By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 72 of 86

• CVE-2026-59519MEDIUM 5.3

  Softaculous FormLayer versions up to 1.0.6 inadvertently expose sensitive information in network traffic by including it in outbound data where it shouldn't be. An attacker on the network path can retrieve this sensitive data without needing authentication or user interaction. This is a moderate-severity issue that affects the confidentiality of information processed by the affected plugin.

• CVE-2026-59817MEDIUM 5.3

  Ghost, a Node.js-based content management system, contains a vulnerability in its donation checkout feature that allows unauthenticated attackers to manipulate checkout metadata. By exploiting this flaw, attackers can obtain paid gift memberships at a fraction of their intended cost, effectively devaluing your membership revenue stream. The vulnerability affects versions 6.27.0 through 6.43.x and is resolved in version 6.44.0.

• CVE-2026-59828MEDIUM 5.3

  Discourse, an open-source discussion platform, contains a vulnerability that allows post revision history to leak information that should remain hidden from regular users. When users view adjacent post revisions, the serialization process can expose diffs that include content from hidden revisions. This affects instances running Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5. The leak occurs through normal diff display functionality rather than requiring special privileges, though the impact is limited to information disclosure.

• CVE-2026-59868MEDIUM 5.3

  js-yaml, a popular JavaScript library for parsing YAML files, contains a performance vulnerability in versions 5.0.0 through 5.1.x. When YAML merge keys are enabled, an attacker can craft a malicious document that causes the parser to consume quadratic amounts of CPU time despite the document itself growing only linearly in size. This creates a denial-of-service condition where relatively small payloads trigger disproportionate computational overhead. The vulnerability is resolved in version 5.2.0.

• CVE-2026-59870MEDIUM 5.3

  js-yaml, a popular JavaScript library for parsing YAML files, contains a performance vulnerability in its ordered-map (omap) tag handling. When processing specially crafted YAML documents, the library performs redundant duplicate-key checks that consume excessive CPU resources, potentially causing denial-of-service conditions. The vulnerability affects versions 5.0.0 through 5.2.0 and is resolved in version 5.2.1.

• CVE-2026-59871MEDIUM 5.3

  node-tar, a popular Node.js library for handling tar archives, has a flaw in how it processes certain archive metadata. When a tar file contains paths or link targets that are purely numeric values, the library incorrectly converts them into JavaScript numbers instead of treating them as text. This conversion breaks downstream code that expects to work with file paths as strings, causing the application to crash with an uncaught error. The issue affects versions prior to 7.5.18 and has been patched in that release.

• CVE-2026-59875MEDIUM 5.3

  A vulnerability in node-tar, a popular Node.js library for reading and writing tar archives, allows an attacker to craft a malicious tar file that crashes applications processing it. The flaw stems from improper handling of special characters (NUL bytes) embedded in file path metadata within tar archives. When an affected version of node-tar encounters such an archive, the resulting error terminates the application unexpectedly, causing a denial of service. This impacts any Node.js application that extracts or processes untrusted tar files without additional validation.

• CVE-2026-59877MEDIUM 5.3

  protobufjs, a JavaScript library that converts Protocol Buffer schema definitions into executable code, contains a parsing vulnerability in versions before 7.6.5 and 8.6.6. An attacker who supplies a malformed .proto schema file can trigger an infinite loop during parsing, causing the application to hang indefinitely. This affects any developer or system that loads untrusted protobuf schemas using the vulnerable library versions.

• CVE-2026-59927MEDIUM 5.3

  Mistune, a popular Python Markdown parser, contains a flaw in how it handles file inclusion directives. When two Markdown files are set up to include each other (either directly or through a chain), the parser enters an infinite loop trying to resolve the circular reference. This causes the application to crash with a RecursionError rather than gracefully detecting and rejecting the cycle. The vulnerability was introduced because the inclusion logic only checked for immediate self-references but missed indirect circular dependencies. The issue affects all versions prior to 3.3.0.

• CVE-2026-59938MEDIUM 5.3

  A memory exhaustion vulnerability exists in pypdf, a popular open-source Python PDF library. An attacker can craft a malicious PDF file that declares image dimensions far larger than the actual image data contained within it. When pypdf processes such a file, it allocates excessive memory based on the declared sizes, leading to memory exhaustion and denial of service. The flaw affects all versions prior to 6.14.0 and is resolved in that release.

• CVE-2026-60086MEDIUM 5.3

  PraisonAI versions before 4.6.78 have a weakness in their prompt injection defense system. The defense is designed to block dangerous attacks, but it only stops threats it classifies as CRITICAL—which requires matching three or more threat detection families at once. Attackers can bypass this by crafting simpler prompt injections that are classified as HIGH severity instead, allowing malicious inputs to reach the underlying AI model without being blocked.

• CVE-2026-6046MEDIUM 5.3

  Mattermost has a vulnerability in its bot registration process that fails to properly verify bot account ownership. An attacker with basic user access can register a standard user account using a name that matches a plugin bot's predictable username. This allows them to intercept private messages intended for that bot—messages that often contain sensitive information passed between plugins and administrators. The vulnerability affects multiple Mattermost versions across the 11.6, 11.5, and 10.11 release lines.

• CVE-2026-6092MEDIUM 5.3

  CVE-2026-6092 is a cryptographic implementation flaw in WolfSSL where the library may unexpectedly downgrade from the stronger Encrypt-then-MAC mode to the weaker MAC-then-Encrypt mode, even when configured to enforce Encrypt-then-MAC. This downgrade weakens the integrity guarantees of TLS connections by allowing potential plaintext recovery attacks. An attacker on the network can exploit this without authentication to read sensitive data transmitted over affected connections.

