downgrading from HTTPS to HTTP, causing it to leak sensitive credentials—such as browser cookies, bearer tokens, or API keys—to an attacker's server. The attack requires user interaction and works only against nearby network positions, but the confidentiality impact is high.

• CVE-2026-49955MEDIUM 5.3

  Hermes WebUI versions before 0.51.270 have a flaw that lets anyone on the internet repeatedly trigger authentication challenges without actually completing the login process. By flooding the authentication endpoint with requests, attackers can exhaust server resources—filling up disk space, consuming CPU cycles, and degrading service availability for legitimate users. No authentication is required to exploit this vulnerability.

• CVE-2026-50020MEDIUM 5.3

  Netty, a widely-used Java network framework, has a flaw in how it processes incoming HTTP requests. Before reading the first line of an HTTP request, Netty discards control characters (like NUL bytes and other non-printable characters) along with whitespace. While the HTTP specification allows servers to ignore blank lines before a request, Netty goes much further by silently accepting non-standard control bytes that RFC 9112 never intended servers to strip. In architectures where multiple components handle the same traffic—such as when requests flow through a front-end proxy to a back-end Netty service—this difference in character handling can create confusion about where one request ends and another begins, potentially allowing attackers to smuggle malicious requests or bypass security controls.

• CVE-2026-50128MEDIUM 5.3

  Mastodon, the open-source social network platform, contains a vulnerability in how it validates author attribution claims on posts. Attackers can forge or modify claims about where an article originated without being detected by Mastodon's signature verification system. This affects versions 4.3.0 through 4.5.10 (4.5.x line) and 4.4.0 through 4.4.17 (4.4.x line). The flaw lies in a JSON-LD configuration error that weakens cryptographic signing, allowing an attacker to tamper with authorship metadata on legitimately signed updates.

• CVE-2026-50226MEDIUM 5.3

  The AcerConnect OTA (Over-The-Air) application contains hard-coded encryption keys that attackers can exploit to forge authentication tokens for any device. An attacker with network access can use these fixed keys to pose as legitimate devices by spoofing IMEI numbers, granting them the ability to browse firmware catalogs and download protected binary files that should remain restricted. This is a confidentiality issue—attackers gain unauthorized read access to sensitive data, but cannot currently modify or delete it through this vector.

• CVE-2026-50233MEDIUM 5.3

  Lyrion Music Server version 9.2.0 has a flaw that allows attackers to browse any folder on the server's hard drive without authentication or permission. The vulnerability exists in a directory-listing function exposed through both a command-line service and a web interface. An attacker on the network can exploit this to discover sensitive files and system information, potentially uncovering credentials, configuration details, or other valuable data stored on the host.

• CVE-2026-50244MEDIUM 5.3

  Naxclow's device registration system has a flaw that lets anyone enumerate and count the devices in an organization's fleet without needing proper authorization. When registering a new device, the platform accepts signed requests but fails to verify that the caller actually owns the account or device they're claiming to register. Each registration call returns a counter showing how many devices are currently active in that batch, and an attacker can exploit this to map out the full scope of a target's device infrastructure.

• CVE-2026-5038MEDIUM 5.3

  multer, a popular Node.js middleware for handling file uploads, has a resource exhaustion vulnerability affecting versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1. When a multipart upload is aborted or arrives malformed, the library fails to clean up temporary partial files from disk. An unauthenticated attacker can repeatedly trigger these failed uploads to consume disk space until the server runs out, causing a denial of service. No special application code flaws are needed—the vulnerability is inherent to how multer manages stream cleanup.

• CVE-2026-50560MEDIUM 5.3

  Netty, a widely-used Java framework for building network servers and clients, has a flaw in how it handles HTTP/2 header size limits. When a client specifies a maximum header list size via the HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE parameter, Netty can be forced into a state where it crashes while attempting to send response headers back to the client. An attacker can exploit this to repeatedly trigger these crashes, effectively denying service to legitimate users—similar in impact to the HTTP/2 Rapid Reset attack but using different network-level mechanics. The vulnerability affects Netty versions before 4.1.135.Final and 4.2.15.Final.

• CVE-2026-50589MEDIUM 5.3

  OpenStack Ironic versions 32 through 36 contain a vulnerability that allows unauthenticated attackers to crash the service by sending specially crafted JSON payloads to certain API and JSON-RPC endpoints. An attacker requires only network access to the affected service and no credentials—they can disrupt availability without gaining deeper system access. The vulnerability was patched in version 37.0.0.

• CVE-2026-50629MEDIUM 5.3

  An OAuth2 server vulnerability allows attackers to inject malicious log entries by sending specially crafted requests with unvalidated control characters in the client ID parameter. The vulnerability does not leak sensitive data or directly crash the system, but it enables log manipulation—a tactic often used to cover attack tracks or create false evidence. Apache CXF versions prior to 4.2.2 and 4.1.7 are affected.

• CVE-2026-5078MEDIUM 5.3

  Morgan, a popular Node.js HTTP request logging middleware, has a vulnerability in how it handles usernames from HTTP Basic authentication. When processing login attempts, the logging middleware extracts the username and writes it to application logs without sanitizing special control characters like line breaks. An attacker can craft a fake login attempt with hidden line-break characters embedded in the username field, causing the log entry to split across multiple lines and appearing to contain forged log records. This can deceive downstream systems that rely on logs for security monitoring or compliance auditing.

• CVE-2026-52721MEDIUM 5.3

  GStreamer's pcapparse element contains multiple out-of-bounds read vulnerabilities that can be triggered when processing malformed PCAP (packet capture) files. An attacker could craft a specially crafted PCAP file with malicious IPv4/TCP header data that, when opened by a user, causes the application to read beyond allocated buffer memory. This can result in the application crashing or potentially exposing sensitive information from adjacent memory. The attack requires local access and user interaction—the target must be tricked into opening the malicious file—which limits the scope of real-world risk.

