By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 79 of 86

• CVE-2026-15375MEDIUM 4.3

  Eleveo Call Recording Software version 9.7.0 contains an authorization flaw in its LDAP user management interface that allows authenticated users to access or view information they shouldn't be permitted to see. The vulnerability is accessible over the network and requires valid credentials to exploit. Public details about this vulnerability are available, increasing the risk of opportunistic attacks against unpatched installations.

• CVE-2026-15377MEDIUM 4.3

  Eleveo Call Recording Software version 9.7.0 contains an authorization bypass vulnerability affecting the /callrec/sendlogfile endpoint. An authenticated user can exploit this flaw to access information they shouldn't be able to read, though they cannot modify or delete data. The vulnerability has been publicly disclosed, and exploit code is available. The vendor has not responded to early disclosure attempts.

• CVE-2026-1606MEDIUM 4.3

  GitLab has patched a vulnerability affecting its Community Edition and Enterprise Edition that allowed authenticated users to hide content within Snippets through improper input validation. An attacker with valid GitLab credentials could exploit this to conceal code or text in a Snippet, potentially obscuring malicious or sensitive content from other users who view it. The vulnerability requires authentication and carries a CVSS score of 4.3 (MEDIUM severity), indicating moderate risk that warrants timely patching but does not represent an emergency threat.

• CVE-2026-1946MEDIUM 4.3

  The GW AI Website Builder plugin for WordPress has a security flaw that allows low-level user accounts (Subscriber and above) to disconnect the plugin from its GravityWrite integration without authorization. An attacker with basic WordPress access can exploit this via a single AJAX request, disrupting the plugin's functionality and potentially affecting site operations that depend on that integration.

• CVE-2026-20178MEDIUM 4.3

  A vulnerability in Cisco's browser-based Webex App could allow attackers to trick users into visiting malicious websites. The flaw involves inadequate validation of URL parameters, meaning a crafted link sent to a user could redirect them elsewhere if clicked. Cisco has already patched the issue, and users do not need to take action—the fix is applied server-side or through automatic updates.

• CVE-2026-20260MEDIUM 4.3

  A flaw in Splunk SOAR (prior to version 8.5.0) allows an attacker without authentication to insert special control codes into application log files by crafting malicious URLs. If a system administrator later views those logs in a terminal, the codes could cause unexpected behavior—such as hiding text, changing colors, or executing terminal commands. This is a log injection vulnerability that bridges the gap between the attacker's network access and a human's interactive terminal session.

• CVE-2026-20265MEDIUM 4.3

  Splunk AI Toolkit versions before 5.7.4 contain a flaw that allows low-privileged users—those without admin or power roles—to redirect the toolkit's outbound requests to attacker-controlled servers over unencrypted HTTP. This happens because the toolkit fails to properly validate which external domains it communicates with, creating a path for sensitive data to be stolen. An attacker with knowledge of a target organization's Splunk deployment could exploit this without needing elevated privileges.

• CVE-2026-24618MEDIUM 4.3

  CVE-2026-24618 is a medium-severity information disclosure vulnerability affecting HashThemes Hash Elements plugin versions up to 1.5.4. An authenticated attacker can retrieve sensitive system information that should remain hidden from unauthorized users. The vulnerability requires valid user credentials to exploit, limiting its attack surface, but the exposure of system details could facilitate further attacks or reconnaissance.

• CVE-2026-2470MEDIUM 4.3

  The Pagelayer WordPress page builder plugin contains an authorization flaw that allows contributors and above to secretly configure contact form email templates by exploiting a mismatch between how the plugin saves settings and how it uses them. A low-level authenticated user can inject malicious form templates via the plugin's settings API, then those templates get processed by the public-facing contact form endpoint without checking who set them up or whether the post is actually published. This enables attackers to manipulate how contact form emails are sent, which becomes especially dangerous if chained with other vulnerabilities.

• CVE-2026-24756MEDIUM 4.3

  Kiteworks, a platform for secure data sharing and management, contains a flaw that allows authenticated users to modify data belonging to other users. The vulnerability stems from the application failing to properly verify that a user should have access to resources they're attempting to change. An attacker with valid credentials could exploit this to alter forms, templates, or other shared resources without authorization. The fix requires upgrading to version 9.3.0 or later.

• CVE-2026-25714MEDIUM 4.3

  Gitea, a self-hosted Git service, has a vulnerability in how it filters access tokens for organization-related API calls. Even though Gitea released a fix for a previous token-leakage issue (CVE-2025-68941), this new vulnerability reveals that the fix was incomplete. An authenticated user can still see tokens they shouldn't have access to through the organization API, potentially exposing sensitive authentication credentials.

• CVE-2026-27761MEDIUM 4.3

  Gitea, a self-hosted Git platform, contains a flaw in how it validates API permissions on feed endpoints. Specifically, the RSS and Atom feed features for repositories do not properly enforce token scope restrictions. This means a token that lacks permission to access a private repository can still retrieve sensitive commit information by accessing the feed endpoints directly. The issue affects Gitea versions up to 1.26.2.

• CVE-2026-27783MEDIUM 4.3

  Gitea, a self-hosted Git service, has a flaw in how it validates permissions on its issue-template API endpoints. An authenticated user who should not have access to a repository's issue templates can retrieve or view them because the API does not properly check repository-level permissions. This is a read-only exposure—the attacker cannot modify templates or perform destructive actions—but sensitive template configurations could be disclosed to unauthorized users.

• CVE-2026-27956MEDIUM 4.3

  Coolify, an open-source platform for managing servers and applications, contains a flaw that allows any authenticated user to discover domain names of applications controlled by other teams. When a specific optional parameter is added to a particular API call, the system fails to properly restrict access based on team membership, exposing this sensitive infrastructure information. The vulnerability affects versions before 4.0.0-beta.464 and is considered moderate in severity.