• CVE-2026-61344MEDIUM 5.3

  California's Superior Court Hearing Reminder Service (HRS) at https://www.hrs.courts.ca.gov contains an API endpoint that leaks court hearing reminder records to anyone on the internet without requiring login credentials. The exposed data is not encrypted or restricted, meaning an attacker can retrieve potentially sensitive case and scheduling information simply by querying the endpoint. This is a missing authentication issue affecting a public government service.

• CVE-2026-6450MEDIUM 5.3

  A flaw in how WolfSSL processes certificate revocation lists (CRLs) allows specially crafted CRLs with unrecognized critical extensions to bypass validation checks. When a CRL carries a valid signature, the library should reject any critical extensions it doesn't understand—but this implementation fails to do so. An attacker could supply a malicious CRL that appears legitimate to certificate validation logic, potentially leading to acceptance of certificates that should have been revoked. This affects only WolfSSL builds compiled with CRL support enabled.

• CVE-2026-6678MEDIUM 5.3

  A flaw in wolfSSL's PKCS#7 decryption function can cause incorrect handling of encrypted data when processing specially crafted messages. The vulnerability stems from an integer underflow—a mathematical error where a calculation produces a value smaller than intended—affecting how the library determines the length of decrypted content. While this does not expose encrypted data or allow an attacker to decrypt messages they shouldn't access, it can cause the decryption process to fail or behave unexpectedly, potentially leading to a denial of service.

• CVE-2026-6681MEDIUM 5.3

  wolfSSL versions 5.9.0 and earlier contain a buffer overflow vulnerability in their PKCS#7 decoding functionality. When applications call the PKCS#7 decoder and provide a buffer along with its size, the decoder ignores the size limit and writes decoded data beyond the buffer boundary. An unauthenticated remote attacker can exploit this to corrupt memory and potentially modify application state or behavior. The vulnerability was patched in wolfSSL 5.9.1.

• CVE-2026-6798MEDIUM 5.3

  The 2Download Connector for 2DL Hosted Checkout WordPress plugin contains a critical authorization flaw that exposes subscription data to anyone on the internet. An attacker without any login credentials can access another customer's subscription details—including whether their subscription is active, what they purchased, order numbers, and renewal dates. The vulnerability affects all versions up to 0.1.5 and requires immediate patching.

• CVE-2026-6802MEDIUM 5.3

  A WordPress plugin called Easy Upload Files During Checkout contains a security flaw that allows anyone on the internet to delete files from a site's media library without needing a password or any special access. The vulnerability exists in versions 3.0.1 and earlier. An attacker could exploit this to remove important images, documents, or other media, potentially disrupting site operations or destroying content.

• CVE-2026-6937MEDIUM 5.3

  A WordPress plugin called 'Appointment Booking Calendar — Simply Schedule Appointments' has a flaw that allows anyone on the internet to view and modify appointment data without logging in. Attackers can change appointment details, payment status, meeting links, and steal customer information by exploiting a predictable security token that's visible in the HTML of booking pages. The vulnerability affects all versions up to 1.6.11.8.

• CVE-2026-6964MEDIUM 5.3

  A WordPress plugin for video conferencing with Zoom has a flaw that allows anyone on the internet to obtain sensitive credentials—specifically the site's Zoom SDK API key and a signed authentication token—without needing to log in or have permission. An attacker with these credentials can use Zoom's Web SDK to join any meeting hosted through that Zoom account, bypassing the normal meeting access controls. The vulnerability affects all versions of the plugin up to and including 4.6.7.

• CVE-2026-7552MEDIUM 5.3

  The Geo Mashup plugin for WordPress has a flaw that allows anyone on the internet to retrieve sensitive configuration information without needing to log in or have any authorization. Specifically, attackers can obtain Google Maps API keys and GeoNames service credentials stored in the plugin's settings. This happens because the plugin fails to properly check whether a request is coming from someone who should actually have access to that data.

• CVE-2026-7558MEDIUM 5.3

  A WordPress plugin called Age Verification & Identity Verification by Token of Trust allows anyone visiting a website—even without logging in—to download sensitive donation and order information by simply adding a special web address parameter. The plugin doesn't check whether visitors have permission to access this data, meaning attackers could collect details about charitable donations, order IDs, dates, and internal admin links without any authentication. All versions up to 4.0.2 are affected.

• CVE-2026-7617MEDIUM 5.3

  The Secufor_OAuth plugin for WordPress contains an authorization flaw that allows unauthenticated attackers to disconnect a WordPress site from its linked Secufor account. An attacker can clear the plugin's stored authentication token and user login configuration without needing any valid credentials or permission. This creates a denial-of-service condition for legitimate users trying to access their Secufor-integrated authentication system.

• CVE-2026-7651MEDIUM 5.3

  A widely-used WordPress membership plugin contains a flaw that allows any logged-in user with basic subscriber privileges to delete media files (images, documents, etc.) that belong to other users, including administrators. The plugin fails to verify ownership before allowing deletion, meaning an attacker could systematically destroy important content without authorization. This affects all versions up to 5.1.5.

• CVE-2026-7665MEDIUM 5.3

  A WordPress plugin called Essential Addons for Elementor contains a flaw that allows anyone on the internet to view sensitive posts they shouldn't be able to see—including password-protected pages, private posts, and draft content. The vulnerability exists in a feature called 'ajax_load_more' that doesn't properly check permissions before returning post data. An attacker needs only a web browser; no login credentials or special interaction is required.