• CVE-2026-53442MEDIUM 5.3

  Jenkins fails to encrypt sensitive credentials when they are submitted via POST requests to update job configurations. Instead of storing these secrets securely, Jenkins saves them in plain text within job config.xml files on the controller. Any user with permission to read job details or anyone with file system access to the Jenkins controller can view these unencrypted secrets, creating a path for credential theft.

• CVE-2026-53467MEDIUM 5.3

  ImageMagick, a widely-used image editing and manipulation tool, contains a vulnerability in its MNG (Multiple-image Network Graphics) decoder that can leak sensitive memory contents. When processing certain MNG files, part of the image pixel data is not properly initialized, potentially exposing unintended information from the heap memory. An attacker can craft a malicious MNG file that, when processed by a vulnerable ImageMagick instance, causes the application to return heap data as part of the image output. This affects ImageMagick versions prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch).

• CVE-2026-5348MEDIUM 5.3

  A flaw in the Academy LMS WordPress plugin allows anyone on the internet to view detailed course curriculum information without logging in or being enrolled. The vulnerability exists in the plugin's REST API for managing course topics, which was misconfigured to accept requests from unauthenticated users. An attacker can exploit this by cycling through course IDs to discover what lessons, modules, or other curriculum details exist in courses marked as private, draft, scheduled, or password-protected—information that should only be visible to enrolled students or instructors.

• CVE-2026-53550MEDIUM 5.3

  js-yaml, a widely-used Node.js YAML parser, contains a denial-of-service vulnerability in its merge-key handling logic. An attacker can craft a malicious YAML document that exploits how the library processes merge operations (<<) by repeating aliases, causing the parser to consume excessive CPU time. The impact is significant for availability: a relatively small payload—just tens of kilobytes—can freeze a Node.js process for several seconds, disrupting application responsiveness or worker threads. The vulnerability has been patched in versions 4.2.0 and 3.15.0.

• CVE-2026-53851MEDIUM 5.3

  OpenClaw versions before 2026.5.12 fail to properly enforce the disabling of Slack reaction event notifications. When reaction notifications are toggled off in the configuration, the system still processes incoming Slack reaction events within its agent pipeline. An attacker can exploit this by sending reaction events to trigger unintended agent actions, circumventing the intended notification controls and potentially causing the system to process lower-trust input that should have been filtered out.

• CVE-2026-53947MEDIUM 5.3

  Ghost, a Node.js-based content management system, contains a vulnerability in its member signin endpoints that allows an unauthenticated attacker to discover whether an email address belongs to a registered member of a Ghost site. The flaw stems from inconsistent response patterns when valid versus invalid member emails are submitted, enabling email enumeration attacks. Versions 5.18.0 through 6.21.0 are affected; the issue is resolved in version 6.21.1.

• CVE-2026-53949MEDIUM 5.3

  Ghost, a popular Node.js-based content management system, contains a flaw in how it validates filter parameters on public API endpoints. Attackers can exploit this weakness to bypass security checks and access private fields that should be hidden, potentially including user password hashes. The severity of the exposure depends on the underlying database: SQLite instances leak complete password hashes, while MySQL instances lose case sensitivity information in hashes, which significantly hampers offline brute-force feasibility. The vulnerability affects Ghost versions 5.46.1 through 6.21.2, and the issue is resolved in version 6.21.2.

• CVE-2026-54022MEDIUM 5.3

  Open WebUI, a self-hosted AI platform, contains an authorization bypass that allows authenticated users to read private notes belonging to other users. The vulnerability stems from a mismatch between how the access control layer and the storage layer handle document identifiers. While the authorization check looks for note IDs with colons (note:123), the underlying storage system normalizes all colons to underscores (note_123). An attacker who knows or guesses a target user's note ID can simply request it using the underscore format, bypassing the ownership check and receiving the full private note contents. This affects Open WebUI versions before 0.8.11 and requires the attacker to be an authenticated user of the platform.

• CVE-2026-54029MEDIUM 5.3

  LibreChat, a self-hosted ChatGPT alternative that integrates multiple AI providers, contains an authorization flaw in its message deletion endpoint. An authenticated attacker can delete any other user's messages by exploiting a gap between authentication (which checks conversation ownership) and authorization (which does not check message ownership). The attacker supplies their own valid conversation ID to bypass initial validation, then targets a victim's message ID for deletion. Messages deleted this way cannot be recovered. The vulnerability affects all versions before 0.8.4-rc1 and is resolved in that release.

• CVE-2026-54036MEDIUM 5.3

  LibreChat versions prior to 0.8.4-rc1 contain a critical flaw in two-factor authentication (2FA) management. An attacker who has compromised a user's session token can call a specific API endpoint to completely reset that user's 2FA settings—overwriting their TOTP secret, invalidating backup codes, and disabling 2FA entirely—without needing to know or verify the existing 2FA credentials. This locks legitimate users out of their own account security while giving the attacker an open door to permanent access.

• CVE-2026-54105MEDIUM 5.3

  Two U.S. government systems used for federal contract disputes—the GAO's Electronic Protest Docketing System and the CBCA's Electronic Docketing System—leak user email addresses and account details through an unprotected API endpoint. An attacker can request information about any user account without logging in, simply by guessing or iterating user ID numbers. The systems fail to validate that a requester has permission to view account data belonging to someone else.