• CVE-2026-28511MEDIUM 4.3

  eLabFTW, an open-source electronic lab notebook platform, contains an information disclosure vulnerability affecting versions before 5.4.2. When an authenticated user performs a numeric search or reference lookup, the system may return resource titles that the user should not have access to view. The actual content of those resources remains protected—only the titles are exposed. This is particularly concerning because titles may contain sensitive information such as project names, patient identifiers, or regulated data that could constitute unauthorized disclosure.

• CVE-2026-32250MEDIUM 4.3

  NamelessMC, a website platform used for Minecraft server management, contains a reflected cross-site scripting (XSS) vulnerability in version 2.2.4. The flaw exists in how the application handles the `id` parameter on the user queries endpoint. An attacker can embed malicious JavaScript in a specially crafted URL; when a user clicks that link, the script runs in their browser with access to the site's session and data. This could enable attackers to steal session cookies, redirect users to phishing pages, or modify page content to deceive users.

• CVE-2026-32906MEDIUM 4.3

  OpenClaw versions prior to 2026.5.12 contain a privilege escalation flaw in their Slack plugin approval system. Users who hold limited exec approval permissions can manipulate the approval workflow to bypass intended authorization checks, allowing them to approve plugin actions that should require additional oversight or operator configuration. The vulnerability requires an authenticated user to exploit, reducing but not eliminating risk in environments with permissive access controls.

• CVE-2026-33799MEDIUM 4.3

  Juniper Networks Junos OS and Junos OS Evolved contain a memory management flaw in their SNMP daemon that can be triggered by authenticated attackers. By sending specially crafted SNMPv3 queries, an attacker can cause the snmpd process to leak memory. Over time, repeated exploitation exhausts available memory, forcing the process to crash and restart. This disrupts SNMP-based system monitoring until the process recovers. The vulnerability requires network access and valid SNMP credentials to exploit.

• CVE-2026-34170MEDIUM 4.3

  Coolify, a self-hosted deployment and infrastructure management platform, contains a server-side request forgery (SSRF) vulnerability in its GitHub App integration. When an authenticated user configures a GitHub App source, Coolify fails to validate the api_url parameter, allowing that URL to point to internal services or cloud metadata endpoints instead of GitHub. An attacker with legitimate access to Coolify can exploit this to probe internal networks, access cloud provider metadata, or interact with services that should remain isolated from external requests. The vulnerability is limited to authenticated users and does not provide write capabilities, but the information disclosure risk warrants prompt patching.

• CVE-2026-34193MEDIUM 4.3

  CVE-2026-34193 describes a logic error in GPU memory address translation that allows a compromised kernel running inside a virtual machine to send malformed commands to the GPU firmware, causing it to write data to unintended locations in firmware memory. The vulnerability requires local access and an already-compromised kernel to exploit, but once triggered, it can corrupt GPU firmware state without authorization.

• CVE-2026-3433MEDIUM 4.3

  Mattermost's websocket service inadvertently broadcasts permission change notifications to all authenticated users, including guest-level accounts, even when those users lack membership in the affected team or channel. An attacker with guest credentials can observe role and permission updates for private teams they should have no visibility into, revealing information about organizational access controls. This is a confidentiality issue requiring authentication to exploit but affecting teams that rely on Mattermost's role-based access controls to maintain information barriers between guest and member populations.

• CVE-2026-34912MEDIUM 4.3

  Revive Adserver contains a flaw that allows users with basic system access to improperly link advertising banners or campaigns to advertising zones they don't own. Specifically, a low-privileged user can modify zone-include.php or use the API to associate their zones with banners or campaigns managed by other user accounts on the same server. This breaks the expected ownership model, potentially allowing unauthorized modification of advertising relationships across accounts. The vendor has added validation logic to prevent this cross-account linking.

• CVE-2026-34913MEDIUM 4.3

  Revive Adserver versions 6.0.6 and earlier contain a flaw that allows account users with limited permissions to improperly link tracking tools to advertising campaigns they do not own. The vulnerability stems from inadequate permission checks in the campaign-trackers.php file. An attacker with basic user credentials could reassign trackers across different advertiser accounts, creating ownership confusion and potentially manipulating reporting or tracking data. Patched versions validate that campaigns can only be associated with trackers belonging to the same advertiser, restoring proper access boundaries.

• CVE-2026-34917MEDIUM 4.3

  A vulnerability in how session identifiers are managed allows attackers with low-privilege access to the web admin console to reuse their session tokens to authenticate against the XML-RPC API, which normally requires full admin permissions. By exploiting this session confusion, an attacker could gain unauthorized API access and potentially chain this into further exploitation. The fix involves tracking the session context (whether a session originated from the web interface or API) to prevent tokens from being valid across different authentication boundaries.

• CVE-2026-35162MEDIUM 4.3

  Dell PowerFlex Manager versions before 5.1.0.1 have an access control flaw that allows low-privilege remote users to trigger denial-of-service conditions. While the attacker needs valid credentials, the barrier to exploitation is relatively low, and the impact centers on service availability rather than data compromise.

• CVE-2026-36602MEDIUM 4.3

  A Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909 has a flaw in its UPnP service that exposes internal kernel memory addresses to anyone on the same network segment. An attacker can query the router's UPnP interface to extract a raw MIPS kernel pointer, effectively creating a roadmap of how the router's operating system is laid out in memory. While this doesn't directly compromise the device, it removes a significant barrier to follow-up attacks by revealing memory layout details that are normally hidden.

