By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 75 of 86

Known exploited (KEV)Critical High Medium All recent

CVE-2026-46298MEDIUM 4.7
A race condition exists in the Linux kernel's PAPR HVPIPE driver that can cause a system deadlock. The vulnerability occurs when an interrupt fires on the same CPU while the driver's ioctl or release handlers are executing. If both try to acquire the same lock simultaneously, the system can become unresponsive. The issue is resolved by using interrupt-safe lock primitives that prevent interrupts from firing during critical sections, eliminating the deadlock scenario. This is primarily a local denial of service affecting systems running vulnerable kernel versions.
CVE-2026-46772MEDIUM 4.7
Oracle's Application Development Framework (ADF), a core component of Fusion Middleware, contains a privilege-escalation vulnerability affecting versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with high-level administrative access and direct infrastructure access could exploit insufficient privilege controls to read sensitive application data or modify certain records. The attack is not trivial—it requires both elevated credentials and specific configuration conditions—but poses meaningful risk to organizations running vulnerable ADF instances, particularly those handling sensitive business data through ADF-based applications.
CVE-2026-48733MEDIUM 4.7
ImageMagick, widely used for image editing and manipulation across web applications and server environments, contains a flaw that can trigger an infinite loop when processing specially crafted images during subimage-search operations. An attacker who tricks a user into opening a malicious image file can cause the application to hang indefinitely, disrupting availability. This is not a memory corruption or data theft vulnerability, but a denial-of-service condition that freezes the process.
CVE-2026-48984MEDIUM 4.7
pam_usb is a Linux authentication tool that uses removable media (like USB drives) as a hardware security key. A flaw in versions 0.9.1 and earlier leaves sensitive authentication data—specifically one-time pad values—sitting in freed memory instead of securely erasing it. If an attacker gains local access and can inspect heap memory (either through a use-after-free bug or memory inspection tools), they could potentially recover these pad values and bypass authentication. The issue affects the central memory deallocation function, which should be clearing sensitive buffers before releasing them.
CVE-2026-48986MEDIUM 4.7
pam_usb is a Linux authentication module that lets users log in using USB devices as hardware tokens. A bug in version 0.9.1 and earlier can cause the authentication process to hang indefinitely if a parent process terminates during login. When this happens, the sudo, sshd, or login process becomes unresponsive and must be manually killed. This is a denial-of-service vulnerability that affects systems using pam_usb for authentication. The issue stems from improper error handling in the code that walks up the process tree to verify the authenticating process. Upgrading to version 0.9.2 or later resolves the problem.
CVE-2026-49043MEDIUM 4.7
WP Migrate Lite, a WordPress plugin for site migration tasks, contains a CSRF vulnerability affecting versions 2.7.8 and earlier. The flaw allows attackers to trick authenticated WordPress users into performing unintended actions without their knowledge or consent—such as initiating a migration, modifying plugin settings, or exporting site data. The attacker crafts a malicious webpage or email and waits for an admin or privileged user to visit it while logged into their WordPress site. No direct attack on the website itself is required; the vulnerability exploits the trust relationship between the user and the WordPress site.
CVE-2026-50267MEDIUM 4.7
Steeltoe, a .NET library for building cloud-native applications, inadvertently exposes database credentials to other processes on the same Linux container. When applications configure MySQL or PostgreSQL connections through Cloud Foundry service bindings, Steeltoe temporarily stores TLS client credentials in world-readable files in the system temp directory. These files are never cleaned up, leaving sensitive key material accessible to any other user or process on the same machine. The vulnerability affects Steeltoe.Configuration.Abstractions versions 4.0.0 through 4.1.0 and is resolved in version 4.2.0.
CVE-2026-52902MEDIUM 4.7
CVE-2026-52902 is a path traversal flaw in awxkit, the command-line interface for Red Hat's AWX automation platform. When a user imports a specially crafted YAML configuration file using the "awx --conf.format yaml import" command, an attacker can trick awxkit into reading arbitrary YAML files from the victim's local system. The vulnerability stems from insufficient validation of file paths in the YAML !include directive. This is fundamentally a client-side attack requiring the user to knowingly or unknowingly process a malicious YAML file, making social engineering a prerequisite for exploitation.
CVE-2026-53008MEDIUM 4.7
A race condition exists in the Linux kernel's ice driver that can cause a system crash when one CPU is cleaning up TX timestamp resources while another CPU is actively using them. The vulnerability occurs because pointer cleanup and flag clearing happen in the wrong order, allowing a concurrent operation to dereference a NULL pointer. The impact is limited to systems with the ice driver loaded and TX timestamping enabled, and requires local access to trigger.
CVE-2026-53108MEDIUM 4.7
A race condition exists in the Linux kernel's memory management on PowerPC 64-bit systems that can trigger a kernel crash (panic) when two processes simultaneously attempt incompatible operations on the same memory pages. Specifically, when one process moves memory pages between NUMA nodes using move_pages() while another process unmaps that memory via munmap(), the kernel can encounter an assertion failure. The vulnerability requires local access and moderate effort to trigger, but results in a denial of service affecting system availability.
CVE-2026-53352MEDIUM 4.7
CVE-2026-53352 is a race condition in the Linux kernel's signal handling code. When a multi-threaded process receives a stop signal and one thread calls execve() simultaneously, the kernel fails to properly clean up job control flags on the calling thread. This leaves stale signal state that causes the thread to attempt an invalid operation when returning to user mode, triggering a kernel warning. The vulnerability requires local access and specific timing, but can crash or destabilize the kernel.