• CVE-2026-54236MEDIUM 5.3

  vLLM, a popular open-source engine for running and serving large language models, has a vulnerability that leaks sensitive memory addresses to clients. The issue stems from an incomplete fix to a prior vulnerability: while one code path was patched to hide memory addresses from error messages, several other code paths still expose this information. An attacker can exploit this by sending specially crafted image data through vLLM's Anthropic API endpoints, triggering an error that includes a memory address in the response. This leak could help an attacker defeat memory layout randomization (ASLR), a common defense against exploitation. The vulnerability affects vLLM versions before 0.23.1rc0 and requires no authentication to exploit.

• CVE-2026-54269MEDIUM 5.3

  protobufjs is a widely-used library that converts Protocol Buffer schema definitions into JavaScript code. Versions before 8.6.0 and 7.6.3 contain a flaw where certain field or service names—particularly hasOwnProperty, $type, and rpcCall—can collide with names reserved by protobufjs's internal runtime helpers. When a schema uses these conflicting names, the library may read attacker-controlled data from the schema instead of accessing its own safety mechanisms, potentially causing the application to crash or enter infinite loops during message decoding, validation, or RPC operations.

• CVE-2026-54270MEDIUM 5.3

  protobufjs, a popular JavaScript library for working with Protocol Buffers, has a memory exhaustion vulnerability in versions 8.2.0 through 8.4.2. When decoding untrusted protobuf messages, the library automatically stores unknown fields in memory without providing a way to discard them at decode time. An attacker can craft a malicious protobuf payload with many unknown fields that forces the decoded message to consume far more memory than the payload's raw size would suggest, potentially causing denial of service through resource exhaustion. The vulnerability affects applications that decode protobuf data from untrusted sources, particularly those handling user-supplied or network-sourced messages. Version 8.5.0 introduced options to control unknown-field retention, and version 8.6.2 made discarding unknown fields the default behavior.

• CVE-2026-54285MEDIUM 5.3

  OpenTelemetry's JavaScript implementation has a memory exhaustion vulnerability in its baggage header parsing logic. When the library processes inbound HTTP headers containing baggage data, it fails to validate the size of that data. An attacker can send abnormally large or numerous baggage entries, causing the application to allocate memory without limits, potentially degrading performance or crashing the service. The vulnerability exists only in the inbound parsing path; outbound validation was already in place. Version 2.8.0 and later address this issue.

• CVE-2026-54287MEDIUM 5.3

  Hono, a JavaScript web framework supporting multiple runtimes, has a flaw in how it handles HTTP cookies when deployed on AWS Lambda with either Application Load Balancer (ALB) or VPC Lattice v2. The framework incorrectly combines multiple Set-Cookie headers into a single comma-separated value. Since commas naturally appear in cookie attributes like expiration dates, clients cannot reliably parse them back into separate cookies, leading to silent data loss or misinterpretation. This affects cookie-based security controls and session management. The issue is resolved in version 4.12.25.

• CVE-2026-54300MEDIUM 5.3

  @astrojs/netlify versions before 7.0.13 contain a logic flaw in how remote image access patterns are converted for Netlify's Image CDN. When you define trusted image sources using wildcards—like *.example.com or /images/*—the adapter translates these rules incorrectly, allowing images from unintended hosts and paths to pass validation. For example, a wildcard subdomain pattern meant to match api.example.com would inadvertently permit requests from example.com itself (the apex domain), and a path pattern intended to restrict /images/* would match any deeper path like /images/foo/bar/baz. This creates an uncontrolled image loading vulnerability where the adapter grants Image CDN access to sources beyond your intended scope.

• CVE-2026-54470MEDIUM 5.3

  Dell Unisphere for PowerMax versions 10.3.0.5 and earlier contain an XML External Entity (XXE) vulnerability that allows a low-privileged remote attacker to read sensitive data without authorization. The vulnerability is difficult to exploit in practice—it requires valid user credentials and specific conditions—but when successfully exploited, it can expose confidential information stored or processed by the storage management system.

• CVE-2026-54500MEDIUM 5.3

  Oj is a widely-used Ruby gem for parsing JSON data. A flaw in versions before 3.17.3 causes the parser to leak uninitialized memory from the process stack when it encounters JSON objects with very long keys (254 bytes or more). An attacker can craft a malicious JSON payload to trigger this memory leak, potentially exposing sensitive data that happened to be in memory at that moment. The vulnerability is reachable over the network if your application parses untrusted JSON input.

• CVE-2026-54514MEDIUM 5.3

  Jackson-databind, a widely-used Java library for converting JSON to objects, has a DNS leakage vulnerability in versions before 2.18.8, 2.21.4, and 3.1.4. When an application deserializes untrusted JSON containing an InetSocketAddress field, the library performs an immediate DNS lookup on any hostname in that field—before the application has a chance to validate the data or decide whether to connect. This allows an attacker to force your systems to issue DNS queries to attacker-controlled domains, leaking information about what JSON you're processing and potentially enabling DNS-based attacks.

• CVE-2026-54515MEDIUM 5.3

  Jackson-databind, a widely-used Java library for converting JSON to Java objects, has a flaw that allows properties marked to be ignored during deserialization to become writable again in certain configurations. When a developer uses @JsonIgnoreProperties to exclude specific fields from being deserialized, and also enables case-insensitive property matching via @JsonFormat, the library incorrectly rebuilds its property filter from the unfiltered map, reinstating the very properties it should block. An attacker who can supply JSON input to an affected application could write to fields that should be protected, potentially modifying application state or bypassing business logic constraints.