• CVE-2026-36613MEDIUM 4.3

  Mercusys AC12G (EU) V1 routers running firmware AC12G(EU)_V1_200909 leak sensitive internal memory to unauthenticated attackers on the same network. When an attacker sends HTTP POST requests to non-existent paths on the router's web interface, the device inadvertently returns 128 bytes of uninitialized buffer memory. This exposed data may contain router state information, configuration details, or other sensitive runtime values. The vulnerability requires physical or network adjacency—an attacker must be on the same local network segment—but no authentication or user interaction is needed to trigger it.

• CVE-2026-36615MEDIUM 4.3

  The Mercusys AC12G (EU) router running firmware version AC12G(EU)_V1_200909 contains an unauthenticated information disclosure vulnerability. An attacker on the same local network can access a hidden endpoint (/agileconfigreset) that leaks internal buffer contents without requiring any credentials or user interaction. This information could be used to further compromise the device or the network it serves.

• CVE-2026-36618MEDIUM 4.3

  The Mercusys AC12G (EU) router with firmware version AC12G(EU)_V1_200909 has a configuration issue that allows anyone on the local network to discover which version of the DNS resolver software (unbound 1.22.0) is running on the device. An attacker can query the router for this information and use it to identify known vulnerabilities affecting that specific DNS software version, making targeted attacks easier. This is a local network exposure only—an attacker would need network access to the router or its subnet to exploit it.

• CVE-2026-4058MEDIUM 4.3

  A WordPress plugin used for user management and registration has a security gap that allows any logged-in user with basic Subscriber permissions to cancel subscription plans belonging to other users—including site administrators. This missing permission check means a low-privilege attacker could disrupt subscriptions, affect billing relationships, and potentially lock administrators out of paid features. The vulnerability exists in all versions up to 4.3.2.

• CVE-2026-4071MEDIUM 4.3

  The BirdSeed WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to change the plugin's authentication token without the site administrator's knowledge. An attacker can craft a malicious link or webpage that, when clicked by an admin, silently modifies the BirdSeed token stored in the site's database. This breaks the trust chain between your WordPress site and the BirdSeed service. The vulnerability affects all versions up to and including 2.2.0 and requires social engineering—tricking an administrator into clicking a link—but no authentication or special privileges are needed from the attacker's side.

• CVE-2026-40914MEDIUM 4.3

  Apache Artemis has a flaw in how it enforces permissions when users communicate via the STOMP protocol. A user with permission to send or receive messages on a particular address can trick the system into accepting messages with a message routing-type that the address doesn't normally support. This bypasses an important security boundary: only administrators with explicit createAddress permission should be able to change an address's routing-type capabilities. An attacker could exploit this to send or consume messages in ways that violate the intended security policy, even though their basic send/consume permissions are legitimate.

• CVE-2026-41014MEDIUM 4.3

  Apache Airflow contains an authorization bypass in its UI that allows authenticated users to view information about data pipeline runs (DAGs) they shouldn't have access to. Specifically, a user with broad asset-level read permissions can see partition run states, scheduling details, and data connections for DAGs restricted to other teams or users. This affects only deployments that intentionally segment DAG access by user or role while granting wider asset visibility. The vulnerability requires an existing user account and network access to the Airflow UI or API.

• CVE-2026-41115MEDIUM 4.3

  Apache Kafka contains an authorization mismatch in its consumer group metadata API. The CONSUMER_GROUP_DESCRIBE operation checks for DESCRIBE permission on groups, but Kafka's documentation and the relevant design specification (KIP-848) incorrectly state it should check for READ permission. This inconsistency between code behavior and documentation can lead to misconfigured access controls—either granting unintended READ access to users who only have DESCRIBE permissions, or blocking legitimate access for users who rely on documentation-based ACL configurations. The vulnerability is not a code flaw but a documentation gap that can cause real-world security postures to diverge from intent.

• CVE-2026-41123MEDIUM 4.3

  Dell PowerProtect Data Domain contains a flaw in its role-based access control (RBAC) system that allows a low-privileged remote user to modify or tamper with information they shouldn't be able to access. While an attacker cannot read sensitive data or disrupt service availability through this vulnerability, the ability to alter information represents a meaningful integrity risk—particularly critical for a backup and data protection appliance where data trustworthiness is paramount.

• CVE-2026-41160MEDIUM 4.3

  EspoCRM contains a logic flaw that allows lower-privileged users to pin notes they don't have permission to edit. The vulnerability stems from a timing issue in the API backend: the system modifies the note in the database before checking whether the user is actually authorized to do so. Even though the server returns an error message afterward, the damage is already done—the note remains pinned. This affects EspoCRM versions before 9.3.5.

• CVE-2026-41983MEDIUM 4.3

  A denial-of-service vulnerability exists in a browser kernel component that can be triggered through user interaction. An attacker can craft malicious content that, when encountered by a user, causes the browser to become unresponsive or crash. The vulnerability requires user action (clicking a link, viewing a page) and does not allow attackers to steal data or modify system content—only to disrupt availability.

• CVE-2026-42005MEDIUM 4.3

  CVE-2026-42005 is a denial-of-service vulnerability affecting an internal web server component. An attacker with valid credentials can send a specially crafted web request that triggers unbounded memory allocation, exhausting system memory and causing service interruption. The risk is naturally contained by the fact that this internal web server is disabled by default in most deployments, meaning organizations must have explicitly enabled it to be vulnerable.

• CVE-2026-42540MEDIUM 4.3

  IRIS is a collaborative web platform used by incident response teams to share and document technical details during security investigations. A vulnerability in versions before 2.4.28 allows authenticated users to modify database records through specially crafted API requests, potentially corrupting or altering incident investigation data. The issue requires valid login credentials to exploit and affects data integrity rather than confidentiality.