CVE-2026-54106MEDIUM 4.7
The U.S. Government Accountability Office (GAO) operates two critical federal docketing systems—the Electronic Protest Docketing System (EPDS) and the Civilian Board of Contract Appeals Electronic Docketing System (EDS)—that process sensitive government contract disputes. Both systems fail to properly validate the X-Forwarded-For HTTP header, a field that applications often use to identify the true client IP address in proxy or load-balancer scenarios. An attacker who has already compromised administrator credentials can abuse this validation gap to bypass network-level access controls and successfully authenticate. This is a privilege abuse scenario rather than an unauthenticated attack: the adversary needs valid admin credentials but can then circumvent IP-based restrictions that might otherwise limit where those credentials can be used.
CVE-2026-54344MEDIUM 4.7
ToolJet is an open-source low-code platform used to build internal business tools. A vulnerability in versions prior to 3.20.180 allows unauthorized command execution on CI/CD runners through GitHub pull request comments. Any user with the ability to comment on an open pull request can inject shell commands by crafting a comment with a deploy command, potentially extracting sensitive deployment credentials stored in the CI environment. The flaw stems from unsafe interpolation of user-controlled input directly into bash conditionals without sanitization.
CVE-2026-55595MEDIUM 4.7
ImageMagick, a widely used image processing tool, contains a flaw that causes it to enter an infinite loop when given malformed input to its connected-components feature. An attacker could exploit this by crafting a specially formed image file or command that triggers the loop, effectively freezing the application and making it unavailable until forcibly stopped. The issue affects ImageMagick versions prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch).
CVE-2026-56117MEDIUM 4.7
dhcpcd, a widely deployed DHCP client daemon, contains a memory safety bug that can crash the service when privilege separation is disabled. A local user on the same system can exploit this by sending a specially crafted command to dhcpcd's control socket, causing the daemon to reference memory it has already freed. While the vulnerability requires local access and a specific configuration, it represents a denial-of-service risk in environments where dhcpcd runs with privilege separation turned off—a configuration sometimes found in embedded systems or minimal deployments.
CVE-2026-56332MEDIUM 4.7
Capgo before version 12.128.2 contains a flaw that allows attackers to redirect users to malicious websites during the signup confirmation process. An attacker can craft a deceptive confirmation link that appears legitimate but directs victims to an attacker-controlled site, where they might be tricked into entering credentials or downloading malware. The vulnerability requires user interaction—victims must click the malicious link—but poses a real phishing risk, especially if distributed through email or messaging channels.
CVE-2026-57031MEDIUM 4.7
Juniper Networks has disclosed a vulnerability in Junos OS that affects MX Series routers when subscribers are configured on static interfaces. The issue causes the packet forwarding engine to skip security checks on incoming traffic, meaning configured firewall filters don't work as intended. This creates a window where adjacent network subscribers—those directly connected to the affected device—can send traffic that bypasses the firewall rules you've put in place. The vulnerability does not provide confidentiality risk, but allows policy violation through integrity compromise, and affects multiple recent versions of Junos OS across several hardware variants.
CVE-2026-57957MEDIUM 4.7
Papermark versions through 0.22.0 have a cross-origin request forgery (CSRF) vulnerability in their file upload endpoint. The vulnerability stems from improper handling of cross-origin requests: the application reflects whatever origin a request claims to come from and allows credentialed requests from that origin. This means an attacker can trick authenticated Papermark users into visiting a malicious webpage that silently uploads files into the victim's datarooms or extracts sensitive information—all without the victim's knowledge or consent. The attacker never needs valid credentials themselves; they exploit the victim's existing session.
CVE-2026-59883MEDIUM 4.7
Guzzle, a widely-used PHP HTTP client library, contains a cookie-handling flaw that can allow attackers to leak cookies between different hosts or inject cookies into requests. The vulnerability exists in how Guzzle's CookieJar component validates which domains a cookie belongs to. When a cookie is scoped to an IP address (like 192.168.0.1 or ::1) or a bare numeric value, Guzzle incorrectly applies standard domain suffix matching rules instead of requiring an exact match. This means a cookie set for one IP could be sent to a different IP on the same network, or a cookie meant for one host could be injected into requests to another. The issue affects Guzzle versions prior to 7.12.3 and requires user interaction to exploit (such as visiting a malicious page), but can impact any application using vulnerable Guzzle versions.
CVE-2026-59947MEDIUM 4.7
Composer, PHP's widely-used package manager, leaks authentication credentials in debug output under specific circumstances. When developers run Composer with the highest verbosity flag (-vvv), credentials embedded in repository URLs—such as GitHub Personal Access Tokens—can be exposed in logs or terminal output. This happens because Composer's credential sanitization functions fail to strip credentials from certain URL formats, specifically when the token appears in the username portion of the URL. The vulnerability affects Composer versions prior to 2.2.29 and 2.10.2.
CVE-2022-44630MEDIUM 4.6
A cross-site request forgery (CSRF) vulnerability exists in the YITH WooCommerce Product Slider Carousel plugin for WordPress. The flaw allows an attacker to trick an authenticated administrator into performing unwanted actions on the plugin without their knowledge—such as modifying carousel settings or configurations—by embedding malicious requests in a webpage the admin visits. The vulnerability affects all versions through 1.16.0.
CVE-2026-10642MEDIUM 4.6
The Zephyr RTOS PL011 UART driver contains a loop that can spin indefinitely when hardware flow control (CTS) is enabled and the connected device stops asserting the CTS signal during data transmission. When this happens, the thread attempting to send data hangs, freezing the entire execution context and breaking serial communication—typically affecting Bluetooth HCI and other serial-dependent subsystems. An attacker with physical or adjacent access to the CTS line (such as by controlling an external Bluetooth module) can trigger this denial of service. Versions 4.1.0 through 4.4.0 are affected; patched releases address the issue by checking CTS status and using the modem-status interrupt to resume when CTS recovers.
