By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 80 of 86

• CVE-2026-52795MEDIUM 4.3

  Gogs, a self-hosted Git service, contains a logic error in its Watch API that allows any authenticated user to monitor private repositories they should not have access to. The vulnerability stems from an inverted access check—the API returns an error when a user CAN read the repository, rather than when they CANNOT. Once a user watches a private repository, their dashboard reveals sensitive information including commit messages, branch names, issue titles, and pull request details. If email notifications are enabled, attackers also receive email digests containing issue and comment content from repositories they should be excluded from.

• CVE-2026-53422MEDIUM 4.3

  A flaw in Erlang OTP's SFTP server module allows authenticated users to discover whether files and directories exist outside their authorized access area. When a user sends a specially crafted request to the server's path-resolution function, the server's response reveals whether a path exists on the system—even if the user shouldn't have permission to see that location. An attacker can use this to map out sensitive filesystem structures, such as identifying the presence of critical files or system directories, without actually reading any contents. This is an information-disclosure issue that requires valid SFTP credentials to exploit.

• CVE-2026-53436MEDIUM 4.3

  Jenkins contains a validation flaw in its login redirect mechanism that allows attackers to craft phishing URLs appearing to come from a legitimate Jenkins instance. When users log in, Jenkins is supposed to redirect them to internal pages, but the vulnerability allows attackers to redirect users to external malicious sites by exploiting how the application handles relative path segments (like `./` or `../`). An attacker would need to trick a user into clicking a specially crafted link, but the exploit itself is straightforward and doesn't require special technical skills.

• CVE-2026-53437MEDIUM 4.3

  Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier) contain a flaw in how they validate redirect URLs after user login. An attacker can craft a malicious redirect URL that appears to point to a legitimate Jenkins instance by inserting tab or newline characters between the `//` protocol separator, causing the validation to pass. When a user clicks such a link after logging in, they may be redirected to an attacker-controlled site while believing they're staying within Jenkins, enabling credential harvesting or other phishing attacks.

• CVE-2026-53438MEDIUM 4.3

  Jenkins versions 2.567 and earlier (or LTS 2.555.2 and earlier) contain a permission bypass flaw that allows authenticated users holding the Item/Cancel permission to cancel build queue items without requiring Item/Read permission. This means an attacker with limited cancellation rights can disrupt builds they shouldn't be able to view or access, effectively using one permission to circumvent another. The vulnerability is not actively exploited in the wild and requires authenticated access, making it a moderate risk in most deployments.

• CVE-2026-53439MEDIUM 4.3

  Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier) contain a permission bypass vulnerability that allows low-privileged attackers to discover sensitive information about other users. Specifically, attackers who have been granted the basic Overall/Read permission can view other users' timezone settings and enumerate the names of views in other users' private "My Views" sections. This is an information disclosure issue that could support reconnaissance or social engineering attacks, though it does not enable direct system compromise.

• CVE-2026-53440MEDIUM 4.3

  Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier) contain a flaw in their "Delegate to servlet container" security realm that fails to validate redirect destinations after user login. An attacker can craft a malicious link that redirects authenticated users to an attacker-controlled website, enabling phishing attacks that steal credentials or distribute malware while appearing to come from a legitimate Jenkins instance.

• CVE-2026-53463MEDIUM 4.3

  ImageMagick, a widely-used open-source image editing library, has a vulnerability in its distort operation that can cause the application to crash when given malformed parameters. The issue stems from improper handling of null pointers—a memory safety problem that occurs before the software attempts to process the distort command. Users who interact with untrusted images or accept image files from external sources face potential denial-of-service risk, though the vulnerability does not compromise data confidentiality or integrity.

• CVE-2026-53634MEDIUM 4.3

  Sharp, a Laravel-based content management framework, contains an authorization bypass affecting its Quick Creation Command feature in versions 9.0.0 through 9.22.2. An authenticated user without permission to create records in a specific entity could still use the Quick Creation feature to view creation forms and submit new records, provided that entity had a Quick Creation Command handler configured. This represents a privilege escalation flaw where the access control layer was not properly enforced on certain endpoints. The vulnerability has been resolved in version 9.22.3.

