By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 76 of 86

• CVE-2026-38973MEDIUM 4.4

  mrubyc, a lightweight Ruby virtual machine implementation, contains a flaw that allows the software to read memory beyond allocated boundaries when looking up missing methods. An attacker with local access could trigger this vulnerability through user interaction, potentially exposing sensitive data in memory or causing the application to crash. The vulnerability affects mrubyc through version 3.4.1.

• CVE-2026-41701MEDIUM 4.4

  Spring AMQP's RabbitTemplate.sendAndReceive() method uses predictable correlation IDs when configured with a fixed reply queue. An attacker with elevated privileges and network access could potentially intercept or manipulate message correlations because the IDs follow a simple counter pattern rather than being cryptographically random. This affects multiple versions across four release branches of Spring AMQP.

• CVE-2026-41978MEDIUM 4.4

  A permission control vulnerability exists in a clone module that could allow an unauthorized user to access sensitive information. The issue arises from improper permission checks when cloning resources, potentially exposing confidential data. While the vulnerability requires local access and user interaction to exploit, it carries a medium risk profile and warrants timely remediation to protect data confidentiality.

• CVE-2026-44268MEDIUM 4.4

  Dell PowerProtect Data Domain contains a permissions vulnerability that could allow a high-privileged local attacker to read sensitive data. The issue stems from incorrect file or resource permission assignment in affected versions. An attacker with existing administrative or root access could escalate their capabilities to access confidential information they shouldn't be able to reach. This is not a remote vulnerability—it requires someone already on the system with elevated privileges.

• CVE-2026-44269MEDIUM 4.4

  Dell PowerProtect Data Domain contains a symlink-following vulnerability that allows an attacker with high-level local system access to read sensitive files they shouldn't be able to access. The flaw exists in versions 7.7.1.0 through 8.6, affecting multiple support branches (LTS2026, LTS2025, and LTS2024). While the attacker must already have elevated privileges on the system, the vulnerability could lead to unauthorized disclosure of confidential data stored on the backup appliance.

• CVE-2026-45279MEDIUM 4.4

  Nextcloud Server contains a path traversal vulnerability that allows non-admin users to copy files into their own Nextcloud directories in certain scenarios. The vulnerability exists in specific versions and depends on underlying Unix file system permissions. An attacker would need already-elevated user privileges within Nextcloud to exploit this issue, limiting the practical threat surface.

• CVE-2026-45702MEDIUM 4.4

  OP-TEE, a security-focused component running on Arm processors, contains a type confusion flaw when handling memory-sharing requests from the normal operating system. The vulnerability only affects specific OP-TEE configurations used to manage secure applications (when both SPMC mode and secure partition features are enabled). An attacker with high system privileges can trigger a denial of service, though the flaw does not expose sensitive data or allow code execution. Upgrading to OP-TEE version 4.11.0 or later resolves the issue.

• CVE-2026-46388MEDIUM 4.4

  osquery, a widely-used operating system monitoring framework, has a file permission flaw that allows unprivileged users to read sensitive data during file carve operations. When osquery extracts files (a feature called 'carving'), it creates temporary directories with overly permissive access controls. An attacker with local access can watch these temporary locations and read files being extracted before they're cleaned up—potentially including system files the attacker shouldn't be able to access. This is a local privilege escalation risk that requires an attacker to already have some level of system access and user interaction to exploit.

• CVE-2026-46468MEDIUM 4.4

  Dell PowerProtect Data Domain contains a vulnerability where the system doesn't properly check symbolic links before accessing files. An attacker with high-level local system access could exploit this to read sensitive information they shouldn't normally access. While the attack requires significant privileges and local access, the potential exposure of confidential data makes this a meaningful security concern for organizations relying on Data Domain for backup and archival operations.

• CVE-2026-47190MEDIUM 4.4

  IPAM (IP Address Manager) for Cluster API Provider Metal3 granted its controller pod excessive permissions to read, modify, and delete Kubernetes Secrets—a capability it never uses during normal operation. If an attacker compromised the controller pod through a supply chain attack or container escape, they could exploit these overly broad permissions to steal sensitive credentials and other secret data stored in the cluster. This permission misconfiguration has been corrected in patched versions.

• CVE-2026-47733MEDIUM 4.4

  Rocket.Chat versions before 8.5.0 contain a flaw in how the ImageElement component processes user-supplied image URLs in markdown content. When rendering image links, the component fails to filter dangerous protocol prefixes like javascript: and data:, allowing an authenticated attacker to craft a malicious markdown image that executes arbitrary JavaScript when clicked by another user. The vulnerability requires user interaction (clicking the link) and works primarily on older browsers, but poses a real risk in environments where users share untrusted markdown content or where attackers have internal access.

• CVE-2026-47778MEDIUM 4.4

  Envoy proxy versions before 1.35.11, 1.36.7, 1.37.3, and 1.38.1 contain a certificate validation bypass vulnerability. An attacker can craft a certificate with a malicious DNS Subject Alternative Name (SAN) containing a hidden NUL byte character. Due to improper string handling in the validation logic, Envoy truncates the certificate's SAN at the NUL byte and compares only the truncated portion against expected values, allowing an invalid certificate to pass validation. This could enable a sophisticated attacker with certificate-issuance capability to impersonate legitimate upstream services in Envoy-routed environments.