CVE-2026-10656MEDIUM 4.6
A USB device driver in Zephyr crashes when a USB host performs a legitimate control-transfer abort. The MAX32 USB device controller driver fails to check whether a buffer exists before trying to use it in interrupt handlers. A USB host can trigger this by sending a new SETUP packet to interrupt an in-flight control transfer—standard USB behavior. The result is a device crash (denial of service). No special privileges or authentication are required; physical USB bus access is sufficient. The flaw affects Zephyr v4.4.0 and later versions of the MAX32 UDC driver until patched.
CVE-2026-10834MEDIUM 4.6
The WP Travel Engine WordPress plugin contains a vulnerability in versions before 6.8.1 that allows logged-in users with basic subscriber permissions to move any file from the WordPress media library into their profile image directory. When a file is moved this way, it disappears from its original location, potentially breaking content that depends on it—such as images in blog posts, pages, or other media-dependent features. The vulnerability requires user interaction (a click or action by the attacker) and only affects the integrity and availability of media files, not confidentiality.
CVE-2026-11443MEDIUM 4.6
Allegra contains a cross-site scripting (XSS) vulnerability in its downloadAttachment method that allows attackers to inject malicious scripts. An authenticated user must be tricked into visiting a malicious page or opening a malicious file to trigger the attack. Once executed, the injected script runs with the privileges of the logged-in user, potentially allowing access to sensitive information or account compromise.
CVE-2026-13808MEDIUM 4.6
Google Chrome on iOS versions before 150.0.7871.47 contain a flaw in how the browser validates user-supplied data, allowing someone with physical access to an iOS device to extract sensitive information from the browser's memory. This is a local-only attack that requires hands-on device access, but the potential exposure of sensitive data makes it worth patching promptly.
CVE-2026-33462MEDIUM 4.6
A path traversal flaw in Kibana's dashboard management allows an authenticated user with basic permissions to craft a malicious dashboard identifier. When an administrator deletes this dashboard, the deletion request bypasses security controls and targets unintended internal endpoints—potentially destroying user accounts or other critical resources. The vulnerability requires an administrator to take action on the malicious object, making it a privilege-escalation path rather than a self-executing exploit.
CVE-2026-34096MEDIUM 4.6
CVE-2026-34096 is a reflected cross-site scripting (XSS) vulnerability in Guardian's language-system component. The flaw exists in the designer.php file, where user-supplied input via the 'name' GET parameter is inserted directly into an HTML input field without proper sanitization. An authenticated user can exploit this by crafting a malicious URL containing script tags; when a victim visits that URL, the injected script executes in their browser within the security context of their authenticated session. This allows an attacker to steal session tokens, modify page content, or perform actions on behalf of the victim.
CVE-2026-34097MEDIUM 4.6
Guardian language-system contains a cross-site scripting (XSS) vulnerability in its text_file.php component where user-controlled input is not properly validated before being placed into HTML form attributes. An authenticated user can manipulate the 'id' parameter to inject malicious scripts that execute within another user's browser session, potentially compromising their account or session data.
CVE-2026-34098MEDIUM 4.6
CVE-2026-34098 is a stored cross-site scripting (XSS) vulnerability in Guardian language-system's media.php file. An authenticated user can inject malicious script code through the 'id' GET parameter, which gets embedded directly into the HTML page without proper sanitization. When another user visits the crafted URL, the injected script executes in their browser with their session privileges. This requires an attacker to already have login credentials and victim interaction (clicking a malicious link), limiting the attack surface but posing a real risk in multi-user environments.
CVE-2026-36174MEDIUM 4.6
GNCC GP5 devices running version 7.1.76 transmit sensitive wireless network credentials in readable form to the serial console during normal operation. An attacker with physical access to the device's serial port can intercept these credentials, compromising network security. This is a localized but consequential exposure for organizations operating these devices in shared or less-controlled physical environments.
CVE-2026-36178MEDIUM 4.6
A flaw in the factory reset process of GNCC GP5 v7.1.76 leaves sensitive cryptographic keys and related data intact on the device's storage partition even after a factory reset is performed. An attacker with physical access to the device could potentially recover this material and use it to decrypt or impersonate the original user's configuration and encrypted content.
CVE-2026-36180MEDIUM 4.6
GNCC GP5 version 7.1.76 has a security weakness that allows an attacker with physical access to the machine to temporarily modify read-only system files and binaries during a single boot session. The vulnerability exploits bind-mount mechanisms—a Linux/Unix filesystem technique—to circumvent protections meant to keep critical system files locked down. While the attacker needs to be physically present and the changes only persist until reboot, this represents a meaningful integrity risk for systems in shared, controlled, or potentially hostile physical environments.
CVE-2026-38571MEDIUM 4.6
The Tenda N300 F3 router (V603 firmware) stores Wi-Fi security passwords in plain text and allows anyone with physical access to the device's serial port to read them without any authentication. The same serial console also permits attackers to read or write data directly to the device's memory, potentially compromising the router's operation or extracting additional sensitive information. This is a physically proximate attack—the attacker must be able to connect a cable to the device—but requires no special knowledge or authentication once connected.
CVE-2026-45106MEDIUM 4.6
Weblate, a collaborative localization and translation platform, contains a stored cross-site scripting (XSS) vulnerability in its live search preview feature. Before version 2026.5, the tool failed to sanitize HTML and CSS content entered into source fields and context fields by contributors. When another user performs a search that matches this malicious content, the unescaped HTML and CSS executes in their browser within the authenticated Weblate editor environment. Any authenticated user can inject this payload, making it a contributor-level threat that persists and affects all users who trigger the matching search.
CVE-2026-45153MEDIUM 4.6
Nextcloud Files app on Android has a PIN bypass vulnerability affecting versions 33.0.0 through 33.0.x. An attacker with physical access to an unlocked Android device can use the back button to circumvent the app's PIN protection and gain unauthorized access to files stored in the Nextcloud app. This is a local attack requiring the device to already be unlocked, but it effectively neutralizes the app-level security control that would normally protect sensitive files even if the phone falls into the wrong hands.