• CVE-2026-53675MEDIUM 4.3

  BuddyPress 14.4.0 has a flaw in its friends REST API that allows any logged-in user to view another user's complete friend list without permission. The vulnerability exists because the API endpoint checks only that someone is authenticated, not whether they should have access to the specific friend list being requested. An attacker with any user account can enumerate and collect the private social connections of any other user on the platform.

• CVE-2026-53736MEDIUM 4.3

  Easy Twitter Feeds versions before 1.2.13 have a cross-site request forgery (CSRF) vulnerability in their post duplication feature. An attacker can craft a malicious link that, when clicked by a logged-in user, will automatically duplicate posts without the user's knowledge or consent. The vulnerability exists because the plugin fails to validate that duplication requests actually came from the user, making it trivial for attackers to abuse the feature via social engineering or injected links.

• CVE-2026-53739MEDIUM 4.3

  Yoast Duplicate Post, a popular WordPress plugin for content management, contains a cross-site request forgery (CSRF) flaw in versions through 4.6. The vulnerability allows an attacker to craft a malicious webpage or email that, when visited by a logged-in WordPress administrator, automatically suppresses admin notices across the entire network without the admin's knowledge or consent. No special technical skill is required to exploit this—only the ability to trick an admin into clicking a link or visiting a page.

• CVE-2026-53781MEDIUM 4.3

  Summarize, a podcast and media management CLI tool, contains a vulnerability that allows attackers to exhaust a system's disk space. If you use Summarize before version 0.17.0, an attacker who controls a podcast feed or media URL can force the application to download an extremely large (or infinite) file to your disk. The vulnerability exists because Summarize doesn't properly validate file sizes when the server doesn't send proper size headers or uses certain types of data streaming. This can render your system unusable by filling up its storage.

• CVE-2026-53826MEDIUM 4.3

  OpenClaw versions prior to 2026.4.26 inadvertently leak sensitive workspace path information when child AI model sessions are spawned from sandboxed parent environments. An authenticated attacker can trigger this disclosure by creating child sessions, allowing them to discover the real underlying workspace location or related memory context that should remain isolated. The vulnerability requires valid credentials and does not involve network-level attacks or severe data manipulation, but it does undermine the security boundary that sandboxing is designed to maintain.

• CVE-2026-53835MEDIUM 4.3

  OpenClaw versions before 2026.5.6 have a flaw in how they enforce configuration rules for Feishu dynamic-agent bindings. An authenticated user can create or modify these bindings while bypassing the normal access controls that should restrict who can make such changes. This means someone with legitimate credentials could potentially create unauthorized connections between senders and agents that policy should have blocked.

• CVE-2026-53845MEDIUM 4.3

  OpenClaw versions before 2026.5.6 contain a vulnerability that allows authenticated users to bypass security hooks designed to audit and enforce policies on skill command execution. When skill commands are routed through a specific dispatch path, they skip the before-tool-call hooks that normally intercept and validate these operations. An attacker with valid credentials could exploit this to execute commands without triggering audit logs or policy checks.

• CVE-2026-53848MEDIUM 4.3

  OpenClaw before version 2026.5.26 has a security flaw that allows authenticated operators to bypass command allowlist restrictions. An attacker with valid operator credentials can craft specially formed requests that use transparent command wrappers to execute operations that should have been blocked by the allowlist. This affects the integrity of command execution controls but does not expose data or cause system availability issues.

• CVE-2026-53867MEDIUM 4.3

  Capgo versions prior to 12.128.2 do not properly clean up user profile images from storage when those images are replaced or deleted. This means old image files remain accessible on the backend server even after users think they've removed them. An attacker with a user account can leverage previously shared or discovered image URLs to retrieve these orphaned files, potentially accessing private user photos or other sensitive image data that should have been deleted.