• CVE-2026-49088MEDIUM 4.4

  Kibana's optional application performance monitoring (APM) feature can inadvertently record sensitive HTTP request headers in application logs. If an operator with log file access gains visibility into these logs, they may be exposed to sensitive information such as authentication tokens or API keys that were passed in request headers. This is a logging misconfiguration issue rather than a direct attack vector—the vulnerability requires both APM instrumentation to be enabled and an insider or log-access breach to be exploited.

• CVE-2026-5051MEDIUM 4.4

  HashiCorp Vault and Vault Enterprise versions prior to 2.0.1 contain a flaw in how they validate audit device configurations when using the legacy file audit path feature. The vulnerability stems from inconsistent application of plugin directory protections, which could allow a high-privileged attacker to read sensitive information from the system. This is not an active exploitation target in the wild, but requires administrative-level access to trigger.

• CVE-2026-52757MEDIUM 4.4

  Ghidra, the National Security Agency's widely-used reverse-engineering and binary analysis platform, contains a memory safety bug in its decompiler. When a specially crafted binary file is opened in Ghidra's decompiler view, the application can access memory that has already been freed, potentially corrupting data or crashing the program. An attacker would need to distribute a malicious binary and convince a user to analyze it in Ghidra—the vulnerability itself does not allow remote code execution or network-based attacks.

• CVE-2026-54325MEDIUM 4.4

  Pi is a lightweight terminal-based coding environment that, prior to version 0.79.0, automatically loaded configuration files and extensions from a `.pi` directory in any repository without asking the user for permission first. An attacker could place malicious executable code (disguised as project-local extensions written in TypeScript or JavaScript) in a repository's `.pi` directory. When a user ran Pi in that directory, the malicious code would execute with the same privileges as the Pi process itself—essentially running whatever the attacker wanted on the user's machine. The fix in version 0.79.0 addresses this by requiring explicit user trust before loading project-local resources.

• CVE-2026-54776MEDIUM 4.4

  CoreWCF is a .NET Core implementation of Windows Communication Foundation that allows applications to build service-oriented systems. A security weakness exists in how CoreWCF handles client authentication when services use Unix Domain Sockets with PosixIdentity credentials. Specifically, the vulnerability allows an attacker with local system access to bypass the authentication process by connecting without completing the required security handshake, potentially gaining unauthorized access to service functionality. This affects CoreWCF versions before 1.8.1 and 1.9.1.

• CVE-2026-56788MEDIUM 4.4

  RTKLIB, an open-source GNSS/GPS processing toolkit, contains a flaw that crashes the application when it encounters RINEX observation files with unrecognized code types. An attacker can craft malicious RINEX files that trigger the crash and potentially expose sensitive data from the application's memory. The vulnerability affects versions through 2.4.3 and requires user interaction—someone must open or process the malicious file—but no special privileges are needed.

• CVE-2026-57966MEDIUM 4.4

  A path traversal flaw in spice-vdagent allows a malicious or compromised SPICE host to write arbitrary files anywhere on a guest system. When a SPICE host initiates a file transfer, the agent doesn't validate the filename, enabling an attacker to place files in sensitive directories with the privileges of the logged-in user. This is a real but constrained risk: it requires either control of or a compromise of the SPICE host itself, not just network access.

• CVE-2026-59831MEDIUM 4.4

  GitHub CLI (gh) versions 2.10.0 through 2.95.0 contain a vulnerability in the `gh codespace jupyter` command that can lead to arbitrary command execution. When opening a Jupyter notebook in a Codespace, the tool fails to validate that the JupyterLab URL is legitimate, allowing an attacker controlling a malicious Codespace to craft a specially formatted vscode:// or vscode-insiders:// URL. This URL is then passed to VS Code without validation, potentially leading to command execution on the user's local machine. The vulnerability requires an authenticated user to connect to a malicious Codespace, making it a supply-chain or social engineering risk for development teams.

• CVE-2026-7421MEDIUM 4.4

  A WordPress plugin called Passeum Ticketing contains a vulnerability that allows site administrators to inadvertently (or maliciously in compromised accounts) inject malicious scripts into a website. The plugin fails to properly validate the shop name setting, allowing an attacker with admin access to point the site to a malicious domain. When this happens, the plugin loads JavaScript and CSS files from that attacker-controlled domain, which then executes on every page of the website for all visitors. This is a stored cross-site scripting (XSS) vulnerability specific to multisite WordPress installations.

• CVE-2026-7430MEDIUM 4.4

  The Post Snippets plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting all versions up to 4.0.19. An authenticated administrator can inject malicious code through the plugin's import feature. When that code is imported, it gets embedded unsafely into the post editor's JavaScript, allowing the attacker to execute arbitrary scripts that run whenever any administrator opens a post editor page. This is a privilege-escalation and persistence risk: an attacker with admin access can compromise the experience of other admins and potentially maintain control across sessions.

• CVE-2026-8330MEDIUM 4.4

  GitLab has patched a vulnerability in both Community Edition (CE) and Enterprise Edition (EE) that could leak sensitive information into application logs. The issue affects a CI/CD API endpoint and requires high privileges to trigger—an authenticated admin or user with elevated permissions must perform a specific action. While the exposure is localized to logs (not remote network access), the leaked data could include credentials, tokens, or other secrets that would normally be protected. Administrators should update to the patched versions as part of normal security maintenance.