• CVE-2026-7765MEDIUM 5.3

  Checkmk contains a flaw in how it controls access to user messages through its dashboard feature. When someone shares a dashboard using a public token, the system incorrectly returns messages belonging to the dashboard creator instead of the person viewing it. An attacker who obtains a valid share token can bypass normal access controls and read the creator's private messages directly from the underlying API endpoints—even if no User Messages widget is visible on the dashboard itself. This is an authorization bypass that leaks sensitive information.

• CVE-2026-7792MEDIUM 5.3

  The WPForms plugin for WordPress is vulnerable to webhook forgery that allows attackers to impersonate PayPal and manipulate subscription payment records. An attacker who knows a subscription ID can craft fake PayPal webhook messages to reactivate cancelled subscriptions, change payment status, or modify other subscription details—all without needing to authenticate or access PayPal itself. The vulnerability exists because the plugin accepts webhook payloads without verifying they actually came from PayPal using the required cryptographic signature check.

• CVE-2026-7828MEDIUM 5.3

  UltraVNC repeater versions up to 1.8.2.2 contain a memory allocation flaw triggered by oversized HTTP requests. When a user sends an HTTP request with an exceptionally long URI to the repeater's web interface port, the logging function attempts to allocate memory based on the URI length but miscalculates the size due to integer overflow. This causes the system to reserve far less memory than needed, and the subsequent copy of the full URI data spills beyond the allocated buffer, corrupting heap memory. An attacker on the network can trigger this condition without authentication, potentially destabilizing the repeater process or, in theory, achieving limited code execution through heap manipulation.

• CVE-2026-7859MEDIUM 5.3

  The Motors WordPress plugin contains a security flaw that allows attackers to change important website content without logging in. By exploiting a missing security check in one of the plugin's automated actions, an attacker can modify post metadata—such as gallery settings and featured images. On sites selling products with WooCommerce, this extends to changing product prices. The vulnerability affects all versions of the plugin before 1.4.110.

• CVE-2026-8049MEDIUM 5.3

  SignalRGB, a popular RGB lighting control application, contains a local privilege escalation vulnerability affecting versions before 1.3.7.0. The application creates a system device object without proper security restrictions, allowing any user logged into the system to send administrative commands to the device driver. This could let an attacker read sensitive data, modify system settings, or cause the application to crash.

• CVE-2026-8382MEDIUM 5.3

  The Advanced Custom Fields (ACF) plugin for WordPress contains a flaw that allows anyone on the internet to modify the title and content of posts that use ACF forms, without needing to log in or have any special permissions. An attacker can inject malicious values into form fields to alter published content, potentially leading to defacement, misinformation, or reputational damage. All versions up to 6.8.1 are affected.

• CVE-2026-8383MEDIUM 5.3

  A flaw in the LearnPress WordPress plugin before version 4.3.7 exposes sensitive user information to anyone on the internet without needing to log in. The plugin's REST API endpoint fails to properly restrict access to user details—specifically roles, capabilities, locale, and registration dates—which should only be available to administrators. An attacker can craft a simple web request to retrieve this data for any user on an affected site.

• CVE-2026-8385MEDIUM 5.3

  The WP Go Maps WordPress plugin contains an access control flaw that exposes unapproved map markers to anyone on the internet. Site owners use marker approval workflows to control which locations, names, and descriptions appear publicly on their maps. This vulnerability bypasses that approval gate through a fallback admin endpoint, leaking sensitive location data—including titles, categories, addresses, and descriptions—to unauthenticated visitors. The issue affects all versions before 10.0.10.

• CVE-2026-8386MEDIUM 5.3

  A flaw in the WP Go Maps WordPress plugin before version 10.0.10 exposes unapproved location markers to anyone on the internet. When an administrator creates a marker on a map but hasn't published it yet, the plugin still serves that marker's data via a public API endpoint without checking whether it should be visible. This means sensitive details—like personal addresses, descriptions, and exact GPS coordinates—can leak to unauthorized visitors before the admin intends to make them public.

• CVE-2026-8474MEDIUM 5.3

  A reflected cross-site scripting (XSS) vulnerability exists in the login API of Stormshield Network Security (SNS) appliances. An attacker can craft a malicious link or inject code that, when accessed by a user, executes arbitrary JavaScript in their browser. This could allow theft of session cookies, capture of credentials, or redirection to phishing sites. The vulnerability affects versions 4.3.0–4.3.41, 4.8.0–4.8.15, and 5.0.0–5.0.5.

• CVE-2026-8499MEDIUM 5.3

  The Helpfulcrowd Product Reviews plugin for WordPress contains a critical logic flaw that allows unauthenticated attackers to bypass security checks and modify the plugin's configuration settings. An attacker can send a specially crafted request with a JSON boolean value to trick the plugin's validation function into accepting unauthorized access, then write arbitrary settings into the WordPress database. This vulnerability affects versions 1.2.9 and earlier.

• CVE-2026-8502MEDIUM 5.3

  The LearnPress WordPress LMS plugin contains a flaw that lets unauthenticated attackers read sensitive course data. By crafting a specific request to the courses API endpoint with two parameters (c_status=all and return_type=json), an attacker can bypass intended access controls and retrieve plaintext passwords for protected courses, as well as unpublished course content, author names, and other metadata. The vulnerability affects all versions up to 4.3.6.

• CVE-2026-8608MEDIUM 5.3

  The Event Monster WordPress plugin, used for event management and ticket sales, contains a flaw that allows attackers to create fake payment records without actually paying. An unauthenticated attacker can submit forged transaction details through the plugin's payment handler, tricking the system into marking bookings as completed and issuing valid QR code tickets. This bypasses payment verification entirely, enabling ticket fraud on any affected WordPress site.