• CVE-2026-54516MEDIUM 5.3

  Jackson-databind, a widely-used Java library for converting JSON to and from objects, has a flaw in how it handles property annotations. The bug allows attackers to write data to fields that should be protected by @JsonIgnore annotations when certain conditions are met. Specifically, if a class uses @JsonProperty to rename a getter but @JsonIgnore on the setter, an attacker can bypass the ignore directive by sending JSON with the renamed key, directly modifying the underlying field. This works because Jackson's property inference logic treats the backing field as writable even though the intended API forbids it. The vulnerability affects versions 2.21.0 through 2.21.4 and 3.1.4 (or earlier in the 3.x line prior to 3.1.4).

• CVE-2026-54517MEDIUM 5.3

  A flaw in Jackson's data-binding library allows attackers to bypass view-based access controls during JSON deserialization. When a JSON API uses @JsonView annotations to hide certain properties from specific clients or roles, this vulnerability can cause hidden collection or map properties to be populated anyway if they lack a setter method. An attacker sending crafted JSON can inject data into fields that should have been invisible, potentially modifying application state in unintended ways.

• CVE-2026-5459MEDIUM 5.3

  A WordPress plugin called User Frontend has a security flaw that allows anyone on the internet—without needing to log in—to change another user's subscription status. Specifically, an attacker can downgrade a paying customer to a free subscription tier, removing their paid features. The vulnerability exists in how the plugin handles subscription activation requests and fails to verify that the person making the request has permission to modify that user's account.

• CVE-2026-54665MEDIUM 5.3

  Apache NiFi versions up to 2.9.0 fail to validate certain HTTP headers that web proxies use to communicate the client's original hostname. An attacker can send specially crafted headers to trick NiFi into generating incorrect URLs for redirects or embedding in responses, potentially directing users to malicious sites or exposing data references. This is a header-injection vulnerability that affects the application's URL-building logic. The fix is available in NiFi 2.10.0, which adds validation for these proxy headers.

• CVE-2026-54712MEDIUM 5.3

  OpenTelemetry Java Instrumentation versions before 2.27.0 contain a denial-of-service vulnerability in the RMI context propagation handler. An attacker with network access to an exposed RMI endpoint can send specially crafted payloads that bypass size limits on individual context strings, forcing the instrumented JVM to allocate excessive memory. This can degrade or crash the application. The vulnerability only affects deployments where RMI instrumentation is explicitly enabled and the RMI endpoint is network-accessible.

• CVE-2026-55205MEDIUM 5.3

  Hermes WebUI versions before 0.51.468 contain a flaw in an unauthenticated login-flow endpoint that fails to limit how many simultaneous requests it processes. An attacker can repeatedly hit this endpoint to flood the server with memory-consuming state objects and worker threads, eventually exhausting available resources and causing the service to become slow or unresponsive. The endpoint also triggers outbound device-code requests to upstream OAuth providers, so repeated exploitation can trigger cascading load on those services as well.

• CVE-2026-55594MEDIUM 5.3

  ImageMagick, a widely-used open-source image processing toolkit, contains a stack overflow vulnerability in its MVG (Magick Vector Graphics) decoder. When processing a specially crafted image file, the decoder fails to validate recursion depth, allowing the stack to overflow and crash the application. An attacker can exploit this by sending a malicious image to any system running a vulnerable version of ImageMagick, causing a denial of service. The vulnerability affects versions prior to 6.9.13-51 (stable branch) and 7.1.2-26 (development branch).

• CVE-2026-55605MEDIUM 5.3

  DeepSeek MCP Server, a tool for integrating DeepSeek V4 AI capabilities, had a critical flaw in its self-hosted HTTP configuration: the main API endpoint accepted requests without any authentication. This meant anyone with network access to a running instance could interact with it as if they were an authorized user. They could initialize sessions, list available tools, and invoke local functions—including one that exposes session data and another that uses the server's own API credentials to make DeepSeek API calls. The issue affected versions 1.4.2 through 1.7.x, and self-hosted deployments using the default container configuration were particularly exposed since HTTP mode and port 3000 are enabled by default.

• CVE-2026-55686MEDIUM 5.3

  Podman, a widely-used container management tool, contains a symlink-handling vulnerability that allows a malicious container image to create directories or modify file ownership on the host system. The flaw exists in versions 3.0.0 through 5.7.0 and has been patched in version 5.7.1. An attacker would need to craft a container with a symlink in the WORKDIR path; modifying ownership requires additional coordination with a compromised host process during a race condition window, making that outcome less probable but still possible.

• CVE-2026-55726MEDIUM 5.3

  Gardyn's Azure Blob Storage container holding device logs is misconfigured to allow public listing without authentication. An attacker can browse and download any device log file stored in this container, potentially exposing sensitive operational and diagnostic information from connected devices.

• CVE-2026-55964MEDIUM 5.3

  wolfSSL's certificate verification code accepted intermediate CA certificates that claimed to be signing authorities (CA:TRUE) without properly checking that they possessed the required signing capability (keyCertSign). This loophole applied specifically to temporary CAs injected during certificate chain building in OpenSSL-compatible mode, not to user-loaded root certificates. An attacker could potentially use a malformed intermediate certificate in a chain to bypass security checks and gain unauthorized signing privileges, though actual exploitation depends on how applications use the verified certificate chain.

• CVE-2026-56021MEDIUM 5.3

  Webmin contains a flaw that allows anyone on the network to read sensitive configuration files without logging in. The vulnerability bypasses a validation filter that's supposed to block access to .conf files in module directories. An attacker can exploit this to extract configuration data that may contain credentials, API keys, or other sensitive information. This is a straightforward information disclosure issue with moderate severity.

• CVE-2026-56022MEDIUM 5.3

  Webmin contains an authentication bypass vulnerability that allows attackers to skip multi-factor authentication (MFA) requirements by sending a specially crafted HTTP header. An attacker can log in using basic credentials without providing session cookies, provided they include 'User-Agent: webmin' in their request. This undermines the security controls that organizations rely on to protect administrative access. The issue affects Webmin versions prior to 2.641.