• CVE-2026-8853MEDIUM 4.4

  MW WP Form, a WordPress plugin used for form management, contains a stored cross-site scripting (XSS) flaw in how it handles memo field data. An attacker with editor-level WordPress access or higher can inject malicious scripts into memo fields that will execute in the browsers of anyone viewing affected pages. The vulnerability exists because the plugin stores memo data directly without properly cleaning or escaping it, and uses a database storage method that bypasses WordPress's built-in security filters.

• CVE-2026-8991MEDIUM 4.4

  A WordPress plugin called 'Drag and Drop Multiple File Upload for Contact Form 7' contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.3.9.7. An attacker with administrator access can inject malicious scripts into the plugin's settings, which will then execute in the browsers of any user who views the affected pages. This is a privilege-escalation risk that exploits insufficient input validation on two specific settings fields.

• CVE-2026-9594MEDIUM 4.4

  The WP Maps plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 4.9.4. An attacker with administrator access or a custom role granted the wpgmp_manage_location capability can inject malicious scripts into location messages. These scripts execute whenever site visitors access pages containing the injected content, potentially compromising user sessions, stealing credentials, or redirecting visitors to malicious sites. The vulnerability requires authenticated access and administrative privileges, limiting its immediate risk but making it a concern for organizations with admin account security gaps or custom role configurations.

• CVE-2026-9651MEDIUM 4.4

  CVE-2026-9651 is a file permission vulnerability affecting Schneider Electric industrial control system products. An attacker with administrative or privileged local access to an affected device can read system files that contain password hashes, potentially enabling account compromise. The vulnerability requires high-level local privileges to exploit and does not allow remote access or denial of service, which limits its immediate risk profile but remains concerning for insiders or those who have already gained local foothold on vulnerable systems.

• CVE-2016-20067MEDIUM 4.3

  WordPress CP Polls version 1.0.8 contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick administrators into performing unintended actions on their WordPress sites. An attacker can create a malicious webpage that, when visited by a logged-in site administrator, silently executes poll-related operations without the administrator's knowledge or consent. This works because the plugin fails to validate that requests originate from legitimate sources.

• CVE-2016-20074MEDIUM 4.3

  The Lazy Content Slider WordPress plugin version 3.4 is vulnerable to cross-site request forgery (CSRF), a type of attack where an attacker tricks an authenticated site administrator into unknowingly changing the plugin's settings. An attacker would craft a malicious web page that, when visited by a logged-in WordPress admin, silently submits configuration changes to the plugin—such as altering color schemes or display counts—without the administrator's knowledge or consent. This vulnerability requires the attacker to socially engineer an admin into visiting a malicious page, but the actual attack happens without additional user interaction once the admin is tricked.

• CVE-2019-25717MEDIUM 4.3

  Dräger's Infinity Delta, Delta XL, and Kappa patient monitors expose sensitive log files to unauthenticated attackers on the local network. An attacker with network access can retrieve device internals, location data, and network configuration without needing credentials. This is a network-adjacent threat that discloses operational details but does not enable direct device compromise or manipulation.

• CVE-2022-47150MEDIUM 4.3

  A cross-site request forgery (CSRF) vulnerability exists in weDevs' WooCommerce Conversion Tracking plugin through version 2.0.10. This flaw allows attackers to trick site administrators into performing unintended actions—such as modifying tracking settings or disabling conversion monitoring—by crafting malicious web pages or emails. The attack requires user interaction but does not require authentication, making it a moderate-severity issue for e-commerce sites relying on this plugin.

• CVE-2023-32959MEDIUM 4.3

  CVE-2023-32959 is a missing authorization flaw in Sparkle WP MetroStore, a WordPress plugin, affecting versions up to 1.3.2. An authenticated attacker with basic user privileges can modify data or content they should not have access to because the plugin fails to properly enforce access control checks. The vulnerability requires login credentials but does not require user interaction from a victim, making it a practical concern in multi-user WordPress environments.

• CVE-2024-24709MEDIUM 4.3

  Shareaholic versions up to 9.7.11 contain a missing authorization flaw that allows authenticated users to modify data they shouldn't have access to. Because the plugin fails to properly enforce access control checks on certain functions, a logged-in user with minimal permissions could exploit misconfigured security levels to alter content or settings beyond their intended scope. This is a privilege-escalation scenario where authorization logic is absent rather than broken.

• CVE-2024-31435MEDIUM 4.3

  CVE-2024-31435 is a missing authorization flaw in the Inisev Social Media & Share Icons plugin (versions up to 2.8.6) that allows unauthenticated attackers to modify content through incorrectly configured access controls. An attacker can exploit this by tricking a user into visiting a malicious link, then making unauthorized changes without proper permission checks. This is a moderate-severity vulnerability that affects the integrity of plugin functionality but does not expose sensitive data or cause service disruption.

• CVE-2024-32110MEDIUM 4.3

  The WpEvently WordPress plugin through version 4.1.2 contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick authenticated users into performing unintended actions on the site without their knowledge. An attacker can craft a malicious webpage that, when visited by a logged-in WordPress administrator or user, silently executes actions on behalf of that user—such as modifying plugin settings or creating unauthorized content. The vulnerability requires user interaction (visiting a malicious link or page) but does not require the attacker to have direct access to the WordPress installation.

• CVE-2024-33685MEDIUM 4.3

  Startupzy contains a missing authorization vulnerability that allows authenticated users to perform actions they shouldn't be permitted to perform. The issue stems from incorrectly configured access control security levels—essentially, the application fails to properly verify what operations a logged-in user is allowed to execute. An attacker with valid credentials can exploit this to modify data or perform unauthorized changes, though they cannot read sensitive information or crash the system.