• CVE-2026-42543MEDIUM 4.3

  IRIS, a web-based platform used by incident responders to collaborate and share technical details during investigations, contains a cross-site request forgery (CSRF) vulnerability in versions prior to 2.4.28. The vulnerability exists because the platform uses HTTP GET requests to perform state-changing actions on the server—a design flaw that allows an attacker to trick authenticated users into unknowingly executing unwanted actions. An attacker could craft a malicious link or webpage that, when visited by an IRIS user, silently modifies data or settings without the user's knowledge or consent.

• CVE-2026-42568MEDIUM 4.3

  Yamcs, a mission control framework used in aerospace and satellite operations, contains a flaw in how it validates user login attempts against LDAP directories. An authenticated user can inject specially crafted characters into their username to bypass normal search restrictions, potentially gaining unauthorized access to directory information. The vulnerability requires valid credentials to exploit, limiting immediate risk, but organizations relying on LDAP-backed Yamcs deployments should update promptly.

• CVE-2026-4298MEDIUM 4.3

  The DSGVO All in one for WP WordPress plugin contains an authorization flaw that allows any authenticated user with Subscriber-level access or higher to reset critical privacy policy settings. An attacker could silently revert your organization's customized cookie notices, Google Analytics consent language, and social media policies back to defaults—potentially disrupting privacy compliance and user trust without requiring administrative credentials or special permissions.

• CVE-2026-43708MEDIUM 4.3

  A cross-origin data exfiltration vulnerability in Apple's WebKit rendering engine affects Safari and multiple Apple operating systems. A malicious website can extract user data that should remain isolated to the user's own origin, bypassing the browser's same-origin policy. Apple has patched this issue across Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS with improved input validation to enforce proper origin boundaries.

• CVE-2026-44041MEDIUM 4.3

  UltraVNC versions through 1.8.2.2 contain a flaw in how the software processes text encoding conversion. When converting wide-character strings to multibyte format, the code reads from a caller-supplied buffer without first checking its bounds. If that buffer is missing a proper null terminator, the read operation continues beyond the buffer's legitimate memory, exposing data from adjacent memory regions or potentially crashing the application. This vulnerability requires an unusual programming pattern to trigger and is not currently known to be actively exploited.

• CVE-2026-44169MEDIUM 4.3

  MariaDB's access control for stored routines has a flaw that leaks routine definitions to users who shouldn't see them. If a user receives EXECUTE permission on a stored routine through a database role, they can view the routine's source code without having explicit SHOW CREATE ROUTINE privilege. This bypasses the intended separation between execution rights and visibility rights, allowing unauthorized code inspection. The issue affects MariaDB 11.4, 11.8, and 12.3 releases across a specific version range and has been patched.

• CVE-2026-44731MEDIUM 4.3

  OpenProject's meetings filter feature contains a user enumeration vulnerability that allows attackers with login credentials to discover which user accounts exist in the system and learn their full names. By testing different user IDs and analyzing how the application responds, an attacker can build a complete roster of valid accounts—information that's typically kept private. The vulnerability affects OpenProject versions before 17.3.2 and 17.4.0.

• CVE-2026-44732MEDIUM 4.3

  OpenProject, an open-source project management platform, contains an authorization bypass vulnerability in its document management functionality. An authenticated user can modify or move documents belonging to other projects even if they lack the necessary permissions, by exploiting a timing issue where attribute changes are applied before access controls are checked. The flaw affects versions prior to 17.3.2 and 17.4.0.

• CVE-2026-44750MEDIUM 4.3

  SAP MDG's Review Match Groups Application fails to enforce proper authorization checks for logged-in users. This means a user with basic system access can perform actions they shouldn't be able to, effectively gaining privileges beyond their intended role. The vulnerability is localized to data integrity risks—attackers cannot access confidential information or disrupt system availability, but they can modify data they're not authorized to change.

• CVE-2026-44755MEDIUM 4.3

  SAP Business Objects Business Intelligence Platform contains a vulnerability that allows authenticated users to send spoofed emails by manipulating email parameters that the system fails to properly validate. An attacker with legitimate access to the platform could craft emails that appear to come from different senders, potentially damaging organizational trust or enabling social engineering attacks. The vulnerability is limited to integrity concerns—system confidentiality and availability are not compromised.

• CVE-2026-44779MEDIUM 4.3

  Discourse, a popular open-source discussion platform, contains a flaw in bot debug endpoints that unintentionally exposes sensitive whisper translation audit logs. Whispers are private messages intended only for specific users or moderators, and their translation records should not be accessible. Authenticated users can access these debug endpoints and retrieve information about whisper translations that they shouldn't see, potentially revealing private conversations and moderation activities. The vulnerability affects multiple active release branches and has been patched.

• CVE-2026-44780MEDIUM 4.3

  Discourse has a privilege-bypass vulnerability where category moderators can read the full source of emails submitted to the platform, even if they lack explicit permission to view raw email content. When posts arrive via incoming email integration, a serialization component unintentionally exposes complete email headers, metadata, and body to anyone reviewing flagged posts—sidestepping the normal access controls that restrict raw email viewing. This leaks potentially sensitive information embedded in inbound emails to a wider set of moderators than intended.

• CVE-2026-44782MEDIUM 4.3

  Discourse, an open-source discussion platform, contains a logic error in how it handles user name visibility settings. Due to a misnamed predicate in the GroupPostSerializer component, user names are always included in API responses regardless of the site administrator's configuration to disable them. An authenticated user can exploit this to retrieve user name information that should be hidden, even when the 'enable_names' setting is turned off. The issue affects multiple version branches and has been patched.