• CVE-2026-56099MEDIUM 5.3

  OpenBSD systems running versions before commit 6a23123 (released 2026-06-18) are vulnerable to a memory disclosure flaw in their MPLS networking stack. An attacker on the network can send specially crafted MPLS frames to trigger an out-of-bounds read, potentially leaking sensitive data from the kernel's memory. This is a remote attack requiring no authentication or user interaction, but the impact is limited to information disclosure—no system compromise or denial of service.

• CVE-2026-56113MEDIUM 5.3

  dhcpcd, a widely-used DHCP client daemon, contains a memory safety bug that can be triggered by a malicious DHCPv6 server on the same network. An attacker who can send a specially crafted DHCPv6 renewal message can cause dhcpcd to crash. The vulnerability exists in how dhcpcd manages IPv6 address delegation—specifically when an attacker sets both lifetime values to zero in a prefix delegation exclusion option. Versions through 10.3.2 are affected; the fix is available in commit 5733d3c and later releases.

• CVE-2026-56114MEDIUM 5.3

  dhcpcd, a widely-used DHCP client for Unix-like systems, contains a stack memory vulnerability that can be triggered by an attacker on the same network segment. An attacker can send a specially crafted DHCPv6 advertisement message that causes dhcpcd to write one byte past the boundary of an internal buffer. While this is a limited write (one byte), it occurs on the stack and can corrupt adjacent memory structures, potentially leading to a denial of service. The vulnerability affects dhcpcd versions up to 10.3.2 and has been fixed in a subsequent commit.

• CVE-2026-56139MEDIUM 5.3

  Apache Camel's Undertow HTTP component has a configuration flaw that causes it to leak sensitive information through error messages. When a client sends a request that triggers an exception, the server returns the full Java stack trace to the requester instead of a generic error response. This happens because the component defaults to exposing exceptions (muteException=false), contrary to other Camel HTTP components. An attacker who can reach an affected endpoint and cause any processing error—such as sending malformed data or invalid parameters—receives detailed internal information including credentials, hostnames, file paths, database names, and application architecture details. The flaw is particularly dangerous in Rest DSL deployments, where the mitigation option is completely ignored even if configured.

• CVE-2026-56152MEDIUM 5.3

  Elastic Defend contains an authorization flaw that allows low-privileged authenticated users to view response action data they should not have access to. The vulnerability exploits a gap in access control enforcement, enabling information disclosure under specific conditions. An attacker would need valid credentials and network access to the affected system, but the barrier to exploitation is moderately high due to the required conditions.

• CVE-2026-56213MEDIUM 5.3

  Capgo, a mobile app update and deployment platform, has a security flaw where an unauthenticated attacker can modify application version metadata through a publicly accessible API endpoint. By sending requests with basic authentication credentials, an attacker can insert fake data into any application's version records, corrupting the metrics and statistics that operators rely on for monitoring. This poisoning attack doesn't steal data or crash systems, but it pollutes the information dashboards display, potentially triggering false alarms and undermining confidence in application health metrics.

• CVE-2026-56218MEDIUM 5.3

  Capgo versions before 12.128.2 do not remove sensitive location data embedded in images that users upload to the platform. When someone uploads a photo taken with a smartphone or modern camera, that device typically records GPS coordinates, timestamps, and other metadata in the image file itself. Capgo fails to strip this data before storing or serving the image, meaning anyone who downloads an uploaded image can extract the precise latitude and longitude showing exactly where and when the photo was taken. This allows attackers to discover where users were physically located at specific moments, posing a privacy and safety risk.

• CVE-2026-56234MEDIUM 5.3

  Capgo versions before 12.128.2 have a flaw in their password validation endpoint that allows anyone on the internet to check user passwords without needing to log in. The endpoint is misconfigured to accept requests from any website and has no protection against repeated attempts, making it straightforward for attackers to systematically try common passwords or stolen credential lists against user accounts. This credential stuffing vulnerability can lead to unauthorized account access.

• CVE-2026-56235MEDIUM 5.3

  Cap-go capgo versions before 12.128.2 expose a flaw where three database query functions (get_app_metrics, get_global_metrics, get_total_metrics) can be called by anyone without authentication. An attacker only needs Cap-go's public API key to request usage data for any organization, including ones they don't belong to. This allows leaking how many users each org has, bandwidth consumption, app installation counts, and which apps belong to a target organization. Additionally, an attacker can determine whether a specific organization exists in the system.

• CVE-2026-56282MEDIUM 5.3

  Capgo versions before 12.128.2 expose sensitive database replication information through an unauthenticated endpoint. An attacker can access the /replication endpoint without logging in to retrieve PostgreSQL replication slot names, write-ahead log (WAL) positions, and other infrastructure telemetry. This reconnaissance data could help an adversary understand your database topology and replication strategy without needing valid credentials.

• CVE-2026-56284MEDIUM 5.3

  Capgo, a platform for managing mobile app updates, has an information disclosure flaw that allows anyone on the internet to retrieve sensitive operational metrics about organizations using the service. An attacker doesn't need valid credentials—they only need a valid organization identifier (UUID) and can then extract data like monthly active users, bandwidth consumption, and app installation counts. This works because a backend database function that should be restricted is accidentally callable by anonymous users. The vulnerability was patched in version 12.128.2.

• CVE-2026-56299MEDIUM 5.3

  Capgo, a software build and deployment tool, has a security flaw that lets attackers bypass authentication on a specific upload endpoint. By sending specially crafted HTTP OPTIONS requests, an attacker can trigger errors repeatedly without needing valid credentials. This causes the service to become unavailable—a denial-of-service attack. The vulnerability affects versions before 12.128.2.