• CVE-2024-34810MEDIUM 4.3

  Skyline WP, a WordPress theme distributed by Extend Themes, contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to trick authenticated administrators into performing unintended actions on the site. An attacker could craft a malicious webpage or email that, when visited by a logged-in WordPress admin, would execute administrative functions without explicit user consent. The vulnerability affects all versions of Skyline WP through version 1.0.10.

• CVE-2024-35648MEDIUM 4.3

  A cross-site request forgery (CSRF) vulnerability exists in Andy Moyle Emergency Password Reset versions up to and including 8.0. An attacker can craft a malicious web page or email that, when visited by an authenticated user, triggers unintended password reset actions without the user's knowledge or consent. The attack succeeds because the application does not properly validate the origin or intent of password reset requests.

• CVE-2024-37496MEDIUM 4.3

  CVE-2024-37496 is a missing authorization flaw in Rara Themes' Metro Magazine WordPress theme that allows unauthenticated users to perform certain actions they shouldn't be able to perform due to improperly configured access controls. An attacker could exploit this to modify content or settings without logging in, though the vulnerability requires user interaction (such as a click on a malicious link) to trigger. The issue affects Metro Magazine versions up to and including 1.3.7.

• CVE-2024-47273MEDIUM 4.3

  Synology Hyper Backup versions before 4.1.2-4036 contain a path traversal vulnerability in the Backup Task feature that allows an authenticated user to write files outside their intended directory. An attacker with valid credentials could exploit this to place files in restricted locations on the system, potentially compromising system integrity or enabling lateral movement.

• CVE-2025-32748MEDIUM 4.3

  Dell PowerFlex Manager versions before 5.1.0.1 contain a host header injection flaw that allows unauthenticated attackers with network access to craft malicious requests. By manipulating the HTTP Host header, an attacker can cause the application to redirect users to arbitrary external websites, potentially in service of phishing or social engineering campaigns. No authentication is required to trigger the vulnerability, but successful exploitation requires user interaction—the victim must follow the malicious redirect.

• CVE-2025-36319MEDIUM 4.3

  IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 contain a denial-of-service vulnerability accessible to authenticated users. An attacker with valid credentials can send a specially crafted HTTP request that exploits improper resource throttling controls, temporarily disrupting service availability. The vulnerability does not compromise confidentiality or integrity—only availability is at risk.

• CVE-2025-36324MEDIUM 4.3

  IBM watsonx.data intelligence contains a server-side request forgery (SSRF) vulnerability that allows authenticated users to make unauthorized requests from the affected system. An attacker with valid credentials could potentially probe internal network resources, discover services running on the local network, or use the compromised system as a pivot point for further attacks. The vulnerability affects versions 5.2.0 through 5.3.0.

• CVE-2025-36328MEDIUM 4.3

  IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 leak sensitive information through verbose error messages displayed in web browsers. An attacker with valid credentials can trigger these detailed error responses to extract system details that could facilitate further attacks. This is an information disclosure vulnerability requiring authentication to exploit.

• CVE-2025-36333MEDIUM 4.3

  IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 contain a flaw that allows authenticated users to bypass intended workflow restrictions and perform actions they should not be permitted to execute. An attacker with valid credentials could exploit this to make unauthorized changes within the platform, though the vulnerability does not enable data theft or system unavailability. The issue stems from inadequate enforcement of behavioral workflow controls during user action validation.

• CVE-2025-48571MEDIUM 4.3

  A logic error in Android's Bluetooth management code (btm_sec.cc) creates a window where attackers can intercept incoming SMS messages. An attacker on the network could exploit this to read message content without needing special device permissions, but requires user interaction to succeed—for instance, the user must be engaged in a Bluetooth operation when the interception occurs. The vulnerability carries medium severity; while SMS interception is serious, the requirement for user interaction and network proximity limits the attack surface.

• CVE-2025-52606MEDIUM 4.3

  HCL iControl contains a weakness in how it validates user input during its security architecture implementation. The application fails to properly check that incoming data matches the expected type before processing it, allowing an authenticated attacker to submit malformed input that the system does not adequately verify. This can lead to unintended modifications of application state or data.

• CVE-2025-53346MEDIUM 4.3

  CVE-2025-53346 is a missing authorization flaw in ThimPress Thim Core that allows authenticated users to modify data or settings they should not have access to. The vulnerability stems from inadequate access control checks, meaning the application fails to properly verify whether a logged-in user has permission to perform specific actions. While an attacker must already have valid login credentials, the weakness could allow them to escalate privileges or tamper with configuration or content outside their intended scope.

• CVE-2025-59872MEDIUM 4.3

  HCL ZIE for Web contains a file upload vulnerability that allows authenticated users to upload files without proper restrictions. If the server is configured to execute code—a common default in web environments—an attacker could upload a malicious script (web shell) to gain remote command execution. The vulnerability requires an authenticated account and depends on server configuration, which limits its immediate risk but makes it a serious concern in environments where these conditions are met.

• CVE-2025-63078MEDIUM 4.3

  Restaurant Menu by MotoPress versions 2.4.11 and earlier contain a broken access control vulnerability that allows authenticated subscribers to modify menu data they should not have permission to access. An attacker with a subscriber account can change restaurant menu information without proper authorization checks, potentially altering prices, descriptions, or availability of menu items. This is a localized privilege escalation issue affecting the restaurant management functionality of the plugin.