• CVE-2026-44785MEDIUM 4.3

  Discourse, an open-source discussion platform, contains an authorization flaw in its AI-powered "explain" feature. When a user asks the system to explain a reply to a post, the feature only checks whether the user can see the reply itself—not whether they should have access to the parent post being discussed. This oversight allows any authenticated user with access to the AI helper to read hidden or restricted parent posts by simply requesting an explanation of a public reply to them. The vulnerability affects multiple version branches and has been patched.

• CVE-2026-44957MEDIUM 4.3

  Revive Adserver versions 6.0.6 and earlier contain a flaw in their XML-RPC API that fails to properly verify user permissions when reassigning entities to different parent entities. An attacker with low-level API access cannot exploit this vulnerability alone; they would need either a separate critical vulnerability (CVE-2026-34917) or a custom third-party extension to reach the vulnerable code. When those conditions align, an attacker could reassign entities without authorization, creating inconsistent ownership relationships that may allow lateral privilege expansion or data manipulation.

• CVE-2026-45264MEDIUM 4.3

  Nextcloud versions spanning 17.0.0 through 21.0.3 contain a permission bypass vulnerability that allows users with read and create access—but explicitly not update access—to rename files within team folders. This unintended capability undermines the granular permission model Nextcloud enforces, potentially enabling unauthorized modification of file metadata and organizational disruption. The issue affects a broad version range and has been patched across all active release lines.

• CVE-2026-45286MEDIUM 4.3

  An authenticated user on a Nextcloud instance can discover other users' identities by abusing the Calendar app's attendee-suggestion feature. The vulnerability exists because this endpoint bypasses the access controls that Nextcloud applies elsewhere. An attacker already logged into the system can systematically enumerate valid usernames, potentially laying groundwork for targeted attacks like password spraying or social engineering. The flaw affects Nextcloud versions 5.5.13 through 5.5.16 and 6.2.0 through 6.2.2.

• CVE-2026-45544MEDIUM 4.3

  Nextcloud Tables, a collaborative document and data management component, contains an information disclosure vulnerability affecting versions 0.8.0 through 1.0.3. The issue allows users with read-only access to view filter criteria—potentially including sensitive column names, field definitions, or search logic—that should have been restricted to higher-privilege users. This represents a low-severity data exposure that could leak operational details about table structure and content filtering strategies. The vulnerability has been resolved in Nextcloud Tables versions 1.0.4 and 2.0.0.

• CVE-2026-45563MEDIUM 4.3

  Roxy-WI, a popular web management interface for load balancers and web servers, contains a flaw that allows any logged-in user to view detailed audit trails of other users' administrative actions. Even a guest-level user in one department can see which servers another user has accessed, what configuration changes they deployed, and what services they restarted. The vulnerability affects Roxy-WI versions 8.2.6.4 and earlier. While this doesn't grant direct control over infrastructure, it exposes sensitive operational history that should remain confidential.

• CVE-2026-45650MEDIUM 4.3

  CVE-2026-45650 is a user interface spoofing vulnerability in Microsoft Bing that allows attackers to misrepresent critical information to users over the network. An attacker can craft a malicious link or interaction that tricks Bing's UI into displaying false or misleading content, potentially leading users to believe they are viewing legitimate search results, advertisements, or information when they are not. This requires user interaction to succeed, meaning a victim must click a link or engage with the spoofed element.

• CVE-2026-45729MEDIUM 4.3

  ThorVG, a vector graphics rendering engine, contains a flaw that can crash applications using it when they process malicious SVG files. An attacker can craft a specially formatted SVG document as small as 6 bytes that triggers an application crash when the affected code path is invoked. This is a denial-of-service vulnerability affecting availability but not data confidentiality or integrity. The issue was introduced in earlier versions and is resolved in ThorVG 1.0.5.

• CVE-2026-45776MEDIUM 4.3

  OpenXDMoD is an open-source framework used by HPC (high-performance computing) centers to collect and monitor system performance metrics. Versions before 11.0.3 contain a session-handling flaw that allows an authenticated attacker to manipulate authorization checks. If an installation includes the optional Job Performance (SUPReMM) module, an attacker could view other users' job efficiency data they shouldn't have access to. The vulnerability requires an existing login but does not require admin privileges.

• CVE-2026-46542MEDIUM 4.3

  Nimiq, a Rust-based blockchain implementation, contains a vulnerability in how it validates cryptographic keys used for multisig (multi-signature) operations. When the system processes Ed25519 public keys, it only checks that the key is 32 bytes long—the correct size—but doesn't verify that those bytes actually represent a valid point on the Ed25519 elliptic curve. An attacker can send a specially crafted, mathematically invalid public key that passes the length check. When the Nimiq node attempts to process this malformed key during multisig delinearization, the code crashes due to an uncaught exception, causing a denial-of-service condition. This affects Nimiq versions before 1.4.0.

• CVE-2026-46548MEDIUM 4.3

  NocoDB, a database-as-spreadsheet platform, contains a server-side request forgery (SSRF) vulnerability in its webhook notification system. An authenticated user with permissions to create webhooks can craft malicious requests to the Slack, Discord, Mattermost, or Teams webhook plugins that bypass intended network protections, allowing them to reach internal hosts that should be off-limits. The flaw stems from improper configuration of HTTP agent settings in four webhook integrations. This issue is resolved in version 2026.04.1 and later.

• CVE-2026-46605MEDIUM 4.3

  Apache ActiveMQ has an authorization flaw that allows authenticated users to delete message queues and topics they shouldn't be able to modify. An attacker with valid credentials to your messaging system could disrupt operations by removing critical destinations, even if permission controls suggest they shouldn't have that ability. This affects ActiveMQ versions before 5.19.7 and 6.0.0 through 6.2.5.