CVE-2026-45284MEDIUM 4.6
Nextcloud's OIDC (OpenID Connect) user authentication module contains a flaw that allows deleted LDAP users to continue authenticating to the system. When an organization uses both LDAP and OIDC for user management, deletion of a user from LDAP does not properly prevent that user from logging in via OIDC. This creates an unintended persistence of access for users who should no longer have system privileges. The issue affects Nextcloud versions 1.3.6 through 8.3.x and has been resolved in version 8.4.0.
CVE-2026-45462MEDIUM 4.6
CVE-2026-45462 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an authorized user to inject malicious scripts into web pages. When other users view the affected page, the script executes in their browser, potentially allowing the attacker to steal session data, redirect users, or impersonate trusted content. The vulnerability requires an authenticated attacker and user interaction (such as clicking a link), limiting its blast radius but making it a meaningful concern for organizations where SharePoint access is broadly distributed.
CVE-2026-45467MEDIUM 4.6
CVE-2026-45467 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint that allows an authenticated user to inject malicious scripts into web pages. When another user views the compromised page, the script executes in their browser, potentially allowing the attacker to steal credentials, manipulate content they see, or impersonate the attacker. The vulnerability requires an authorized SharePoint user to set it up and a victim to click or view the malicious content, limiting its reach but making it effective in insider threat scenarios.
CVE-2026-45468MEDIUM 4.6
CVE-2026-45468 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an authenticated user to inject malicious scripts into web pages. When a victim views the compromised page, the attacker can steal sensitive information or impersonate the victim within SharePoint. The vulnerability requires an authorized account to exploit and user interaction to trigger, making it moderate in severity but still a genuine risk in environments where SharePoint users have elevated privileges or access to sensitive data.
CVE-2026-45479MEDIUM 4.6
CVE-2026-45479 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an authenticated attacker to inject malicious code into web pages. When a user views the compromised page, the attacker can steal session credentials, redirect users to phishing sites, or perform actions on behalf of the victim. The attack requires both valid SharePoint credentials and user interaction (clicking a malicious link or visiting a crafted page), which moderates its overall risk.
CVE-2026-45483MEDIUM 4.6
Microsoft Office Project Server contains a cross-site scripting (XSS) vulnerability that allows an authenticated user to inject malicious code into web pages viewed by others. An attacker would need valid login credentials and would require a victim to interact with a crafted link or page element. The injected code runs in the victim's browser in the context of Project Server, enabling spoofing attacks such as credential theft or unauthorized actions on behalf of the user. This is a moderate-severity issue that primarily affects organizations where Project Server access is restricted to authenticated users.
CVE-2026-46532MEDIUM 4.6
A memory reading vulnerability exists in Espressif's ESP-IDF Bluetooth stack, specifically in the AVRCP (Audio/Video Remote Control Profile) vendor command parser. An authenticated attacker with local Bluetooth access could read adjacent memory contents by crafting malformed vendor commands. This could leak sensitive information from the device's memory. The vulnerability affects ESP-IDF versions 5.2.6 through 6.0 across multiple release branches.
CVE-2026-46609MEDIUM 4.6
Umbraco CMS versions 14.0.0 through 17.3.x contain a stored cross-site scripting (XSS) vulnerability in a confirmation dialog. Authenticated users can inject malicious HTML into an input field that gets rendered without proper encoding, allowing attackers to execute arbitrary JavaScript in the context of other users' browsers. This requires an attacker to have valid credentials and typically requires user interaction to trigger the payload.
CVE-2026-46672MEDIUM 4.6
Actual, a local-first personal finance application, contains a CSV formula-injection vulnerability in its command-line interface (CLI). When users export data to CSV format using the --format csv option, the app's CSV serializer fails to escape special characters that trigger automatic formula evaluation in spreadsheet applications. An attacker with local access could craft malicious transaction data, account names, payee information, or other financial records that, when exported to CSV and opened in Excel, LibreOffice Calc, or Google Sheets, execute arbitrary formulas. This could lead to data exfiltration or further compromise. The vulnerability was patched in version 26.6.0.
CVE-2026-47637MEDIUM 4.6
CVE-2026-47637 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an authenticated attacker to inject malicious script into web pages. When a user views a compromised page, the attacker can steal session tokens, redirect users to phishing sites, or perform actions on behalf of the victim. The attack requires an authorized attacker and user interaction (clicking a link or viewing content), limiting its immediate blast radius but still representing a meaningful risk in collaborative environments where SharePoint is heavily used.
CVE-2026-47638MEDIUM 4.6
CVE-2026-47638 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an authenticated attacker to inject malicious scripts into web pages. When a user views the compromised page, the attacker's script executes in their browser, enabling spoofing attacks—such as phishing, credential theft, or session hijacking—while appearing to come from a trusted SharePoint instance. The vulnerability requires user interaction and existing authentication, limiting but not eliminating the risk in organizations with many SharePoint users.
CVE-2026-47640MEDIUM 4.6
Microsoft Office SharePoint contains a cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject malicious scripts into web pages. When a user with appropriate permissions views a compromised page, the injected script executes in their browser, potentially allowing the attacker to steal session tokens, modify page content, or redirect users to malicious sites. This is a reflected or stored XSS flaw depending on how SharePoint processes and stores the unfiltered input.
CVE-2026-47641MEDIUM 4.6
CVE-2026-47641 is a spoofing vulnerability in Microsoft Office SharePoint that allows someone with valid login credentials to impersonate other users or entities through the network. The flaw stems from insufficient validation of user input, meaning malicious insiders or compromised accounts can craft specially formatted requests to bypass identity checks. While this requires an authenticated attacker, the impact—unauthorized identity assumption—is serious enough to warrant prompt attention in environments where SharePoint handles sensitive information or facilitates inter-organizational workflows.