• CVE-2025-63079MEDIUM 4.3

  The Live Copy Paste plugin for Elementor contains an access control flaw that allows contributors—users with limited editing privileges—to perform actions they should not be authorized to perform. The vulnerability affects versions 1.5.3 and earlier. While the impact is limited to information disclosure and does not enable privilege escalation or system compromise, it represents a meaningful security boundary violation in WordPress environments where contributor access is intentionally restricted.

• CVE-2025-71379MEDIUM 4.3

  vLLM, a popular open-source large language model serving framework, contains multiple regular expression parsing flaws that can be exploited to cause denial of service. Versions 0.6.3 through 0.9.0 are affected. An authenticated attacker can craft specially formatted input—containing nested or repeated structures—that causes the regex engine to consume excessive CPU, degrading or halting service availability. The vulnerability exists in multiple code paths: LoRA utility parsing, a phi4mini tool parser, and the OpenAI-compatible chat API endpoint.

• CVE-2026-0140MEDIUM 4.3

  CVE-2026-0140 is a remote information disclosure vulnerability in Android's RTP (Real-time Transport Protocol) packet handling. An integer overflow in the RtpPacket::decodePacket function allows an attacker to read data beyond intended memory boundaries when processing specially crafted RTP packets. The flaw requires user interaction—such as receiving and processing a malicious RTP stream—but does not need special privileges. An attacker could potentially extract sensitive information from device memory without executing code.

• CVE-2026-0141MEDIUM 4.3

  A flaw in Android's RTCP application packet handling allows an authenticated attacker to read sensitive data from device memory without triggering a system crash or requiring user interaction. An attacker with network access and valid credentials can craft a malformed packet that bypasses a bounds check, exposing information that could be used in further attacks. This is a classic information disclosure vulnerability—the attacker cannot modify or delete data, but they can peek at what should remain hidden.

• CVE-2026-0155MEDIUM 4.3

  CVE-2026-0155 is a memory reading vulnerability in Google Android's ImsMediaBitReader component. An attacker with basic login access can trigger the code to read data outside intended memory boundaries, potentially exposing sensitive information. This does not require the victim to take any action and does not allow attackers to modify or crash the system—only to peek at unauthorized data in memory.

• CVE-2026-0157MEDIUM 4.3

  CVE-2026-0157 is a memory safety issue in Android's RTCP header processing that allows a logged-in attacker to read sensitive data from device memory without user action. The flaw exists in the RtcpHeader::decodeRtcpHeader function, which fails to validate data boundaries before reading, potentially exposing information like session keys, media content, or other in-memory secrets to a remote attacker with network access and valid credentials.

• CVE-2026-10023MEDIUM 4.3

  The Dokan multivendor marketplace plugin for WordPress contains a flaw that allows vendor-level users to manipulate orders they don't own. An authenticated vendor can change order statuses, inject fake notes and shipping tracking, or modify product download permissions on any marketplace order by reusing a valid security token from their own dashboard. This works because the plugin fails to verify that the vendor actually owns the order before performing the action.

• CVE-2026-10028MEDIUM 4.3

  CVE-2026-10028 is a denial-of-service vulnerability in glib-networking that can be triggered when an attacker presents a maliciously crafted certificate chain containing circular issuer relationships. When an application using glib-networking with GnuTLS backend processes such a chain, the certificate verification logic enters an infinite loop, consuming CPU resources until the process becomes unresponsive. The attack requires user interaction (such as visiting a malicious website or accepting a connection) and affects only the targeted process, not the wider system.

• CVE-2026-10038MEDIUM 4.3

  The Charitable donation plugin for WordPress contains a flaw that allows authenticated users with basic subscriber permissions to delete any attachment from a site's Media Library. The vulnerability exploits a two-step process: attackers first poison the stored avatar metadata with a target attachment ID, then trigger normal avatar upload functionality to delete it. While this requires login access, the low privilege level needed and straightforward execution method make it a practical risk for any WordPress site running this plugin where subscriber-level registration is enabled.

• CVE-2026-10096MEDIUM 4.3

  The Qi Blocks WordPress plugin contains a flaw that allows authenticated users with author-level permissions to modify styling and appearance of posts, pages, and site-wide templates they don't own. An author could deface content, hide text, or alter the visual presentation of any page on a WordPress site without owning or having permission to edit that content. The vulnerability stems from the plugin failing to verify that a user actually owns the post before allowing style changes.

• CVE-2026-10113MEDIUM 4.3

  Open5GS, an open-source 5G core network software suite, contains a vulnerability in its Shared NF-profile Parser component that can be exploited to disrupt service availability. An attacker with network access and valid authentication credentials can trigger a denial of service condition by manipulating the NF-profile parsing logic. The vulnerability affects Open5GS versions up to 2.7.7, and public exploit information is available, increasing the risk of active exploitation.

• CVE-2026-10114MEDIUM 4.3

  Open5GS versions up to 2.7.7 contain a flaw in how they parse shared NF profile information. When processing certain malformed input, the application writes data beyond the intended memory boundary, potentially crashing the service. While an attacker must have valid network credentials to exploit this, the vulnerability has been publicly disclosed, increasing the likelihood it will be weaponized.