• CVE-2026-56311MEDIUM 5.3

  Capgo before version 12.128.2 has a security flaw that allows anyone on the internet to view billing and plan information about any organization, even without logging in. An attacker only needs to know an organization's ID and can call a specific function to retrieve sensitive details like monthly active user limits, bandwidth allowances, storage quotas, and build time restrictions. This is a data disclosure vulnerability that exposes business-critical information.

• CVE-2026-56316MEDIUM 5.3

  Cap-go versions before 12.128.2 expose a weakness in how the build upload endpoint responds to requests. An attacker doesn't need credentials to send specially crafted requests and figure out which job IDs are real ones based on how the server responds. This allows them to probe the system repeatedly, potentially causing performance issues through sustained unauthenticated traffic.

• CVE-2026-56318MEDIUM 5.3

  Capgo versions before 12.128.2 contain a flaw that leaks information about which organization IDs exist in the system. An attacker without any authentication can send requests to a password validation endpoint and observe whether the system returns different error messages or status codes depending on whether an organization ID is real or fake. By systematically probing the endpoint, an attacker can build a list of valid organization UUIDs, effectively enumerating the platform's organizational structure. This is a reconnaissance-enabling vulnerability that does not allow direct data theft or system manipulation on its own, but significantly reduces the attacker's reconnaissance effort.

• CVE-2026-56321MEDIUM 5.3

  Capgo's backend authentication system has an inconsistency: the GET endpoint for retrieving role bindings in a specific organization doesn't require authentication before reaching the application code, while the POST and DELETE endpoints do. The endpoint itself still rejects unauthenticated requests with an 'Unauthorized' response, so the vulnerability doesn't directly leak data today. However, this architectural mismatch creates a maintenance risk—if the application-level authorization check is removed or modified in future updates, the missing middleware layer would fail to catch it, potentially exposing sensitive organizational role information.

• CVE-2026-56327MEDIUM 5.3

  Capgo versions before 12.128.2 contain a flaw that lets unauthenticated attackers figure out which organizations exist in the system. An attacker can use a publicly available API key to call a specific function and observe whether the system responds with 'organization doesn't exist' versus 'you don't have permission.' By comparing these two different error messages, an attacker can methodically discover which organization IDs are valid, essentially mapping out the tenant structure without needing legitimate credentials.

• CVE-2026-56331MEDIUM 5.3

  Capgo versions prior to 12.128.2 contain a vulnerability where the invitation acceptance endpoint fails to properly handle invalid input, causing the server to respond with a 500 error instead of a standard client error. This allows attackers to submit malformed invitation codes and observe server errors that may reveal internal system details. The vulnerability requires only the public key to trigger and cannot be exploited for authentication bypass or data modification, but the information leakage could support reconnaissance activities.

• CVE-2026-56337MEDIUM 5.3

  Capgo versions before 12.128.2 expose a flaw that lets anyone on the internet discover which app IDs exist in the platform's database. An unauthenticated attacker can probe the system by sending requests to a specific endpoint, learning whether apps with particular IDs have been registered. This leaks information across different tenants and undermines privacy boundaries—an attacker could methodically enumerate apps belonging to other organizations.

• CVE-2026-56338MEDIUM 5.3

  Capgo versions prior to 12.128.2 have a denial-of-service flaw in their two-factor authentication system. When users attempt to verify their email address as part of 2FA setup, a broken captcha validation process causes the authentication endpoint to fail repeatedly with server errors. This prevents users from completing 2FA enrollment, leaving accounts without this critical security layer—a particularly concerning impact since the vulnerability blocks access to security controls rather than enabling unauthorized access.

• CVE-2026-56371MEDIUM 5.3

  ImageMagick, a widely-used image processing library, contains a memory leak when handling specially crafted TXT files that include texture attributes. The vulnerability occurs because the software fails to properly clean up memory allocated during texture processing when a subsequent operation fails, causing memory to be progressively consumed with each malicious file processed. An attacker can exploit this by sending or hosting a crafted TXT file that, when processed by a vulnerable ImageMagick installation, exhausts available memory and causes a denial of service.

• CVE-2026-56762MEDIUM 5.3

  Hono, a popular web framework, has a vulnerability in how it handles cookie names when developers use user-controlled input. Before version 4.12.12, the framework doesn't properly validate cookie names, allowing special characters like line breaks to slip through. While modern JavaScript runtimes (Node.js, Cloudflare Workers) actively reject these malformed cookies and prevent them from being sent, the result is a runtime crash rather than a successful attack. This means your application stops responding rather than being exploited for data theft or tampering.

• CVE-2026-56781MEDIUM 5.3

  Teable, a database and collaboration platform, contains a flaw that allows anyone on the internet to read data fields that administrators intended to hide from public view. An attacker can discover which fields exist by examining metadata shared with them, then request those hidden fields by name when viewing shared records. The vulnerability affects Teable versions released before June 15, 2026, and requires no authentication or user interaction to exploit.

• CVE-2026-57021MEDIUM 5.3

  Juniper Networks Junos OS on SRX Series devices contain a memory handling flaw in their web management component that allows remote attackers to knock the system offline. If your SRX is configured to perform security checks before users log in to the VPN, an attacker can send specially crafted network traffic that crashes the web service, taking down VPN access, J-Web management, and firewall authentication until the service restarts on its own. No authentication or user interaction is needed to trigger this problem.