• CVE-2026-8609MEDIUM 5.3

  Grafana has a denial-of-service vulnerability in its OAuth login flow. An unauthenticated attacker can send repeated login attempts with varying parameters, causing the application to leak memory without bound. Eventually, the Grafana instance runs out of memory and crashes, disrupting availability for legitimate users. No authentication is required to trigger this issue, making it accessible to anyone on the network.

• CVE-2026-8617MEDIUM 5.3

  The SearchPlus WordPress plugin contains a flaw that allows anyone on the internet, without authentication, to modify or delete critical configuration data. Specifically, attackers can overwrite or erase the plugin's stored account tokens and account names by sending specially crafted requests. The vulnerability exists because the plugin fails to verify that the person making the request is actually authorized (missing capability checks) and doesn't use security tokens (nonces) to prevent cross-site forgery attacks. This affects all versions up to and including 1.7.1.

• CVE-2026-8690MEDIUM 5.3

  The RentMy Real-Time Rental Management Plugin for WordPress fails to verify user permissions before allowing changes to rental event data and location settings. This means anyone on the internet—without logging in—can read, modify, or delete rental events and overwrite the location ID stored in WordPress. The vulnerability affects all versions up to 4.0.4.1.

• CVE-2026-8694MEDIUM 5.3

  Devolutions PowerShell Universal versions up to 2026.1.7 contain an access control flaw that allows anyone on the network to read the OpenAPI specification files for REST endpoints you've created. These specification files can reveal sensitive details about your API structure, parameters, and authentication methods—information that normally should only be available to authenticated users. An attacker doesn't need valid credentials to exploit this; they simply request the specification and receive it.

• CVE-2026-8839MEDIUM 5.3

  MapPress Maps for WordPress, a popular mapping plugin, contains a critical authorization flaw affecting all versions through 2.96.6. The plugin's REST API endpoints fail to verify whether the person making a request actually owns the map they're trying to access. This means unauthenticated attackers can read any map's sensitive details—locations, coordinates, addresses, and descriptions—simply by guessing map IDs, while legitimate WordPress users with contributor-level access or higher can modify, delete, or duplicate maps they don't own.

• CVE-2026-9016MEDIUM 5.3

  A WordPress plugin called Debug Log Manager allows website visitors—including those not logged in—to write fake error messages directly into the site's debug log. The plugin publishes a security token publicly in every page's HTML code, defeating its own authorization checks. An attacker can exploit this to flood the log with fabricated entries, making it harder for administrators to spot real problems and potentially covering up malicious activity. This only affects sites that have the plugin's JavaScript error logging feature enabled.

• CVE-2026-9021MEDIUM 5.3

  The Easy Invoice WordPress plugin has a security flaw in versions 2.1.19 and earlier that lets anyone on the internet—without needing an account or credentials—accept or decline quotes and potentially convert them into invoices. The vulnerability exists because the plugin uses WordPress's no-privilege AJAX hooks (allowing unauthenticated access) paired with a basic nonce verification, but relies on an optional, disabled-by-default setting to actually check if someone owns the quote. An attacker can harvest the publicly visible nonce from any published quote page, then submit it to trigger quote acceptance/decline actions, potentially auto-generating and emailing invoices without authorization.

• CVE-2026-9027MEDIUM 5.3

  The CorvusPay WooCommerce Payment Gateway plugin contains a critical flaw in how it handles payment confirmations. When a customer completes a payment, the plugin is supposed to verify that the confirmation is genuinely from CorvusPay by checking a cryptographic signature. However, the plugin checks the signature but then ignores the result—it logs whether the check passed or failed, but proceeds to mark the order as paid regardless. This means an attacker can forge a fake payment confirmation and trick the plugin into marking any order as fully paid, allowing them to obtain merchandise or services without actually paying. Since WooCommerce order IDs are sequential numbers, attackers can systematically target orders without needing to know specific details beforehand.

• CVE-2026-9028MEDIUM 5.3

  The CorvusPay WooCommerce Payment Gateway plugin contains a flaw that allows anyone on the internet—with no account or credentials—to cancel orders placed through the CorvusPay payment method. An attacker simply needs to guess or iterate through order numbers and send a cancel request to a specific REST endpoint. This affects all versions of the plugin up to and including version 2.7.4.

• CVE-2026-9091MEDIUM 5.3

  Casdoor is an open-source identity and access management platform. A logic flaw in its social login binding feature allows attackers to bypass multi-factor authentication (MFA) requirements. When users authenticate through the social login binding flow, the application fails to check whether MFA is enabled, granting them access without completing the second authentication factor. This affects Casdoor versions 2.362.0 and earlier.

• CVE-2026-9172MEDIUM 5.3

  The Devs Accounting plugin for WordPress contains a critical flaw that allows anyone on the internet to delete accounting records without logging in. A REST API endpoint meant to delete account data lacks proper access controls, making it publicly accessible. An attacker can craft a simple web request targeting any account ID to permanently remove (soft-delete) accounting records from the WordPress database. This affects all installations running version 1.2.0 and earlier.

• CVE-2026-9175MEDIUM 5.3

  A WordPress plugin called Devs Accounting fails to properly verify user identity when serving financial data through its REST API. Anyone on the internet can request sensitive account information—like account names, bank details, and opening balances—without logging in or providing credentials. An attacker simply needs to guess or enumerate account ID numbers to retrieve this private financial data. The vulnerability affects all versions of the plugin up to and including version 1.2.0.