• CVE-2026-10115MEDIUM 4.3

  Open5GS, an open-source 5G core network implementation, contains a flaw in how it parses network function profiles. An authenticated attacker can send a specially crafted request that causes the affected service to become unresponsive, disrupting normal operations. The vulnerability requires valid credentials to exploit and does not lead to data theft or unauthorized access—only temporary unavailability. Versions up to 2.7.7 are affected.

• CVE-2026-10116MEDIUM 4.3

  A vulnerability in Open5GS, a popular open-source 5G core network implementation, allows authenticated users to trigger a denial-of-service condition by manipulating the UE authentication endpoint. The flaw resides in timer transaction handling code and can be exploited remotely by anyone with legitimate access to the authentication service. Public exploit code is available, increasing the practical risk of abuse.

• CVE-2026-10117MEDIUM 4.3

  Open5GS, an open-source 5G core network implementation, contains a vulnerability in its HTTP/2 server library that can be exploited to cause a denial of service. An attacker with valid credentials can remotely trigger the issue by manipulating specific inputs to the pool allocation function, causing the application to become unresponsive or crash. Versions up to 2.7.7 are affected. Public exploit code exists, increasing the risk of opportunistic attacks.

• CVE-2026-10153MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability has been identified in westboy CicadasCMS. The flaw exists in the Search function and can be exploited by manipulating a specific argument to inject malicious scripts. An attacker can send a crafted request to a vulnerable instance to execute arbitrary JavaScript in the context of other users' browsers, potentially stealing session data, credentials, or performing actions on their behalf. Exploitation requires user interaction (such as clicking a malicious link) but does not require authentication. A proof-of-concept has already been published, increasing practical risk.

• CVE-2026-10154MEDIUM 4.3

  Dolibarr ERP CRM versions 23.0.0, 23.0.1, and 23.0.2 contain an authorization bypass vulnerability in the user messaging module. An authenticated attacker can manipulate the ID parameter in htdocs/user/messaging.php to access or view information they should not have permission to see. The vulnerability requires valid login credentials but allows a logged-in user to circumvent access controls. Upgrading to version 23.0.3 resolves the issue.

• CVE-2026-10156MEDIUM 4.3

  Open5GS, a popular open-source 5G core network implementation, contains a denial-of-service vulnerability in versions up to 2.7.7. An authenticated attacker can manipulate how the system manages network function instance information, causing the application to consume excessive resources and become unresponsive. The vulnerability has been publicly disclosed, but a patch is already available. This is a moderate-severity issue requiring prioritization for 5G infrastructure operators and anyone running affected Open5GS deployments.

• CVE-2026-10173MEDIUM 4.3

  Orthanc Explorer 2 versions up to 1.12.0 contain a reflected cross-site scripting (XSS) vulnerability in the StudyList component. An attacker can craft a malicious URL with a specially crafted 'remote-source' parameter that, when visited by a user, executes arbitrary JavaScript in their browser within the context of the Orthanc application. This allows theft of session tokens, modification of data, or unauthorized actions performed on behalf of the victim. The vulnerability requires user interaction—a victim must click a malicious link—but can be exploited remotely without authentication.

• CVE-2026-10215MEDIUM 4.3

  A flaw in Dolibarr ERP CRM's Leave Request REST API fails to properly check whether users have permission to access specific leave request objects. An authenticated attacker can remotely exploit this to view leave data they should not be able to see. The vulnerability affects versions up to 23.0.1, and Dolibarr has released version 23.0.2 as a fix. Because the exploit has been publicly disclosed, this poses an active risk despite its moderate CVSS score.

• CVE-2026-10282MEDIUM 4.3

  Bottelet DaybydayCRM versions up to 2.2.1 contain an authorization flaw in the Documents controller that allows authenticated users to access files they shouldn't be able to view. An attacker with valid login credentials can exploit this remotely to read sensitive documents beyond their intended access scope. The vulnerability is rated MEDIUM severity and requires patching.

• CVE-2026-10289MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in Hotel and Tourism Reservation System version 1.0. An attacker can inject malicious scripts by manipulating parameters in the reservation form—specifically the name, email, people count, or booking number fields in the /ht/tour.php file. When a victim visits a crafted link or page, the injected script executes in their browser, potentially allowing session hijacking, credential theft, or defacement. Public exploits are available, increasing active exploitation risk.

• CVE-2026-10291MEDIUM 4.3

  Enderfga's claw-orchestrator contains a flaw in how it validates regular expressions in the Session Grep Endpoint. An authenticated attacker can supply a maliciously crafted regex pattern that forces excessive CPU consumption, potentially slowing or freezing the service. This is a medium-severity issue affecting versions up to 3.7.0 and is remedied by upgrading to 3.7.1.

• CVE-2026-10294MEDIUM 4.3

  PackageKit, a system library for package management on Linux, contains an authorization bypass vulnerability in versions up to 1.3.5. An authenticated attacker can manipulate the frontend-socket parameter in the API to gain unauthorized access to sensitive information. The vulnerability requires an existing user account to exploit but does not require user interaction. While the attack surface is somewhat limited by authentication requirements, the unauthorized information disclosure poses a real security concern for systems relying on PackageKit.

• CVE-2026-10301MEDIUM 4.3

  A reflected cross-site scripting (XSS) vulnerability exists in itsourcecode Fees Management System version 1.0. An attacker can craft a malicious URL containing JavaScript code in the 'page' parameter of index.php. When a user visits this link, the script executes in their browser, potentially allowing theft of session cookies, credential capture, or malware redirection. The vulnerability requires user interaction (clicking a link) but poses a meaningful risk to organizations running this system, especially those handling sensitive fee or financial data.