• CVE-2026-57024MEDIUM 5.3

  Juniper's IKE daemon (iked) on MX devices with SPC3 and SRX Series routers contains a flaw that causes it to crash repeatedly when handling a large number of failed VPN connection attempts. The underlying issue stems from the daemon reusing peer index values that are already assigned, leading to internal state conflicts. Each time iked crashes, it becomes unable to establish new VPN tunnels or refresh existing ones until the entire system is rebooted. An attacker on the network can trigger this by initiating many unsuccessful VPN negotiations, effectively disabling VPN connectivity for an extended period.

• CVE-2026-57029MEDIUM 5.3

  A synchronization flaw in Juniper's Junos OS Evolved operating system can crash the flow collector handler on QFX Series switches when sFlow collector reachability changes at the same moment the sFlow thread reads network routing data. An adjacent attacker without authentication can trigger this race condition, forcing the packet forwarding engine (evo-pfemand process) to restart and briefly interrupting all traffic until recovery completes. The vulnerability affects multiple recent versions of Junos OS Evolved on QFX10008, QFX10016, QFX51xx, and QFX52xx platforms.

• CVE-2026-57079MEDIUM 5.3

  Net::BitTorrent, a Perl BitTorrent client library, contains a path traversal vulnerability that allows remote attackers to write files outside the intended download directory. When a peer sends specially crafted metadata—either through magnet links or the BEP09 ut_metadata extension—an attacker can embed directory traversal sequences (".." path components) that the library fails to sanitize. This allows writing malicious files to arbitrary locations on the victim's system with the privileges of the downloading user. The attacker controls both the file content and its destination path, making this a serious integrity risk for systems running vulnerable versions.

• CVE-2026-57436MEDIUM 5.3

  Nokogiri, a popular Ruby library for parsing and manipulating XML and HTML documents, contains a memory safety bug in versions prior to 1.19.4. The vulnerability allows an attacker to set an invalid type of object (specifically a DTD node) as a document's root element, bypassing validation checks. This causes the library to crash or behave unpredictably when the invalid structure is processed during garbage collection. The issue is resolved in version 1.19.4 and later.

• CVE-2026-57437MEDIUM 5.3

  Nokogiri, a widely-used Ruby library for parsing XML and HTML, contains a memory safety issue in its XPath evaluation feature. If application code manually creates an XPathContext object and then allows the underlying XML/HTML document to be garbage collected while the context is still in use, subsequent XPath queries can read from freed memory, potentially crashing the application. This is a narrow vulnerability—it requires specific patterns in application code and cannot be triggered by feeding a malicious document to the library. The standard document search methods (Document#xpath, Document#css) are not affected.

• CVE-2026-57451MEDIUM 5.3

  Vim, the popular command-line text editor, contains a buffer over-read vulnerability in how it processes text properties stored within files. When Vim opens a specially crafted undo file, it may read far beyond the intended data boundaries, causing the application to crash. The vulnerability exists because Vim trusts a count value in the file without validating it against the actual data present. An attacker would need to convince a user to open a malicious undo file, but no special privileges or complex setup are required.

• CVE-2026-57587MEDIUM 5.3

  A SQL injection flaw in Nessus allows an unauthenticated attacker to manipulate reverse DNS records for a host being scanned, then inject malicious SQL commands into Nessus's scan results database. This could let the attacker read sensitive data from scan results without needing valid credentials. The attack requires the attacker to control DNS infrastructure for a target host, which limits the scope but is feasible in some network configurations.

• CVE-2026-57630MEDIUM 5.3

  Blocksy Companion Pro versions up to 2.1.46 contain an Insecure Direct Object References (IDOR) vulnerability that allows attackers to access sensitive information without authentication. An attacker can bypass access controls by directly referencing object identifiers—such as user IDs or resource handles—and retrieve data they shouldn't have permission to view. This is a network-based attack requiring no special privileges or user interaction, making it straightforward to exploit.

• CVE-2026-57633MEDIUM 5.3

  WCBoost – Products Compare, a WordPress plugin, exposes sensitive information to unauthenticated users in versions 1.1.0 and earlier. An attacker can access data without authentication due to improper access controls, though the data itself is not modified or service availability compromised. This is a localized but meaningful exposure risk for sites relying on this plugin.

• CVE-2026-57652MEDIUM 5.3

  JS Help Desk versions 3.1.0 and earlier contain an unauthenticated IDOR vulnerability that allows attackers to access sensitive information without logging in. An attacker can bypass authentication mechanisms and retrieve data they shouldn't have access to by manipulating object references in requests. This is a confidentiality risk but does not enable data modification or system disruption.

• CVE-2026-57660MEDIUM 5.3

  Booking and Rental Manager versions 2.7.1 and earlier contain a flaw that allows unauthenticated attackers to modify data without proper access controls. An attacker can exploit this vulnerability by sending direct requests to the application without logging in, potentially altering booking records, rental information, or other critical business data. No authentication is required, making this a network-accessible vulnerability that could be discovered and exploited relatively easily.

• CVE-2026-57721MEDIUM 5.3

  WP Reloaded ApplyOnline contains a missing authorization flaw that allows attackers to bypass access controls and modify data they should not have permission to change. The vulnerability stems from incorrectly configured security levels that fail to properly validate user permissions before allowing certain actions. An attacker on the network can exploit this without needing credentials or user interaction, potentially altering application data or settings.

• CVE-2026-57750MEDIUM 5.3

  A security vulnerability exists in ez Form Calculator Premium versions 2.14.1.2 and earlier that allows attackers to modify data without authentication. The flaw stems from insufficient access controls, meaning anyone with network access—no login required—can potentially alter form submissions or configurations. This is classified as a medium-severity issue because while the integrity of data can be compromised, there is no exposure of sensitive information or service disruption in the vulnerability itself.