CVE-2026-4770MEDIUM 4.6
A DOM-based cross-site scripting (XSS) vulnerability exists in TR7 Cyber Defense Inc.'s Web Application Firewall that allows an authenticated attacker to inject malicious scripts into the application. The vulnerability arises from improper sanitization of user input during web page generation. An attacker with valid credentials can craft a malicious link or payload that, when clicked by another user, executes arbitrary JavaScript in their browser context. This affects WAF versions from 1.0.42.239 up to (but not including) 1.4.0.117.
CVE-2026-48562MEDIUM 4.6
CVE-2026-48562 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server that allows an authorized user to inject malicious code into web pages. When other users view the compromised page, the attacker's code executes in their browser, enabling spoofing attacks—impersonation or manipulation of content that appears to come from legitimate sources. This requires an attacker already have valid SharePoint credentials and the victim must interact with the malicious content, but once those conditions are met, the attack is straightforward to execute.
CVE-2026-49316MEDIUM 4.6
A vulnerability in the 2025 Indian Motorcycle Scout Bobber + Tech model allows someone with access to the motorcycle's wireless network to disable anti-theft protections and operate the vehicle without proper authorization. An attacker can manipulate error messages on the motorcycle's internal communication system (CAN bus) to silence the Wireless Control Module, which normally enforces shutdown commands tied to the immobilizer. Once this module stops communicating, other systems on the motorcycle treat its silence as normal rather than a security event, leaving the bike vulnerable to theft despite the immobilizer lock never being engaged.
CVE-2026-49324MEDIUM 4.6
A vulnerability in the Wireless Control Module of the 2025 Indian Motorcycle Scout Bobber + Tech allows someone with access to the bike's internal network to permanently disable it. By sending a small number of specially crafted wireless messages, an attacker can trigger a lockout on the motorcycle's immobilizer system—the security mechanism that prevents unauthorized starting. Unlike typical lockouts that reset when you power cycle the device, this one persists even after restarting the bike, leaving owners unable to start their motorcycle until they visit a dealer for service.
CVE-2026-49325MEDIUM 4.6
Indian Motorcycle's 2025 Scout Bobber + Tech model contains a physical security flaw in its anti-theft system. An attacker with access to the motorcycle's Wireless Control Module (WCM) wiring harness can disconnect a specific wire pair to bypass the PIN-protected shutdown mechanism, leaving the bike fully operational and vulnerable to theft. The vulnerability exploits a gap in how the motorcycle's engine control unit (ECU) validates shutdown signals—it cannot tell the difference between a legitimate shutdown command and a severed wire.
CVE-2026-50099MEDIUM 4.6
Naxclow device firmware exposes sensitive WiFi credentials and encryption keys through an unprotected hardware debugging interface. When devices connect to a network, they broadcast the WiFi password and security keys in plaintext via a labeled UART serial port that runs a command shell. An attacker who can physically access the device for a few minutes—realistic for outdoor-mounted hardware—can extract these credentials and potentially compromise the device's firmware. This is a physical-access vulnerability, but the exposed credentials create downstream network risks.
CVE-2026-56269MEDIUM 4.6
Flowise, a popular open-source workflow automation platform, contains a hardcoded encryption secret in versions 3.0.13 and earlier. When administrators don't explicitly configure the TOKEN_HASH_SECRET environment variable, the application defaults to a publicly known weak value ('Secre$t'). This secret is used to encrypt sensitive metadata (user IDs and workspace IDs) embedded within authentication tokens. An attacker who discovers or deploys Flowise with this default secret can decrypt the metadata to learn internal identifiers and potentially manipulate them. While this alone doesn't bypass authentication, it could facilitate privilege escalation or lateral movement by revealing system structure and enabling token forgery attempts.
CVE-2026-61456MEDIUM 4.6
The Grav API plugin before version 1.0.3 contains a stored cross-site scripting (XSS) vulnerability in its media upload handler. An authenticated user with API media write permissions can upload an SVG file containing malicious JavaScript. Because the plugin fails to sanitize SVG content and serves the file with an image MIME type, opening the file in a browser causes the embedded script to execute in the administrator's session context. This allows attackers to steal session cookies or hijack admin sessions without requiring any additional user interaction beyond the attacker uploading the payload.
CVE-2026-6683MEDIUM 4.6
FatFs R0.16 and earlier has a divide-by-zero defect in its exFAT sync code. When specially crafted filesystem metadata is processed during write or sync operations, internal calculations can attempt division by zero, crashing the file system handler. The vulnerability requires physical access or locally authenticated access in most scenarios, though network-delivered firmware or storage updates could theoretically enable remote exploitation in certain deployment contexts. The impact is denial of service—legitimate I/O operations will fail until the system is restarted or the corrupted metadata is removed.
CVE-2026-6684MEDIUM 4.6
FatFs, a widely-used embedded filesystem library, contains a denial-of-service vulnerability in versions before R0.16 when GPT (GUID Partition Table) scanning is enabled with 64-bit LBA support. An attacker with physical access to a storage device can craft a malicious GPT header with an extremely large or unbounded partition count value, causing any system mounting that device to enter an effectively infinite loop during initialization. This results in a hung or unresponsive device at mount time, disrupting availability without requiring authentication or user interaction.
CVE-2026-6686MEDIUM 4.6
FatFs R0.16 and earlier has a flaw where the f_lseek() function can expose uninitialized data when it extends a file beyond its current end without properly clearing the newly allocated disk clusters. An attacker with physical access to a system could read sensitive information from unallocated or previously used disk space by crafting a file system that triggers this behavior.