• CVE-2026-10552MEDIUM 4.3

  The Blue Captcha WordPress plugin, through version 2.0.1, is vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious link or webpage that, when clicked by a site administrator, silently uninstalls the plugin, deletes security audit logs, removes IP addresses from the Hall of Shame blocklist, or adds arbitrary IPs to the banned list—all without the administrator's knowledge or consent. The vulnerability exists because the plugin does not properly validate that requests originate from the legitimate administrator and are intentional.

• CVE-2026-10553MEDIUM 4.3

  The jQuery Hover Footnotes plugin for WordPress contains a flaw that allows attackers to trick site administrators into unknowingly changing plugin settings. When an admin clicks a malicious link, the attacker can alter how the plugin displays content—including injecting malicious code that affects every visitor to the site. The vulnerability chains two separate weaknesses: the ability to forge requests without verification, followed by the ability to inject unescaped code into pages.

• CVE-2026-10616MEDIUM 4.3

  GoClaw, a component of nextlevelbuilder, contains a flaw in how it validates permissions when completing team tasks. An authenticated attacker can manipulate the Team Task Completion Handler to bypass authorization checks, potentially modifying task records they shouldn't have access to. The vulnerability requires a valid login and network access, and affects versions up to 3.11.3. While the issue carries a medium risk profile, the public availability of exploit details increases practical attack likelihood.

• CVE-2026-10623MEDIUM 4.3

  A WordPress plugin used for creating quizzes and exams has a flaw that lets teachers with higher access levels modify or delete quiz rules set up by other teachers without permission. The vulnerability requires someone to be logged into WordPress with instructor-level access or above, so it's not an external threat, but it does enable insider abuse or lateral privilege misuse within an educational institution using the plugin.

• CVE-2026-10624MEDIUM 4.3

  CVE-2026-10624 is a moderate-severity vulnerability in SourceCodester Human Resource Management version 1.0 that allows authenticated users to access employee information they should not be able to view. The flaw exists in the Employee View Page component and stems from improper handling of the 'employeeid' parameter, which an attacker can manipulate to bypass access controls. Because exploit code has been publicly disclosed, this vulnerability poses a realistic risk to organizations running affected systems.

• CVE-2026-10661MEDIUM 4.3

  A vulnerability in the blender-mcp project allows an authenticated attacker to inject malicious input through the input_image_url parameter in the Open function of src/blender_mcp/server.py. Because authentication is required and the vulnerability only exposes limited information (not enabling code execution or system availability impact), the overall risk is moderate. However, the public disclosure means exploitation techniques are now accessible to threat actors.

• CVE-2026-10691MEDIUM 4.3

  A vulnerability in wonderwhy-er DesktopCommanderMCP through version 0.2.38 allows an authenticated user to trigger a denial-of-service condition by crafting malicious search result data that causes inefficient regular expression processing. The flaw is in the search-manager component and can be exploited remotely by any logged-in user. The vendor has released version 0.2.39 with a fix.

• CVE-2026-10692MEDIUM 4.3

  A flaw exists in code-index-mcp versions up to 2.14.0 that allows authenticated users to cause performance degradation through specially crafted regular expressions. By submitting a malicious regex pattern to the search_code_advanced function, an attacker can trigger inefficient regex processing that consumes excessive CPU resources, leading to application slowdown or unresponsiveness. This is a denial-of-service weakness that requires login credentials to exploit but does not compromise confidentiality or data integrity.

• CVE-2026-10702MEDIUM 4.3

  A flaw in Firefox's JavaScript Just-In-Time (JIT) compiler can cause it to miscompile code in certain circumstances. When a user visits a malicious website, the affected browser may crash or become unstable due to incorrect code generation during compilation. This is not a memory corruption issue and does not allow attackers to steal data or take control of the system, but it does impact availability and user experience.

• CVE-2026-10733MEDIUM 4.3

  GitLab CE and EE versions up to 18.10.7, 18.11.4, and 19.0.1 contain a flaw that allows authenticated users to crash the CI/CD Catalog page. An attacker with valid GitLab credentials can trigger improper input handling in the Catalog interface, causing the service to become temporarily unavailable for users accessing that feature. The vulnerability requires authentication, so external attackers cannot exploit it directly, but it poses a localized availability risk within your GitLab instance.

• CVE-2026-10779MEDIUM 4.3

  A vulnerability in the Classified Listing WordPress plugin (up to version 5.4.2) allows authenticated users with basic subscriber access to change the featured image of classified listings they don't own. The plugin fails to verify that a user actually owns a listing before accepting AJAX requests to update its featured image, relying instead on a nonce token that is publicly visible to all logged-in users. This enables attackers to deface or manipulate listings operated by other users, potentially damaging reputation or misleading potential buyers.

• CVE-2026-10780MEDIUM 4.3

  The Static Block plugin for WordPress has a flaw that allows authenticated contributors and higher-level users to read private and draft posts they shouldn't have access to. An attacker with a contributor account can craft a shortcode that retrieves any post by its ID and preview it, bypassing WordPress's normal permission checks. This affects all versions of the plugin through 2.2.