• CVE-2026-9180MEDIUM 5.3

  The MotoPress Appointment Booking plugin for WordPress contains a flaw that allows anyone on the internet to modify customer details in unconfirmed booking records without any authentication. An attacker can change the name, email, phone number, and internal customer ID associated with a booking that hasn't been confirmed yet. The vulnerability exists because the plugin's booking API endpoint accepts requests from anyone and doesn't verify that the person making the request actually owns the booking they're trying to modify. Attackers can discover target bookings by querying a publicly accessible list of appointments.

• CVE-2026-9187MEDIUM 5.3

  An unauthenticated attacker can permanently delete any post, page, or other content on a WordPress site running the Abandoned Contact Form 7 plugin up to version 2.2. The plugin fails to verify that requests come from authorized users and fails to validate that deletion requests are legitimate. This allows an attacker to send a simple request to the site's admin interface and destroy content without needing any credentials or password.

• CVE-2026-9188MEDIUM 5.3

  The Wappointment plugin for WordPress allows unauthenticated attackers to cancel or reschedule other users' appointments. The plugin generates authorization keys using a weak, predictable formula based on publicly observable or easily guessable information—a sequential customer ID, the appointment time, and staff ID—all hashed together without a random component. An attacker can recreate these keys and manipulate appointments belonging to other users if cancellation or rescheduling features are enabled on the site. This is a straightforward authorization bypass affecting all versions up to 2.7.6.

• CVE-2026-9189MEDIUM 5.3

  The Contact Form 7 – PayPal & Stripe Add-on WordPress plugin contains a payment validation flaw that allows attackers to mark high-value orders as completed without paying the correct amount. An attacker can make a small legitimate PayPal payment, then submit a forged payment notification (IPN) that references a different, expensive order. Because the plugin fails to verify that the payment amount and recipient email match the target order, the attacker's notification is accepted and the high-value order is incorrectly marked as paid. This affects all versions up to and including 2.4.9.

• CVE-2026-9204MEDIUM 5.3

  GitLab has fixed a vulnerability that lets authenticated users on versions 18.10 (before 18.10.8), 18.11 (before 18.11.5), and 19.0 (before 19.0.2) read files directly from the Gitaly server and reach internal network resources during repository imports. The issue stems from incomplete validation of secondary URLs in the import process. An attacker must already have valid GitLab credentials to exploit this flaw.

• CVE-2026-9242MEDIUM 5.3

  The RegistrationMagic plugin for WordPress contains a critical flaw in how it handles PayPal payment confirmations. An unauthenticated attacker can forge a fake PayPal notification to trick the plugin into associating a payment record with any WordPress user account—including admin accounts. By combining this forged notification with a legitimate security hash from a real payment, the attacker can then log in as that target user without knowing their password. The vulnerability affects all versions up to 6.0.8.6.

• CVE-2026-9590MEDIUM 5.3

  Devolutions Server versions up to and including 2026.1.19 contain an access control weakness that allows authenticated users with permission to edit entries to modify asset information beyond their intended scope. An attacker with entry edit privileges can bypass the permission validation checks and alter assets they shouldn't be able to access, potentially compromising the integrity of credential and asset data within the server.

• CVE-2026-9595MEDIUM 5.3

  webpack-dev-server's Hot Module Replacement (HMR) feature can be inadvertently exposed to a user-configured proxy when the proxy context is set broadly (such as /). If WebSocket forwarding is enabled on that proxy, the dev server mistakenly routes its internal HMR WebSocket through the proxy to a backend server. This causes sensitive data—browser cookies and the Origin header—to leak to that backend, circumvents the dev server's built-in Host/Origin protections, and corrupts the HMR socket since both HMR and the proxy write to the same connection. The flaw affects webpack-dev-server versions before 5.2.5.

• CVE-2026-9612MEDIUM 5.3

  The WhatsOrder – Instant Checkout for WooCommerce plugin contains a flaw that allows anyone on the internet to download customer invoices without logging in. The plugin saves invoice files to a web-accessible folder without proper access controls, and because invoice file names are predictable (based on sequential order IDs), attackers can systematically retrieve invoices for any customer. Each invoice contains sensitive personal information including names, email addresses, phone numbers, billing addresses, purchased items, prices, and order totals.

• CVE-2026-9641MEDIUM 5.3

  Crypt::PBKDF2, a Perl cryptographic library, uses cryptographic settings that are too weak by modern standards in versions before 0.261630. Specifically, the library defaults to HMAC-SHA1 (an older algorithm suitable only for legacy compatibility) and performs only 1,000 iterations of the key derivation process. Modern best practices recommend 220,000 to 1,400,000 iterations depending on the algorithm chosen. This gap between defaults and best practices weakens password protection for applications that rely on these defaults without customization.

• CVE-2026-9692MEDIUM 5.3

  Mojolicious::Sessions::Storable, a Perl session management module, uses a weak method to generate session identifiers through version 0.05. The session IDs are created by hashing together predictable data sources: the system's built-in random number generator (which is not cryptographically secure), the current timestamp, the memory address of a temporary data structure, and the process ID. An attacker with knowledge of these values or patterns could predict or forge valid session IDs, potentially gaining unauthorized access to user sessions without needing the correct credentials.

• CVE-2026-9794MEDIUM 5.3

  Keycloak contains an information disclosure vulnerability in its SAML ECP (Enhanced Client or Proxy) endpoint. An unauthenticated attacker can send specially crafted SOAP requests with different client IDs to the endpoint and observe the error messages returned. By analyzing these responses, an attacker can infer whether a given client uses SAML or another protocol. While this doesn't grant direct access to sensitive data or systems, it reveals organizational configuration details that could inform further reconnaissance or targeted attacks.