• CVE-2026-46645MEDIUM 4.3

  SQLAdmin, a popular admin interface library for SQLAlchemy, contains an access control bypass vulnerability in its ajax_lookup feature. When developers restrict access to certain database models using the library's access control mechanism, authenticated users can circumvent those restrictions by sending requests directly to the ajax_lookup endpoint. This allows them to retrieve data from models they shouldn't have permission to access. The vulnerability was fixed in version 0.25.1.

• CVE-2026-46700MEDIUM 4.3

  Actual, a personal finance management tool, contains an access control flaw in its sync-server component prior to version 26.6.0. The GET endpoint used to retrieve secrets—such as bank integration credentials—only checks that a user has a valid session, but does not verify admin privileges. This means any authenticated non-admin user in OpenID-enabled multi-user deployments can query the secrets store and discover which external banking services (SimpleFin, Pluggy, GoCardless) have been configured by administrators, potentially exposing the names and availability of sensitive integrations. The flaw is limited to information disclosure; attackers cannot modify or delete secrets directly through this endpoint.

• CVE-2026-46747MEDIUM 4.3

  SINEC INS, Siemens' network security appliance, contains a path traversal vulnerability in its file upload API endpoint. An authenticated user can craft malicious directory paths to access files outside their intended scope on the server. The vulnerability affects all versions prior to V1.0 SP2 Update 6 and requires valid login credentials to exploit, limiting but not eliminating risk in environments where account compromise or insider threats are concerns.

• CVE-2026-46764MEDIUM 4.3

  Apache Airflow contains an authorization bypass flaw in its audit-log API endpoints. An authenticated user with read access to audit logs for one workflow (Dag) can bypass per-Dag scoping restrictions and view audit-log entries from any other Dag in the same Airflow deployment by directly requesting specific event log IDs. The vulnerability stems from inconsistent permission enforcement: the collection endpoint properly restricts results by Dag, but the detail endpoint applies only a generic audit-log permission check without verifying the requester has access to the specific Dag whose logs are being retrieved. This allows low-privileged users to enumerate and read sensitive audit trails across Dags they should not be able to access.

• CVE-2026-47224MEDIUM 4.3

  NanaZip, a Windows-native fork of the popular 7-Zip archiver, contains a memory safety flaw in how it processes LVM (Logical Volume Manager) disk images. When a user opens a specially crafted LVM disk image file, the application can read beyond the boundaries of allocated memory. This weakness could cause NanaZip to crash or, in theory, leak sensitive data from memory. The issue affects NanaZip versions 3.0.1000.0 through 6.0.1697.0. Users should upgrade to version 6.0.1698.0 or later to resolve the issue.

• CVE-2026-47236MEDIUM 4.3

  Solidtime, an open-source time-tracking application, contains an authorization bypass vulnerability in its team management interface. Prior to version 0.12.2, the web page that displays team members and pending invitations fails to properly enforce permission checks, allowing any employee in the organization to view sensitive information—including pending invitation email addresses and member lists—even though the same data is correctly restricted in the official API. The vulnerability stems from incomplete permission validation in the Jetstream page handler, which checks only basic team membership rather than the required invitations:view and members:view permissions.

• CVE-2026-47263MEDIUM 4.3

  Discourse versions released between early 2026 and mid-2026 contain an access control flaw in their webhook event redelivery system. When Discourse attempts to resend failed webhook notifications, it broadcasts internal event data to a world-readable channel without properly restricting who can see it. Any logged-in user—or any visitor on instances without login requirements—can discover and read webhook events by guessing sequential webhook IDs. This exposes sensitive data that webhook endpoints are designed to receive privately, such as user activity, content moderation events, or custom application logic tied to your Discourse instance.

• CVE-2026-47675MEDIUM 4.3

  Hono, a JavaScript web framework, contains a flaw in how it sanitizes cookie options. While the framework validates certain cookie parameters (domain and path) to prevent malicious characters from breaking the Set-Cookie header, it fails to apply the same checks to sameSite and priority options. If an application passes user-controlled input directly into these parameters, an attacker could inject additional cookie attributes into the response header, potentially manipulating cookie behavior or setting unintended security policies.

• CVE-2026-47696MEDIUM 4.3

  WWBN AVideo, an open-source video hosting platform, contains a payment processing vulnerability in versions 29.0 and earlier. When both the AuthorizeNet and YPTWallet plugins are active, any logged-in user can artificially inflate their account wallet balance without actually paying. The vulnerable endpoint accepts a user-supplied amount parameter and immediately credits the wallet without verifying that a real payment transaction occurred through Authorize.Net. This is a financial manipulation flaw that bypasses payment authentication entirely.

• CVE-2026-47991MEDIUM 4.3

  Adobe Experience Manager contains a flaw that allows attackers to craft deceptive URLs that redirect users to attacker-controlled websites. If a victim clicks such a link, they may be taken to a fake login page or other malicious site where their credentials could be stolen, leading to account compromise. This vulnerability affects multiple AEM versions and requires user interaction—the attacker must convince someone to click the malicious link.

• CVE-2026-48092MEDIUM 4.3

  7-Zip versions 9.34 through 26.00 contain a flaw in how they process SquashFS archive files that can leak sensitive data from memory when extracting files. The vulnerability exists only in 32-bit builds of 7-Zip and requires an attacker to craft a malicious archive with specially modified metadata. When a user extracts such an archive, heap memory contents that should remain private are instead written into the extracted file, potentially exposing passwords, encryption keys, or other sensitive information stored in memory. The issue stems from integer arithmetic wrapping that bypasses safety checks. Users on 64-bit systems are not affected.