CVE-2026-9799MEDIUM 4.6
A vulnerability in Keycloak's User-Managed Access (UMA) system allows an authenticated user to bypass access controls by crafting a specific permission request. If a user has legitimate access to one resource via UMA, they can potentially manipulate their request to gain unauthorized access to all similar resources in the same resource server—even ones they should not have permission to access. This only happens in Keycloak instances configured with permissive policy enforcement mode on typed resources with owner-managed access enabled. The impact is limited to information disclosure or unauthorized modification, not system availability.
CVE-2026-0410MEDIUM 4.5
CVE-2026-0410 is a privilege-escalation vulnerability affecting Netgear routers. An authenticated administrator already connected to the local network can exploit improper input validation to gain elevated access and modify router firmware and settings without authorization. The vulnerability requires the attacker to already have valid admin credentials and local network access, which limits the practical threat surface but poses significant risk in environments where router access controls are not tightly managed.
CVE-2026-0412MEDIUM 4.5
A vulnerability in NETGEAR JR6150 routers allows someone with administrative access on the local network to modify the router's software and settings without proper authorization. The issue stems from inadequate validation of user input. This router model is quite old—released in 2014 and no longer supported by NETGEAR as of 2018—meaning no security patches will be issued. The vulnerability was discovered through controlled testing of the device's firmware in a lab environment, not on actual deployed hardware.
CVE-2026-0413MEDIUM 4.5
A buffer overflow flaw in NETGEAR Orbi mesh router firmware allows authenticated administrators on the local network to modify router software and functionality without authorization. The vulnerability stems from insufficient input validation, meaning an admin account could inject malicious data that overwrites system memory. While exploitation requires valid administrative credentials and local network access, the ability to alter router firmware represents a serious integrity compromise.
CVE-2026-0414MEDIUM 4.5
NETGEAR has a vulnerability in certain router models that allows authenticated administrators on the local network to bypass input validation controls and modify the router's software and core functionality without proper authorization checks. While the attacker must already have administrative credentials and be connected locally, the lack of proper validation on modification requests means an insider threat or compromised admin account could alter router behavior in ways the organization doesn't intend or expect.
CVE-2026-0415MEDIUM 4.5
A validation flaw in NETGEAR Orbi and Nighthawk mesh router firmware allows authenticated administrators on the local network to modify router software and settings without proper authorization checks. While the attacker must already have admin credentials and network access, the insufficient input validation creates a pathway to alter router functionality in unintended ways. This is a medium-severity issue affecting a broad range of NETGEAR mesh and satellite models.
CVE-2026-0416MEDIUM 4.5
NETGEAR has identified a vulnerability affecting their RAX Wi-Fi 6 router models (RAXE450 and RAXE500) in which an authenticated administrator on the local network can send specially crafted input through the management interface to bypass built-in security controls. This could allow the attacker to modify the router's protected software or core functionality without authorization. The flaw requires an admin account and physical/local network proximity, which constrains the attack surface but remains a concern in environments where multiple administrators manage network devices.
CVE-2026-0417MEDIUM 4.5
NETGEAR has patched an input validation flaw affecting 21 router models. An authenticated administrator on the local network can send specially crafted requests to bypass validation checks and tamper with the router's core configuration or operation. The vulnerability requires administrator-level access and direct network connectivity, which limits the threat to insider risk or compromised admin accounts on the same network segment. The impact is integrity-focused—data confidentiality and system availability are not affected.
CVE-2026-0418MEDIUM 4.5
CVE-2026-0418 is a configuration management weakness in Netgear networking devices that allows administrators already logged into the local network to make unauthorized changes to system settings. The vulnerability requires authentication and local network access, limiting its reach to internal threats or compromised admin accounts. Netgear has published this issue affecting routers, mesh systems, and cellular gateways across multiple product lines.
CVE-2026-10814MEDIUM 4.5
Milvus, a popular vector database, contains a weakness in how it generates hash identifiers for grantee access control. An attacker with local access and sufficient privileges could exploit weak cryptographic hashing in the Grantee ID Hash Handler to potentially forge or predict access control identifiers, leading to unauthorized data access or modification. The vulnerability requires high technical complexity to exploit and is rated as medium severity.
CVE-2026-11623MEDIUM 4.5
A use-after-free memory vulnerability exists in tmux versions up to 3.6a, specifically within the image handling code. An attacker with local system access could trigger this flaw through a complex exploitation chain to read, modify, or crash tmux processes. While a public exploit has been disclosed, the attack requires both local access and deliberate manipulation, making opportunistic exploitation unlikely. The issue is resolved by upgrading to version 3.7-rc or applying the specific patch commit fc6d94a9f8a593bd8b7031650802084385d4ee03.
CVE-2026-13502MEDIUM 4.5
A timing vulnerability has been discovered in ANTLR4's Maven plugin (versions up to 4.13.2) that could allow a local attacker to manipulate file operations during the deserialization process. The flaw exploits a race condition between checking and using files, potentially leading to unauthorized access to sensitive data or modification of build artifacts. Exploitation requires local system access, elevated privileges, and significant technical skill, making it a targeted rather than widespread risk.
CVE-2026-44640MEDIUM 4.5
NanoMQ is an edge messaging platform that implements the MQTT protocol for lightweight IoT and edge device communication. A type confusion bug exists in versions before 0.24.14 in how the broker handles QUIC connection objects during the dialing and closing lifecycle. When the broker initiates a QUIC connection (dialing), it stores a pointer as one type (nni_quic_conn), but later during cleanup, the code misinterprets that same pointer as a different type (ex_quic_conn). This mismatch causes the broker to read and operate on invalid memory, resulting in hangs or crashes when closing connections. The issue requires local access and user interaction to trigger.
CVE-2026-49382MEDIUM 4.5
A vulnerability in JetBrains IntelliJ IDEA's Copyright plugin allows an attacker to execute code on a developer's machine through template injection. The attack requires local access and user interaction—specifically, a developer must open a malicious project or file. While the severity is moderate, this poses a real risk in shared development environments or when developers download untrusted projects.