• CVE-2026-53900MEDIUM 4.3

  Firefox for iOS was inadvertently preserving cookies from initial PDF requests even when those requests were redirected across different websites. An attacker could craft a malicious site that, when visited by a user, exploits this behavior to inject cookies into legitimate requests sent to an unrelated target domain—potentially allowing credential theft or session hijacking without the user's knowledge. Apple users running Firefox for iOS below version 152.0 are affected. Mozilla has patched this in Firefox for iOS 152.0.

• CVE-2026-53908MEDIUM 4.3

  MCO (MyComplianceOffice) contains a user enumeration vulnerability in its authentication workflows. When users attempt to reset passwords or retrieve usernames, the application responds differently depending on whether an account exists. An attacker with login access can exploit these timing or content differences to systematically discover valid usernames and associated email addresses—useful for follow-up social engineering, credential stuffing, or targeted account takeover attempts. The vendor has not been successfully contacted to confirm scope beyond version 25.3.3.1.

• CVE-2026-54006MEDIUM 4.3

  Open WebUI, a self-hosted AI platform, contains an authorization bypass vulnerability in its calendar event management API. A regular user can create an event in their own calendar and then move it into another user's calendar without proper permission checks. While the initial event creation correctly validates authorization, the move operation skips this validation entirely. This allows any authenticated user to access or modify calendar events belonging to other users by knowing their calendar ID—a common identifier in multi-user deployments.

• CVE-2026-54014MEDIUM 4.3

  Open WebUI, a self-hosted AI platform designed for offline operation, contains a path traversal flaw that allows authenticated users to read files outside the intended cache directory. The vulnerability stems from an incomplete validation check in the file serving logic that fails to properly isolate the cache folder from similarly-named sibling directories. An attacker with valid credentials can exploit directory name confusion to access restricted files. The issue has been patched in version 0.9.6.

• CVE-2026-54016MEDIUM 4.3

  Open WebUI versions before 0.9.6 contain an authorization bypass in the search_knowledge_files function. When a model lacks attached knowledge bases but function calling is enabled, an authenticated user can query file metadata from any knowledge base by guessing or knowing its identifier, even if they should not have access. The vulnerability leaks file names and structural information about private or restricted knowledge bases, but does not allow file content extraction or modification.

• CVE-2026-54259MEDIUM 4.3

  Wagtail, a Django-based content management system, contains an information disclosure vulnerability in its Documents and Images chooser feature. When an administrator or staff member accesses these chooser interfaces, the system incorrectly reveals filenames, names, and URLs of documents and images that the user should not have permission to browse. This happens despite the user lacking explicit 'choose' permissions for those collections. The vulnerability requires an attacker to already have Wagtail admin access—ordinary website visitors cannot exploit it. Torchbox has patched this issue across three supported version branches.

• CVE-2026-54260MEDIUM 4.3

  Wagtail, a Django-based content management system, contains a vulnerability in versions before 7.0.8, 7.3.3, and 7.4.2 that allows authenticated admin users to degrade system performance by uploading or processing images with specially crafted filter specifications. The vulnerability requires admin-level access to the Wagtail backend, so it cannot be exploited by regular website visitors. When triggered, the malicious filter specs force the system to perform expensive image rendition processing operations that consume significant server resources, potentially slowing or disrupting the CMS for all users.

• CVE-2026-54262MEDIUM 4.3

  Wagtail, a Django-based content management system, has a permission bypass vulnerability affecting versions before 7.0.8, 7.3.3, and 7.4.2. Users with the basic "Can submit translation" permission can circumvent access controls to create translations for any page in the system, regardless of whether they have permission to modify that content. This allows unauthorized users to introduce translations into restricted content areas. The vulnerability has been patched in the three specified releases.

• CVE-2026-54686MEDIUM 4.3

  Warp, a terminal-based development environment with AI capabilities, contains a vulnerability in how it processes shell integration commands. Between April 2021 and May 2026, Warp accepted certain terminal state-changing instructions from the PTY stream without confirming they originated from legitimate shell integration. An attacker could exploit this by crafting malicious terminal output that, when viewed by a victim in Warp, tricks the application into accepting false metadata—such as spoofed current working directories or falsified SSH session information. The vulnerability requires user interaction (viewing attacker-controlled terminal content) and has a relatively low severity impact focused on integrity rather than confidentiality or availability. It is resolved in version 0.2026.05.06.15.42.stable_01 and later.