• CVE-2026-9803MEDIUM 5.3

  Keycloak's client registration endpoint contains a flaw that allows unauthenticated attackers to crash the service by sending malformed authentication headers. When an attacker sends a specially crafted POST request with a broken 'Authorization: Bearer' header to the client registration endpoint, the server throws an exception and returns an error, effectively taking the service offline temporarily. No data is stolen or modified—this is purely a denial of service issue.

• CVE-2026-9985MEDIUM 5.3

  A flaw in Google Chrome and ChromeOS allows an attacker who has already compromised the browser's renderer process to read sensitive data from the browser's memory by tricking a user into viewing a malicious webpage. The vulnerability stems from insufficient validation of media-related input. While this requires an initial renderer compromise, it can expose information that should have remained private within the browser process.

• CVE-2026-41984MEDIUM 5.2

  CVE-2026-41984 is a use-after-free (UAF) vulnerability discovered in a package management module. Use-after-free flaws occur when software attempts to access memory that has already been freed, potentially allowing an attacker to corrupt data or disrupt service. This particular issue requires high-level privileges to exploit and is unlikely to be triggered accidentally, but successful exploitation could compromise the integrity of the affected service.

• CVE-2026-49859MEDIUM 5.2

  Deno, a modern JavaScript and TypeScript runtime, contains a network access control bypass in versions before 2.8.1. When a script uses fetch() to make network requests, Deno's security model allows administrators to block connections to specific IP addresses or networks using the --deny-net flag. However, the vulnerability exists because Deno only checked the hostname against the deny list but failed to verify the actual IP addresses that hostname resolved to. An attacker could craft a malicious domain name that appears to pass the hostname restrictions yet resolves to a blocked IP address, allowing unauthorized network access. This was patched in version 2.8.1.

• CVE-2026-49860MEDIUM 5.2

  Deno versions before 2.8.1 contain a network access control bypass vulnerability in WebSocket connections. When a script attempts to open a WebSocket, Deno validates the destination hostname against deny-net security rules, but fails to re-validate the IP address that hostname resolves to. An attacker can craft a domain name that passes the hostname check but resolves to a blocked IP address, allowing network communication to restricted destinations. This affects local scripts with network privileges, potentially allowing unauthorized outbound connections despite active network restrictions.

• CVE-2026-49983MEDIUM 5.2

  Deno is a modern JavaScript/TypeScript runtime that includes permission controls to restrict what programs can access. One of these controls is the env permission, which blocks access to environment variables. You can use --deny-env to prevent this entirely, or --allow-env=FOO,BAR to restrict access to specific variables. However, in versions before 2.8.1, a built-in function called process.loadEnvFile() bypasses this protection. This function loads environment variables from a .env file, but it only checks whether the program can read the file—it ignores whether env access is allowed. This means an attacker who can control or create a .env file on the system, combined with read access (--allow-read), can inject environment variables into a sandboxed program that was supposed to have no env access. The vulnerability is patched in version 2.8.1.

• CVE-2026-11276MEDIUM 5.1

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Cast feature (which enables screen mirroring and media streaming to nearby devices) processes network traffic. An attacker physically present on the same local network can send specially crafted traffic to bypass access controls that would normally prevent unauthorized casting operations. This is a local network attack that doesn't require user interaction but is limited in scope—it cannot crash systems or execute arbitrary code, only manipulate casting permissions.

• CVE-2026-41985MEDIUM 5.1

  CVE-2026-41985 is a medium-severity memory safety defect in a package management module that can be exploited to disrupt service availability and data integrity. The vulnerability requires local system access, elevated user privileges, and user interaction to trigger, which constrains its real-world attack surface but does not eliminate its risk in insider threat or multi-stage compromise scenarios.

• CVE-2026-42326MEDIUM 5.1

  ImageMagick, a widely-used open-source tool for image processing, contains a flaw that allows a specially crafted image file to trigger an out-of-bounds memory read when the application writes IPTC metadata. An attacker who provides a malicious image could cause the software to read one byte of memory it shouldn't access, potentially leaking sensitive information or causing the application to crash. This is a local issue—the attacker must be able to supply the image file to a system running vulnerable ImageMagick.

• CVE-2026-45624MEDIUM 5.1

  ImageMagick, a widely used image editing library, contains an out-of-bounds memory read vulnerability in its polynomial distortion feature. When processing specially crafted image transformation arguments, the software reads 24 bytes of memory beyond the intended buffer boundary. This can expose sensitive data from the application's memory space. The vulnerability affects versions prior to 6.9.13-47 (legacy branch) and 7.1.2-22 (current branch) and has been patched in those releases.

• CVE-2026-45682MEDIUM 5.1

  OpenTelemetry's eBPF Instrumentation agent for Java contains a memory leak in its TLS connection state tracking. When Java applications handle repeated connection churn (connections opening and closing), the instrumentation fails to properly clean up its internal tracking queue, causing heap memory to grow indefinitely until the application runs out of memory and crashes. This affects long-running production JVMs where connection pools are regularly recycled. The issue is resolved in version 0.9.0.

• CVE-2026-55443MEDIUM 5.1

  LangChain versions prior to 1.3.9 contain a path-traversal vulnerability that allows unauthorized file access. Several components that load or search files do not properly restrict access to a configured directory boundary. An attacker who can influence file paths, search patterns, or LLM inputs could read files outside the intended scope—for instance, by using glob patterns, symbolic links, or prefix-matching tricks to escape a restricted directory and access sensitive files elsewhere on the system.