• CVE-2026-48103MEDIUM 4.3

  7-Zip versions 9.34 through 26.00 contain a memory read vulnerability in the WIM (Windows Imaging Format) archive handler. When processing specially crafted WIM files, the software reads a small amount of data just beyond an allocated memory region due to an off-by-one error in bounds checking. This occurs automatically in the file manager when listing directory contents, requiring only that a user open or preview a malicious WIM file. The practical impact is limited to crashes or potential minor leaks of adjacent memory; no file corruption or system compromise is possible through this flaw alone.

• CVE-2026-48111MEDIUM 4.3

  7-Zip versions 9.21 through 26.00 contain a boundary-checking flaw in their UEFI firmware image parser. When processing certain archive sections, the parser uses an incorrect comparison operator that allows a malicious opcode value to read data beyond an array's bounds. This can either crash the application when the out-of-bounds memory is invalid, or leak small amounts of adjacent string data into the archive's metadata. The flaw is triggered automatically when opening a specially crafted archive file, but the leaked information is limited and does not expose sensitive data or memory layout information.

• CVE-2026-48518MEDIUM 4.3

  MultiJuicer, a platform for running isolated Juice Shop instances on Kubernetes clusters, contains a cross-site request forgery (CSRF) vulnerability in its team join endpoint. Versions 8.0.0 through 10.0.0 accept requests regardless of content type, allowing attackers to craft web pages that silently add victims to attacker-controlled teams. When a victim visits an attacker's page, their browser automatically submits a form to the vulnerable endpoint, enrolling them in the attacker's team without their knowledge. This causes victims to unknowingly solve security challenges under the attacker's identity, inflating scores and exposing any sensitive data entered during exercises. The attack requires no prior authentication and bypasses standard CORS protections and SameSite cookie policies.

• CVE-2026-48789MEDIUM 4.3

  AnythingLLM versions prior to 1.13.0 contain a path traversal vulnerability on Windows systems that allows authenticated users to list and potentially access documents outside the intended documents directory. The vulnerability stems from incomplete validation of Windows-style directory paths. An attacker with valid credentials could craft specially encoded paths to escape the documents folder sandbox and view file listings in other locations on the Windows system.

• CVE-2026-48810MEDIUM 4.3

  FreeScout, a free help desk platform built on Laravel, contains an authorization flaw in version 1.8.220 and earlier. A user with conversation editing permissions who authored a message in one mailbox can edit that message's content even after an administrator removes them from that mailbox. The vulnerability exploits a gap in access controls: the system verifies the user created the message and has the global edit permission, but fails to confirm the user still belongs to the mailbox where the conversation lives. This allows former mailbox members to alter thread history and potentially mislead team members or customers.

• CVE-2026-48811MEDIUM 4.3

  FreeScout, an open-source helpdesk and shared inbox platform, contains a flaw that allows former team members to permanently delete internal notes—even after their access to the mailbox has been revoked. A non-admin user who previously created private threads in a conversation can return and destroy those notes without authorization, because the system fails to verify whether the user still belongs to the mailbox. This affects FreeScout versions before 1.8.221.

• CVE-2026-4888MEDIUM 4.3

  Everest Forms, a popular WordPress form-building plugin, contains a security flaw that allows low-privilege logged-in users to send emails from your website to anyone they choose. Any user with Subscriber access or higher can exploit this by calling an internal email-testing function without proper permission checks. This doesn't require clicking malicious links or advanced technical skills—just authenticated access to your WordPress admin panel.

• CVE-2026-48891MEDIUM 4.3

  Apache Airflow contains an information disclosure vulnerability in its web UI's dependency graph viewer. Authenticated users with permission to read certain workflows can inadvertently discover the names and identifiers of other workflows they should not have access to by examining trigger and sensor dependency relationships displayed in the graph. This happens because the filtering logic that restricts which workflows a user can see was incompletely applied—it hides the top-level workflow information but still leaks workflow identifiers in the detailed dependency connections. Organizations relying on workflow-level access controls to keep workflow names confidential across teams are at risk.

• CVE-2026-48934MEDIUM 4.3

  Node.js contains a flaw in how it validates TLS certificates during secure connections. An authenticated attacker could potentially bypass certificate verification, allowing them to intercept or impersonate HTTPS traffic in environments where they have network or application access. This is not a remote unauthenticated attack—it requires the attacker to already have some level of access to the system or network.

• CVE-2026-49140MEDIUM 4.3

  Nanobot versions before 0.2.1 have a denial-of-service flaw in how they handle media downloads from Matrix chat rooms. An authenticated user in a room can deliberately send specially crafted media events with missing or wrong size information, causing the system to download large files without properly checking their declared sizes first. By sending many of these malicious requests at once, an attacker can force the Nanobot process to consume excessive memory and bandwidth until the service becomes slow or unresponsive. The attacker must already be a member of the room to exploit this.

• CVE-2026-49288MEDIUM 4.3

  Statamic, a Laravel-based content management system, contained an authorization flaw that allowed authenticated users with Control Panel access to view content and metadata they weren't supposed to see. An attacker with valid login credentials could browse restricted entries, assets, user profiles, roles, and groups—exposing titles, custom field values, entry content, asset metadata, and the mere existence of sensitive organizational structures. The vulnerability is read-only; attackers could not modify data. Fixed in Statamic 5.73.23 and 6.20.0.

• CVE-2026-49322MEDIUM 4.3

  The 2025 Indian Motorcycle Scout Bobber + Tech model contains a flaw in its wireless control system that allows someone with access to the motorcycle's internal network to steal the owner's PIN unlock code by observing just a single authentication attempt. Instead of using proper cryptographic security, the system performs simple mathematical operations that can be reversed to recover the PIN, completely bypassing the bike's primary security lock.