• CVE-2026-54886MEDIUM 4.3

  An authenticated user on an SFTP server powered by Erlang/OTP can send specially crafted network messages that cause the SFTP channel handler to enter an infinite loop. The vulnerable code path is triggered only when the server receives SSH extended data (a message type that should never appear in normal SFTP operations) with specific properties. Once triggered, that channel stops responding and consumes CPU continuously, though the overall server remains operational. An attacker with valid SFTP credentials can open many such channels to degrade performance across the system. No data theft or modification is possible; the impact is purely denial of service.

• CVE-2026-55517MEDIUM 4.3

  Deno, a modern JavaScript/TypeScript runtime, has a flaw in how it processes WebSocket connection responses. When a remote server sends back specially crafted response headers containing non-ASCII bytes, Deno crashes entirely rather than handling the malformed data gracefully. An attacker controlling a WebSocket server could exploit this to deny service to any Deno client that connects to it. The issue affects Deno versions before 2.7.5 and is resolved in that release.

• CVE-2026-55542MEDIUM 4.3

  Snipe-IT, an IT asset and license management platform, contains an authorization bypass in its signature image retrieval feature when deployed with S3 object storage. Authenticated users who can guess or discover a signature filename can obtain a temporary signed S3 URL without proper permission checks. This allows unauthorized access to signature images for 5 minutes. The vulnerability stems from the S3 code path returning a URL before performing the same authorization checks that protect local file storage. Version 8.6.1 addresses this issue.

• CVE-2026-55653MEDIUM 4.3

  A vulnerability exists in OpenSSH where a malicious SSH server can trigger a double-free memory error in the client during Diffie-Hellman Group Exchange (DH-GEX) parameter validation in FIPS mode. When an SSH client connects to a compromised or attacker-controlled server, the server can send specially crafted DH-GEX parameters that cause the client process to crash, resulting in a denial of service. This affects users and automated systems that initiate SSH connections to untrusted or compromised servers.

• CVE-2026-55838MEDIUM 4.3

  RustFS, a distributed storage system written in Rust, contains an authorization bypass in its metrics endpoint. The /rustfs/admin/v3/metrics endpoint fails to enforce admin-level IAM policy checks, allowing any authenticated user—even those with minimal permissions like bucket-only access—to view sensitive operational metrics about the entire cluster. This is a privilege escalation vulnerability; the system trusts that a user is authorized to access cluster-wide telemetry data without verifying their IAM role.

• CVE-2026-55873MEDIUM 4.3

  SeaweedFS versions 4.08 through 4.33 contain an authorization flaw in their S3Tables integration. When requests use AWS SigV4 signing for the S3Tables service, the system incorrectly maps low-privileged user identities to a shared administrator account instead of enforcing proper access controls. This misconfiguration allows authenticated users with basic S3 permissions to discover confidential information—specifically, the names and Amazon Resource Names (ARNs) of table buckets managed by administrators. The vulnerability requires valid AWS credentials to exploit and is limited to information disclosure; no data modification or system disruption is possible. SeaweedFS 4.34 and later versions resolve this issue.

• CVE-2026-56217MEDIUM 4.3

  Capgo versions before 12.128.2 contain a vulnerability that lets attackers with API access weaken the security of app updates. Specifically, attackers can bypass organization policies that require app updates to be encrypted by directly manipulating the database to remove encryption keys, allowing them to force apps to accept unencrypted updates. This is a policy-enforcement gap rather than a fundamental cryptographic break, but it does undermine intentional security controls that teams put in place.

• CVE-2026-56255MEDIUM 4.3

  Capgo versions before 12.128.2 contain a denial of service flaw in the demo application creation endpoint. An authenticated user with organization write permissions can abuse this endpoint to repeatedly create demo applications without any rate limiting. Each request triggers approximately 138 database operations, which can degrade system performance, inflate operational costs, and potentially cause service instability for all users.