• CVE-2026-10787MEDIUM 4.3

  Devolutions Server contains a flaw in its API for managing deleted user groups that fails to properly check permissions. An authenticated user with low-level access can craft specific API requests to view metadata about deleted user groups they should not be able to see. The vulnerability requires an attacker to already have valid credentials, limiting the attack surface, but it does represent a breach of data compartmentalization within the system.

• CVE-2026-10802MEDIUM 4.3

  A resource consumption vulnerability exists in KeystoneJS, an open-source headless CMS and GraphQL API framework. The flaw resides in the GraphQL API endpoint handler and can be exploited by authenticated users to exhaust server resources, potentially causing a denial-of-service condition. The vulnerability affects KeystoneJS versions up to March 19, 2026. Exploitation requires valid credentials but can be performed remotely over the network.

• CVE-2026-10810MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in itsourcecode Fees Management System version 1.0 and earlier. The flaw is located in the /navbar.php file, where unsanitized input in the 'page' parameter allows an attacker to inject malicious scripts. An attacker can craft a malicious URL and trick a user into clicking it, causing the injected script to execute in the victim's browser. This could lead to session hijacking, credential theft, or malware distribution. Public exploit code is available, increasing the risk of opportunistic attacks.

• CVE-2026-10854MEDIUM 4.3

  CVE-2026-10854 is a visibility control flaw in MISP's event template creation feature that allowed unauthorized users to see private galaxy data from other organizations. When creating an event template, the system listed all enabled galaxies without checking whether the user's organization owned them or whether they were marked private. This exposed sensitive metadata like galaxy type and description to users who shouldn't have access. The vulnerability requires authentication to exploit and affects only information disclosure—no data modification or denial of service is possible. MISP has patched the issue by filtering galaxy visibility based on organization ownership and distribution settings.

• CVE-2026-10855MEDIUM 4.3

  MISP, a threat intelligence platform, contained an authorization flaw in its event template import feature. When an authenticated user attempted to overwrite an existing event template, the system verified that a template with that name existed but failed to check whether the importing user's organization actually owned it. This allowed users from one organization to forcibly overwrite event templates belonging to other organizations. The flaw only affected non-administrator users; site administrators retained the ability to manage templates across organizational boundaries by design. The vulnerability has been remediated by adding an ownership verification step before permitting any template overwrite operation.

• CVE-2026-10864MEDIUM 4.3

  A flaw in MISP's dashboard widgets allows authenticated users with low-level access to bypass field restrictions and view sensitive information they shouldn't have access to. By manipulating which data fields the New Users and New Organisations widgets display, attackers can circumvent settings designed to hide user email addresses and other restricted organization metadata. The vulnerability stems from how the application processes field filtering—if redaction leaves the field list empty, it falls back to returning unfiltered data instead of enforcing safe defaults.

• CVE-2026-11031MEDIUM 4.3

  Google Chrome's Password Manager fails to properly validate input from network traffic before displaying it to users. An attacker can craft malicious network data that tricks the Password Manager interface into showing fake or misleading information—for example, a phishing prompt that looks legitimate. This affects Chrome versions before 149.0.7827.53 on Windows, macOS, and Linux.

• CVE-2026-11062MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how it enforces policies on browser extensions. An attacker could create a malicious extension that, if installed by a user, would be able to inject malicious scripts or HTML code into sensitive browser pages. While the technical barrier is relatively low (it requires social engineering to trick a user into installing the extension), the impact is limited to tampering with page content rather than stealing data or causing system crashes.

• CVE-2026-11107MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles the Downloads feature that allows an attacker to trick users with a deceptive webpage. Specifically, an attacker could craft a malicious HTML page that, when viewed in an affected Chrome browser, would display fake or misleading interface elements to deceive users—a technique called UI spoofing. The vulnerability requires user interaction (visiting the malicious page) but does not compromise confidentiality or system availability; the primary risk is deception around the integrity of what the user sees on their screen.

• CVE-2026-11126MEDIUM 4.3

  A flaw in Google Chrome's Developer Tools (DevTools) allows an attacker to access data from different websites if they can trick a user into installing a malicious browser extension. The vulnerability has a CVSS score of 4.3 (Medium severity) and requires user interaction—specifically, the user must be convinced to install the malicious extension. Once installed, the crafted extension can exploit improper input validation in DevTools to leak cross-origin data that should normally be protected by browser security policies.

• CVE-2026-11155MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how CSS is processed that could allow an attacker to trick a user into visiting a malicious website where sensitive data from other sites (cross-origin data) could be leaked. The attack requires user interaction—specifically clicking a link or visiting a crafted page—but does not require the attacker to have special permissions or bypass other security controls. The leaked information would be visible only to the attacker, not modified or destroyed.

• CVE-2026-11156MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how it handles CSS styling rules that can allow an attacker to extract data from other websites you have open in your browser. An attacker would need to trick you into visiting a malicious webpage, and if successful could read sensitive information from other tabs or windows—such as content from your email, banking site, or other services—that you're simultaneously visiting. This is a cross-origin data leak vulnerability affecting the browser's CSS implementation.

• CVE-2026-11159MEDIUM 4.3

  A memory safety issue in Google Chrome's Skia graphics library allows attackers to steal data from websites you visit. By crafting a malicious HTML page, an attacker could trick your browser into exposing information that should remain private to other websites—a cross-origin data leak. The vulnerability requires user interaction (clicking or viewing the page) but doesn't require special browser settings or authentication. Google patched this in Chrome 149.0.7827.53 and later versions.