CVE-2026-55798MEDIUM 4.5
Pillow, a widely-used Python image processing library, contains a command injection vulnerability in its Windows image viewer functionality. When Pillow opens an image file on Windows, it constructs a system command to display the image, but fails to properly escape the file path before passing it to the shell. An attacker can craft a malicious image file with shell metacharacters in its name—such as ampersands or pipes—to inject and execute arbitrary Windows commands with the privileges of the user running the Python application. The vulnerability requires user interaction (opening a file) and is fixed in version 12.3.0 and later.
CVE-2026-8650MEDIUM 4.5
Progress MOVEit Transfer contains a relative path traversal vulnerability in its Admin Settings module that allows an authenticated administrator to read sensitive files on the server. The flaw exists in versions before 2025.0.7 and 2025.1.x versions before 2025.1.3. While it requires high-privilege access and provides read-only exposure, the ability to traverse the file system and access confidential data presents a meaningful risk to organizations relying on MOVEit for secure file transfer operations.
CVE-2026-9210MEDIUM 4.5
A NETGEAR router firmware vulnerability allows authenticated administrators on the local network to bypass input validation controls and make unauthorized changes to router software and settings. An attacker with admin credentials and direct network access can modify core router functionality without proper authorization checks. This is a localized threat that requires existing administrative access to exploit, limiting its blast radius but still representing a significant risk to network integrity if admin credentials are compromised.
CVE-2025-13162MEDIUM 4.4
CVE-2025-13162 is a search path vulnerability affecting ABB's industrial automation software—specifically Control Builder A and the 800xA system for Advant Master. An authenticated local user with limited privileges can manipulate the application's search path to cause unintended file or library loading, potentially leading to unauthorized modifications or unexpected behavior. The vulnerability requires user interaction and a somewhat difficult exploitation path, making it moderately concerning rather than critical. It does not currently appear on CISA's KEV catalog.
CVE-2025-62851MEDIUM 4.4
CVE-2025-62851 is a path traversal vulnerability affecting QNAP License Center that allows a local administrator to read files and system data they should not have access to. An attacker who already has administrative credentials can use this flaw to navigate the file system and extract sensitive information. The vulnerability has a CVSS score of 4.4 (Medium severity) and is addressed in License Center version 1.9.56 and later.
CVE-2026-0268MEDIUM 4.4
A vulnerability in Palo Alto Networks' Prisma Access Agent for Linux allows a local user on an affected system to bypass security controls and route network traffic outside the intended VPN tunnel. This is a local attack that requires an authenticated user account and does not affect Windows, macOS, iOS, Android, or ChromeOS deployments. An attacker exploiting this could potentially access resources or send data outside the VPN tunnel without proper security monitoring.
CVE-2026-10100MEDIUM 4.4
The Simple Custom Login Page plugin for WordPress contains a security flaw that allows administrators to inadvertently inject malicious code into the login page viewed by all users. When a site admin configures colors for the login page through the plugin's settings, an attacker with admin access can craft CSS injection payloads in those color fields. Because the plugin doesn't properly validate these inputs before displaying them, an attacker can break out of the intended styling context and insert arbitrary CSS rules. This enables phishing attacks—for example, by hiding the real login form or overlaying a fake one to steal credentials.
CVE-2026-10104MEDIUM 4.4
The Product Video Gallery for WordPress plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated shop managers and higher-privilege users to inject malicious scripts into gallery pages. When other users visit these compromised pages, the injected scripts execute in their browsers. This vulnerability affects all versions up to and including 1.5.1.8 and results from the plugin's failure to properly sanitize and escape user input in the custom_thumbnail parameter.
CVE-2026-11356MEDIUM 4.4
The Ivory Search WordPress plugin contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 5.5.15. An administrator with the highest access level can inject malicious code into two plugin settings—menu_title and menu_magnifier_color—that will then execute in the browsers of any user who visits an affected page. This is a persistence risk: the malicious script lives in the database and runs every time someone views the compromised page.
CVE-2026-11358MEDIUM 4.4
The Orbit Fox WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in its admin settings panel. An authenticated administrator can inject malicious JavaScript that persists in the database and executes for any user viewing affected pages. The vulnerability exists only in multi-site WordPress installations or single-site setups where the unfiltered_html capability has been disabled—a common hardening practice. Versions up to and including 3.0.6 are affected.
CVE-2026-11411MEDIUM 4.4
A path traversal vulnerability exists in the iAI Lab PDF AI App version 4.21.0 for Android. The flaw is located in the chatpdf.pro component's getExternalCacheDir function, where improper handling of the _display_name parameter allows an attacker with local device access to manipulate file paths. This could enable unauthorized file access or modification on the affected device. Public exploit code is available, increasing the practical risk of exploitation.
CVE-2026-12041MEDIUM 4.4
The Chatra Live Chat plugin for WordPress contains a security flaw that allows administrators to inadvertently inject malicious scripts into the site through the plugin's settings panel. When an administrator (or anyone with equivalent permissions) saves settings in the plugin, those settings are not properly validated or cleaned, meaning an attacker with admin access could craft a malicious payload that runs in visitors' browsers. This risk is limited to WordPress multisite networks or sites where the 'unfiltered_html' capability has been restricted—standard single-site WordPress installations with unfiltered_html enabled are not affected.
CVE-2026-12108MEDIUM 4.4
The Highlighting Code Block plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 2.2.0. An authenticated administrator can inject malicious scripts through the plugin's settings that will execute for any user viewing affected pages. This vulnerability only manifests in WordPress multisite installations or where the unfiltered_html capability has been restricted, which are common hardening configurations.