• CVE-2026-57753MEDIUM 5.3

  The Kit for WooCommerce plugin (formerly ConvertKit) up to version 2.1.5 contains a flaw that allows unauthenticated attackers to access sensitive data. An attacker does not need credentials or user interaction to exploit this issue. The vulnerability exposes information that should remain confidential, though it does not enable modification of data or service disruption. WooCommerce sites running the affected plugin versions are at risk of information disclosure.

• CVE-2026-57760MEDIUM 5.3

  Sendcloud Shipping contains a missing authorization flaw that allows attackers to manipulate access control settings. Because the vulnerability lacks proper permission checks, an unauthenticated attacker can modify authorization levels without needing valid credentials or user interaction. This could enable unauthorized changes to shipping configurations or access permissions within affected installations.

• CVE-2026-57923MEDIUM 5.3

  JetBrains YouTrack versions before 2026.2.16593 contain an authorization bypass in the application configurations endpoint that allows authenticated users to modify project settings they should not have access to. An attacker with valid login credentials could escalate privileges within a YouTrack instance by changing project configurations without proper permission validation.

• CVE-2026-57942MEDIUM 5.3

  LibreTranslate versions up to 1.9.7 contain a header spoofing vulnerability that allows attackers to forge client IP addresses. By injecting fake values into the X-Forwarded-For HTTP header, unauthenticated attackers can bypass rate limiting and flood protections designed to prevent API abuse. This enables attackers to send unlimited requests from what appear to be different IP addresses, potentially exhausting service availability or overwhelming the translation API.

• CVE-2026-57952MEDIUM 5.3

  Mythic, a command-and-control framework, contains a flaw that allows operators with access to one attack operation to view sensitive configuration details—including encryption keys—from a completely different operation. This works because four specific API endpoints do not properly verify that a request belongs to the operation it claims to access. An attacker with any valid operator account can exploit this by guessing or knowing a configuration ID from another operation and accessing its secrets. The vendor patched this in version 3.4.0.60.

• CVE-2026-57962MEDIUM 5.3

  Thunderbird users who have configured LDAP (Lightweight Directory Access Protocol) servers for address-book autocomplete are vulnerable to a denial-of-service attack. A malicious LDAP server can respond with extremely large amounts of data that Thunderbird attempts to store, eventually consuming all available memory and crashing the application. An attacker would need to either control an LDAP server that a victim queries, or intercept traffic to a legitimate LDAP server. This is not a data breach or code execution risk, but it can disrupt email service availability.

• CVE-2026-57994MEDIUM 5.3

  phpMyFAQ versions before 4.1.5 contain a flaw that allows anyone on the internet to view draft or unpublished FAQ content that administrators intended to keep private. The vulnerability stems from inconsistent filtering rules across different API endpoints—some endpoints check whether content should be public before returning it, while others do not. An attacker can exploit this by querying the API directly to retrieve full FAQ text, question titles, and preview content from inactive items.

• CVE-2026-58203MEDIUM 5.3

  pydantic-settings is a Python library that manages application configuration through Pydantic models. Versions 2.12.0 through 2.14.1 contain a flaw in how they handle secret files stored in a designated secrets directory. When the nested subdirectory feature is enabled, the library will follow symbolic links (shortcuts) that point outside the intended secrets directory, allowing it to read arbitrary files from the system. An attacker with write access to the secrets directory—such as in a shared or world-writable mount—can create malicious symbolic links to trick the application into loading sensitive files from anywhere on the system. This also bypasses the documented size limit protection meant to prevent loading oversized files.

• CVE-2026-58369MEDIUM 5.3

  Woodpecker versions before 3.15.0 contain a flaw where an unauthenticated user can send requests to a specific endpoint (/api/orgs/lookup/*org_full_name) that the application fails to properly protect. When the endpoint receives these requests, it attempts to use information from a user session that doesn't exist, causing the application to crash briefly. The crash is caught by error handling code so the service keeps running, but each malicious request fills the logs with 37+ lines of error details. An attacker can exploit this by repeatedly sending requests to intentionally bloat log files, consuming disk space and potentially hiding legitimate security events.

• CVE-2026-58470MEDIUM 5.3

  GNU Wget, the widely-used command-line download utility, contains a flaw in how it parses HTTP Content-Range headers sent by servers. An attacker controlling a web server can craft a specially malicious Content-Range header that causes Wget to perform incorrect integer math, leading to unpredictable behavior and download corruption. The vulnerability affects Wget versions through 1.25.0 and has been patched in the project's commit 43d3ba9.

• CVE-2026-59097MEDIUM 5.3

  Taiga, a popular open-source project management and agile planning platform, contains a gap in access controls that allows anyone on the internet to manipulate due-date records within projects without needing to log in. An attacker can create default due-date entries for user stories, tasks, and issues in any project by simply knowing or guessing the project ID. This pre-empts legitimate administrators from setting up their own due dates and can cause confusion or operational disruption. The vulnerability affects versions before 6.10.2.

• CVE-2026-59218MEDIUM 5.3

  Open WebUI versions before 0.10.0 contain a user enumeration vulnerability in the sign-in endpoint. The flaw allows an attacker to determine whether an email address is registered by measuring response times: accounts that exist take longer to reject (because the system verifies a password), while non-existent accounts are rejected faster. This leaks information about registered users without needing valid credentials.

• CVE-2026-59511MEDIUM 5.3

  A vulnerability in Exclusive Addons Elementor, a WordPress plugin providing extended functionality for the Elementor page builder, allows sensitive information to be embedded and transmitted in outbound data. The flaw stems from improper handling of sensitive data during the plugin's normal operation, potentially exposing information that should remain private. Versions through 2.7.9.9 are affected. While the attack requires no user interaction and can be initiated remotely, the impact is limited to confidentiality—data disclosure rather than system compromise or modification.