• CVE-2026-57965MEDIUM 5.1

  CVE-2026-57965 is a medium-severity vulnerability in spice-vdagent, a guest-side agent daemon used in virtualized environments to provide features like clipboard sharing and USB redirection. An attacker who controls or compromises the SPICE (Simple Protocol for Independent Computing Environments) host can craft a malicious network message that causes an integer overflow, leading to a heap buffer overflow in the vdagent daemon. This crash results in denial of service to the virtual machine. The vulnerability requires the host to be untrusted or already compromised, limiting exposure in typical well-managed hypervisor environments, but it represents a privilege escalation vector if host compromise occurs.

• CVE-2024-56141MEDIUM 5.0

  Minosoft, an open-source Minecraft Java Edition client, contains a cryptographic implementation flaw in its AES encryption routine. The application incorrectly uses the encryption key itself as the initialization vector (IV) instead of generating a random one. This design weakness allows attackers with network access and authenticated status to perform chosen-plaintext and chosen-ciphertext attacks, potentially recovering the secret encryption key. The vulnerability affects all Minosoft versions that support Minecraft protocol 1.7 and later. No patch has been released, and no workarounds currently exist.

• CVE-2025-60466MEDIUM 5.0

  GPAC MP4Box versions before 26.02.0 contain a memory safety flaw where freed memory can be accessed during packet filtering operations. An attacker who supplies a specially crafted media file can trigger a crash or service interruption. The vulnerability requires local access and user interaction (opening the file), limiting its direct remote exploitation potential but posing a risk in automated or batch processing environments.

• CVE-2025-60477MEDIUM 5.0

  CVE-2025-60477 is a crash vulnerability in GPAC's MP4Box multimedia processing tool. A specially crafted file can trigger a program crash when processed by a local or authenticated user, disrupting media encoding and processing workflows. The vulnerability does not leak data or enable privilege escalation, but it can be weaponized to interrupt legitimate operations or degrade service availability.

• CVE-2026-10010MEDIUM 5.0

  Google Chrome on Android versions prior to 148.0.7778.216 contain a vulnerability in input handling that allows an attacker who has already compromised Chrome's renderer process to bypass site isolation protections through a specially crafted HTML page. Site isolation is a critical Chrome security boundary designed to keep sensitive data from different websites separate in memory. This flaw undermines that protection, though it requires the attacker to have already gained code execution within the browser engine itself.

• CVE-2026-10275MEDIUM 5.0

  A buffer overflow vulnerability exists in OpenSC versions up to 0.26.1 within the pkcs11-tool component's key generation functionality. The flaw allows an attacker to overflow a buffer during certificate writing operations, potentially enabling remote code execution or data corruption. Exploitation requires user interaction and specific conditions, making it moderately difficult to weaponize, though a proof-of-concept has already been disclosed.

• CVE-2026-10533MEDIUM 5.0

  A vulnerability in OpenShift Container Platform allows non-privileged users to circumvent resource quota enforcement by creating pods with a never-restart policy. These pods and their associated Kubernetes events are not counted against quota limits, enabling an attacker to flood the cluster's event database (etcd) with activity. The resulting accumulation degrades API server performance across the entire cluster, affecting all users and workloads.

• CVE-2026-11281MEDIUM 5.0

  Google Chrome on Windows contains an integer overflow vulnerability in its Chromoting remote desktop component that could allow a local attacker with user-level privileges to read sensitive information from the browser's memory. The attack requires user interaction and relies on sending a specially crafted Event Tracing for Windows (ETW) event. This is a local-only attack requiring existing system access, not a remote exploitation vector.

• CVE-2026-11290MEDIUM 5.0

  An integer overflow vulnerability exists in the WebView component of Google Chrome on Android devices running versions prior to 149.0.7827.53. A local attacker with limited privileges can exploit this flaw by tricking a user into opening a specially crafted file, leading to a denial of service that crashes the browser or WebView. This is a local attack that requires user interaction and does not compromise confidentiality or integrity.

• CVE-2026-11455MEDIUM 5.0

  MetaGPT versions up to 0.8.2 contain a command injection vulnerability in the common utility module. An authenticated attacker can manipulate the mermaid.path argument to inject arbitrary system commands, potentially leading to unauthorized code execution. The flaw requires significant technical knowledge to exploit and has become public, increasing risk posture for organizations running affected versions.

• CVE-2026-11493MEDIUM 5.0

  Tenda AC15 routers running firmware version 15.03.05.19 contain a vulnerability in how they configure Samba file-sharing settings. An attacker with access to the local network can manipulate the Samba configuration file to weaken password requirements, making it easier to gain unauthorized access to shared files and network resources. While a public exploit exists, successful exploitation requires technical knowledge and specific network conditions.

• CVE-2026-11500MEDIUM 5.0

  Weaviate versions up to 1.37.7 contain an authorization bypass vulnerability in the static API key authentication handler. An authenticated attacker can manipulate the StaticApiKey parameter to bypass access controls and gain unauthorized access to protected resources. The vulnerability requires a valid user account and significant technical knowledge to exploit, but public exploit code exists. Upgrading to version 1.38.0-rc.0 resolves the issue.

• CVE-2026-11505MEDIUM 5.0

  GL.iNet routers across multiple models (A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000, XE3000) running firmware version 4.8.x contain a flaw in the glnassys component that exposes a hard-coded cryptographic key. An authenticated attacker with network access can exploit this to gain unauthorized cryptographic capabilities. The vulnerability requires significant technical skill and specific conditions to exploit, placing it in the medium-risk category. A firmware upgrade to version 4.9.0 resolves the issue.