CVE-2026-12114MEDIUM 4.4
A vulnerability in the Team Members – Multi Language Supported Team Plugin for WordPress allows authenticated administrators to inject malicious scripts into plugin settings. When other users visit pages containing these injected scripts, the malicious code executes in their browsers. This is a stored attack—the payload persists in the plugin's configuration. The vulnerability only manifests on WordPress multisite installations or where the unfiltered_html capability has been intentionally restricted, which are less common configurations. An attacker would need full administrator privileges to exploit it.
CVE-2026-12164MEDIUM 4.4
Fortra File Integrity Monitoring (FIM), the integrity monitoring solution formerly known as Tripwire Enterprise, contains a permission assignment flaw in its user import functionality. When administrators use the tetool import command to add users while FIM is actively running—especially if the import simultaneously creates or modifies roles and their associated permissions—the system may grant those imported users incorrect or overly permissive access rights. This means a user intended to have limited monitoring privileges could end up with elevated capabilities, creating an unintended privilege escalation within the FIM system itself.
CVE-2026-12399MEDIUM 4.4
The Gutenverse WordPress plugin—a page builder and site editor tool—contains a stored cross-site scripting (XSS) vulnerability in its admin settings. An editor or administrator with site access could inject malicious code that persists in the WordPress database. When other users visit affected pages, that injected code executes in their browsers. The vulnerability only manifests in WordPress multisite networks or installations where the unfiltered_html capability has been disabled, making it a targeted but real risk for certain WordPress configurations.
CVE-2026-12430MEDIUM 4.4
Blocksy Companion, a popular WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 2.1.45. Authenticated users with editor-level permissions or higher can inject malicious scripts into the plugin's admin settings that will execute for anyone viewing the affected pages. This vulnerability only manifests in WordPress multisite installations or single-site setups where the unfiltered_html capability has been disabled—a common hardening practice. The threat is limited to authenticated attackers but can lead to session hijacking, credential theft, or site defacement.
CVE-2026-12560MEDIUM 4.4
The Editorial Rating plugin for WordPress contains a cross-site scripting (XSS) vulnerability that allows administrators to inject malicious scripts through the 'Link URL' field. These scripts execute when anyone visits the affected page, potentially compromising site visitors. The vulnerability affects all plugin versions up to 4.0.5 and requires admin-level access to exploit, limiting its immediate blast radius but presenting a significant insider threat risk.
CVE-2026-12892MEDIUM 4.4
GStreamer, a popular multimedia framework used in many Linux applications and media players, contains a parsing flaw in its H.264 video handling. When a specially crafted video file with malformed extension data is opened, the parser can read one byte of memory it shouldn't have access to, potentially crashing the application or exposing a small amount of sensitive heap data. The vulnerability requires user interaction—someone must deliberately open a malicious video file—which limits its attack surface.
CVE-2026-13316MEDIUM 4.4
CVE-2026-13316 is a Server-Side Request Forgery (SSRF) vulnerability in Foreman and Red Hat Satellite that allows authenticated users with high privileges to manipulate HTTP proxy parameters. By doing so, an attacker can trick the application into making unauthorized requests to cloud metadata services—such as those available on AWS, GCP, or Azure—potentially exposing sensitive credentials and configuration data. The vulnerability requires high-privilege access and local interaction, limiting its immediate risk but posing a significant concern in environments where infrastructure metadata is valuable.
CVE-2026-13728MEDIUM 4.4
WatchGuard Fireware OS running on FireCluster deployments may use a hard-coded encryption key under certain rare conditions to encrypt saved credentials for Access Portal resources. If exploited, an attacker with high-level administrative privileges could potentially decrypt and recover those stored credentials. The vulnerability does not affect standalone Fireboxes or devices without Access Portal capability.
CVE-2026-14969MEDIUM 4.4
A security issue has been discovered in 389 Directory Server (Red Hat's LDAP directory solution) where sensitive data stored in the database is encrypted using a method that doesn't change the encryption key's starting point between different entries. This means an attacker who can access the filesystem and has administrative privileges could potentially figure out when two encrypted database entries contain the same plaintext information by looking at the encrypted data patterns—a weakness that undermines the confidentiality protection encryption is meant to provide.
CVE-2026-15283MEDIUM 4.4
WPvivid Backup for MainWP, a WordPress plugin used for backup management in multi-site setups, contains a stored cross-site scripting (XSS) flaw in its admin settings panel. An authenticated administrator can inject malicious scripts that persist in the database and execute in the browsers of other users who access the affected pages. The vulnerability is limited to WordPress multi-site installations or sites where the 'unfiltered_html' capability has been explicitly disabled—standard single-site WordPress installations with default settings are not at risk.
CVE-2026-21901MEDIUM 4.4
A flaw in Juniper Networks Junos OS and Junos OS Evolved allows a local administrator or privileged user to crash the management daemon by configuring or deactivating a specific SSH parameter. The vulnerability stems from improper handling of configuration data, where the system attempts to access memory that hasn't been allocated. Repeating the misconfiguration causes the daemon to restart repeatedly, disrupting management access. Only users with high-level administrative privileges can trigger this issue, and patched versions are available from Juniper.
CVE-2026-2500MEDIUM 4.4
The Quick Playground plugin for WordPress has a path traversal flaw that allows WordPress administrators to read sensitive files from the server. An authenticated admin could retrieve files like wp-config.php or /etc/passwd without proper authorization. The vulnerability only affects sites synchronized with WordPress Playground or running on playground.wordpress.net, which significantly constrains real-world exposure. All versions up to and including 1.3.4 are affected.
CVE-2026-3620MEDIUM 4.4
The Word Replacer plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 0.4. An attacker with administrator-level access can inject malicious scripts through the plugin's 'replacement' parameter. These scripts persist in the WordPress database and execute whenever any user visits an affected page, potentially allowing credential theft, session hijacking, or defacement. The vulnerability stems from inadequate input validation and output encoding in the plugin code.