• CVE-2026-49323MEDIUM 4.3

  The 2025 Indian Motorcycle Scout Bobber + Tech model contains a flaw in how its wireless control module authenticates with the engine control module. An attacker positioned on the vehicle's internal network can intercept a single authentication exchange and reverse-engineer the motorcycle's immobilizer secret—the cryptographic key that prevents unauthorized engine starts. Once recovered, the attacker can bypass the immobilizer entirely and start the engine without the key fob.

• CVE-2026-49337MEDIUM 4.3

  libde265, an open-source H.265 video decoder library, contains a memory management flaw that allows attackers to trigger unbounded memory growth on a victim's system. By sending a specially crafted sequence of video data packets, an attacker can cause the decoder to accumulate slice header data in memory without ever releasing it. This happens during normal video playback and can eventually exhaust available memory (denial of service). The vulnerability requires user interaction—someone must open or play a malicious video file—but does not require any special privileges or network access beyond the ability to deliver the crafted video.

• CVE-2026-49355MEDIUM 4.3

  OpenProject versions before 17.4.0 contain an information disclosure vulnerability in the meeting agenda API endpoint. An authenticated attacker can view private work package details that are linked to meeting agenda items, even when those work packages belong to projects the attacker cannot normally access. This leaks sensitive project information to users who should not have visibility into it.

• CVE-2026-49369MEDIUM 4.3

  JetBrains YouTrack versions before 2026.1.13162 contained a flaw that allowed authenticated users to access sensitive information about other users and groups they shouldn't be able to see. The vulnerability is limited to the Users and Groups administrative pages and requires valid login credentials to exploit. This is a straightforward authorization issue where the application failed to properly restrict who could view certain user and group data.

• CVE-2026-49377MEDIUM 4.3

  JetBrains TeamCity contains a configuration flaw where default agent parameters inadvertently expose sensitive data to authenticated users. An attacker with valid login credentials can access information through TeamCity's agent configuration that should remain restricted. This is a network-accessible issue affecting TeamCity deployments before version 2025.11.2, though the vulnerability requires prior authentication to exploit.

• CVE-2026-49378MEDIUM 4.3

  JetBrains TeamCity contained a vulnerability where stored credentials could be inadvertently exposed through the parameter autocompletion feature. When users typed in parameter fields, the system would suggest previously stored credential values, potentially revealing sensitive authentication data to anyone with access to the TeamCity interface. This issue affects TeamCity versions prior to 2026.1 and requires an authenticated user to interact with the affected feature. The exposure is limited to local disclosure within the TeamCity environment rather than remote exfiltration.

• CVE-2026-49482MEDIUM 4.3

  ClipBucket v5 has a vulnerability in its subtitle editing feature that allows authenticated users to corrupt subtitle data across multiple videos at once. By sending a specially crafted request with a wildcard character, an attacker with valid credentials can overwrite all subtitle titles for any video they control in a single action. This is a data integrity issue rather than a data exposure risk, and affects versions before 5.5.3 - #141.

• CVE-2026-49848MEDIUM 4.3

  FreeSWITCH versions prior to 1.11.1 contain a flaw in the Verto module's authentication handler that allows user-supplied session variables to be written into connection state before password validation occurs. Because these writes are append-only and failed authentication attempts don't close the WebSocket connection, variables from a bad login attempt persist and carry over into a subsequent successful login on the same connection. This creates a window for session state manipulation through repeated authentication attempts.

• CVE-2026-50569MEDIUM 4.3

  Fission, an open-source Kubernetes serverless framework, contains a validation bypass in its HTTP trigger configuration. Prior to version 1.25.0, two URL-related fields—RelativeURL and Prefix—were not properly validated when HTTPTrigger resources were created directly through kubectl or the Kubernetes REST API. While these fields were validated at the CLI level, the validation logic was absent from the core application and its API server rules. This means an attacker with Kubernetes API access could bypass URL restrictions by creating or modifying HTTPTrigger resources directly, potentially routing traffic to unintended functions or exposing restricted endpoints.

• CVE-2026-50739MEDIUM 4.3

  A flaw in Revive Adserver allows low-privileged users to associate their tracking tools with advertising campaigns owned by other managers on the same server. This happens because a security fix applied to one direction of the linking process was not extended to the reverse operation, creating an inconsistency that attackers can exploit. The vulnerability affects Revive Adserver version 6.0.7 and earlier.

• CVE-2026-50744MEDIUM 4.3

  Revive Adserver 6.0.7 contains a flaw in its XML-RPC authentication system. When an administrator login attempt is made via the ox.login API method, the server returns an error message—as intended—but inadvertently creates a valid session ID and sends it back in the HTTP response headers anyway. An attacker with basic API access can intercept this session ID and use it to bypass the admin-only restriction, gaining unrestricted access to sensitive API functions without needing actual admin credentials.

• CVE-2026-5137MEDIUM 4.3

  The RTMKit plugin for WordPress (used to manage themes for Elementor) has a vulnerability that allows certain WordPress users to load and run unauthorized PHP code on a website. Specifically, a user with Contributor access or higher can manipulate a request to the plugin's template rendering feature to include files they shouldn't be able to access, then execute whatever code is inside those files. This requires an attacker to already have a low-level account on the WordPress site.

• CVE-2026-5138MEDIUM 4.3

  Foreman, Red Hat's infrastructure management platform, contains a flaw that allows authenticated users with basic host-editing permissions to bypass authorization controls and view sensitive network configuration data from other organizations and locations. An attacker could extract subnet layouts, IP address ranges, gateway configurations, DNS server details, and VLAN assignments belonging to infrastructure they should not have access to. The vulnerability requires valid credentials and existing permissions to exploit, limiting its immediate blast radius, but it creates a significant cross-tenant data leakage risk in multi-tenant deployments.