• CVE-2026-11787MEDIUM 5.0

  A vulnerability in Red Hat's 389 Directory Server allows a memory reading flaw when processing LDAP search filters. The issue occurs when the server parses certain filter strings, causing it to read data from memory locations it shouldn't access. This could potentially be exploited by an authenticated user to leak small amounts of sensitive information or disrupt normal filter processing. The vulnerability requires authentication and specific conditions to exploit, making it a moderate-risk issue that warrants patching but not immediate panic.

• CVE-2026-11791MEDIUM 5.0

  A memory safety defect in 389 Directory Server can crash the service when an administrator reloads the schema while the server is handling active LDAP queries. The vulnerability stems from improper cleanup of attribute syntax data structures during schema reload, allowing worker threads to access memory that has already been freed. This condition results in a denial of service but does not enable data theft or modification.

• CVE-2026-11850MEDIUM 5.0

  MIT krb5 contains an integer underflow bug in how it processes LDAP-backed Kerberos principal data. When the LDAP KDB plugin reads a malformed krbExtraData attribute with insufficient length, a mathematical underflow occurs: subtracting 2 from a value smaller than 2 causes an unsigned integer to wrap around to a very large number (up to 65,535). The code then allocates memory based on this wrapped value and attempts to copy data from a tiny buffer into it, reading far beyond the buffer's actual contents. This can cause sensitive memory disclosure or service disruption on systems running a KDC or kadmind daemon that use LDAP for principal storage.

• CVE-2026-12771MEDIUM 5.0

  BerriAI's litellm, a language model proxy library, contains an authorization flaw in its M2M (machine-to-machine) JWT authentication handler. An authenticated attacker can manipulate requests to bypass proper authorization checks, potentially gaining unauthorized access to protected functionality. This requires existing credentials and significant technical knowledge to exploit, though proof-of-concept code is publicly available.

• CVE-2026-13484MEDIUM 5.0

  MLflow, a popular open-source platform for managing machine learning workflows, contains an authorization flaw in its experiment-scoped label schema API. An authenticated user with low privileges can manipulate this API endpoint to perform actions they should not be allowed to perform—specifically, reading, modifying, or deleting label schemas—without proper permission checks. The vulnerability requires an attacker to already have valid login credentials and involves moderately complex attack conditions, making it a practical but not trivial risk.

• CVE-2026-13507MEDIUM 5.0

  A vulnerability exists in volcengine OpenViking versions up to 0.3.21 that allows authenticated users to bypass data integrity checks when processing primary-key labels in the local vector database. An attacker with valid credentials can manipulate ID arguments to the str_to_uint64 function, causing the system to accept data without proper verification. While the vulnerability requires authentication and is technically complex to exploit, successful exploitation could compromise the confidentiality, integrity, and availability of indexed vector data.

• CVE-2026-13513MEDIUM 5.0

  MyScaleDB versions up to 1.8.0 contain a vulnerability in how they verify the authenticity of cached segment identifiers. An authenticated attacker with network access could manipulate this cache mechanism to bypass data integrity checks, potentially leading to unauthorized information disclosure or modification. The attack is complex to execute, but proof-of-concept code has been publicly released, increasing exploitation risk.

• CVE-2026-13534MEDIUM 5.0

  CherryHQ's cherry-studio application versions up to 1.9.7 contain an authorization bypass vulnerability in its CherryIN Preload API memory service. An authenticated attacker with local or remote access can manipulate a state parameter to bypass authorization controls and access unauthorized data or perform restricted actions. The vulnerability requires high technical complexity to exploit and is rated CVSS 5.0 (Medium). A public exploit exists, elevating practical risk for deployed instances.

• CVE-2026-13591MEDIUM 5.0

  DeepMyst Mysti version 0.4.0 contains a flaw in how it validates user permissions when tracking conversations. An authenticated attacker can manipulate how the system classifies conversation channels to bypass authorization controls, potentially gaining access to or modifying sensitive conversation data. The vulnerability requires an active user account and deliberate manipulation of request parameters, making it a targeted risk rather than a trivial one.

• CVE-2026-14340MEDIUM 5.0

  GitHub Enterprise Server had a flaw in how it validated permissions for tokens used by GitHub Apps. A user-to-server token tied to a GitHub App could be abused to create issues, comments, and vulnerability reports on public repositories even if the token was not supposed to have access to those repositories. An attacker who stole such a token could post content as the legitimate user, making it appear the user performed those actions. GitHub has patched this across all supported versions.

• CVE-2026-27881MEDIUM 5.0

  Coolify, an open-source platform for managing servers and applications, contains an authorization flaw that allows any authenticated API user to view deployment information belonging to other teams. An attacker with valid API credentials can retrieve sensitive deployment details—such as configuration, status, and metadata—for deployments they should not have access to by simply guessing or enumerating valid deployment identifiers. The vulnerability exists in versions prior to 4.0.0-beta.464 and is resolved in that release.

• CVE-2026-27883MEDIUM 5.0

  Coolify is a deployment and infrastructure management platform, and versions before 4.0.0-beta.464 contain an authorization bypass in the deployment details API endpoint. Any user with valid credentials can view deployment information for teams they don't belong to, exposing sensitive infrastructure and application details across team boundaries. The flaw stems from the endpoint accepting a team identifier from the user's authentication token but failing to validate that the requested deployment actually belongs to that team.