• CVE-2026-56298MEDIUM 4.3

  Capgo versions before 12.128.2 do not remove EXIF metadata from images that users upload through the app information endpoint. EXIF data embedded in photos can reveal precise geolocation coordinates, timestamps, device information, and other sensitive details. An authenticated attacker could upload specially crafted images to extract this embedded metadata, potentially learning the physical locations where images were taken or other operational details about the target environment.

• CVE-2026-56307MEDIUM 4.3

  Cap-go versions before 12.128.12 contain a pagination flaw in the device-management API endpoint that allows authenticated users with read access to devices to encounter broken pagination loops. When requesting lists of devices, the cursor mechanism fails to advance properly, causing the same pages of results to repeat indefinitely while later data becomes unreachable. This can disrupt workflows that depend on iterating through device inventories and may cause duplicate processing of device records.

• CVE-2026-56310MEDIUM 4.3

  Cap-go before version 12.128.2 has a flaw in how it enforces API key permissions. Normally, an organization-limited API key should only access data from that specific organization. However, this vulnerability allows someone holding such a restricted key to read member information from organizations they should not have access to. The exposed data includes usernames, email addresses, profile images, roles, and temporary account flags. While the vulnerability requires valid API credentials to exploit, it represents a meaningful breach of the intended access control boundaries.

• CVE-2026-56319MEDIUM 4.3

  Capgo versions before 12.128.2 leak information that allows authenticated users with limited API access to discover app IDs they shouldn't know about. By observing how the server responds to requests, an attacker can figure out which other apps exist in the system—even apps they have no permission to access. This breaks the isolation between different customer accounts and their data.

• CVE-2026-56333MEDIUM 4.3

  Capgo versions prior to 12.128.2 contain a vulnerability that allows authenticated organization administrators to bypass security validation checks and set invalid security policies. An authenticated attacker with admin privileges can directly modify the organization database table to circumvent field-level validation, potentially setting insecure values for critical parameters like API key expiration periods. This is an internal privilege abuse risk rather than a remote, unauthenticated attack vector.

• CVE-2026-56334MEDIUM 4.3

  Capgo versions before 12.128.2 are missing a critical access control rule in their database that allows build status updates to be saved. Without this rule, when API keys or anonymous users attempt to update the status of build requests, those updates don't get persisted to the database. This leaves build jobs stuck in a 'pending' state indefinitely, with no error details recorded, making it impossible to know why builds are failing or what went wrong.

• CVE-2026-56384MEDIUM 4.3

  Craft CMS versions 4.x and 5.x contain a permissions bypass flaw in the asset preview feature. A Control Panel user who lacks permission to view private assets can circumvent that restriction by directly calling the preview endpoint and supplying an asset ID they shouldn't access. The system will return a preview containing a signed link to the private asset, effectively revealing content the user was never authorized to see. Exploitation requires valid Control Panel access but no special privileges beyond that.

• CVE-2026-56385MEDIUM 4.3

  Craft CMS contains a flaw that allows authenticated users with limited permissions to view preview data for assets they shouldn't have access to. An attacker with a low-privilege account can request a preview of restricted assets by manipulating the assetId parameter, receiving both preview HTML and a private image route that exposes the target asset. The vulnerability affects Craft CMS 5.0.0-RC1 through 5.9.13 and 4.0.0-RC1 through 4.17.7. Patch versions 5.9.14 and 4.17.8 resolve the issue.

• CVE-2026-56457MEDIUM 4.3

  HCL DevOps Deploy and HCL Launch contain a vulnerability where sensitive information can be exposed in output logs. An attacker who gains access to these logs could potentially retrieve sensitive values associated with deployment steps. This is a low-privilege vulnerability requiring network access and authenticated access to the system.

• CVE-2026-56761MEDIUM 4.3

  Hono, a popular TypeScript web framework, contains a vulnerability in its server-side JSX rendering engine that allows attackers to inject malicious HTML into web pages. By crafting specially malformed attribute names—using characters like quotes and angle brackets—attackers can break out of HTML tag contexts and insert unintended HTML elements or attributes. This vulnerability affects Hono versions before 4.12.14. The attack requires user interaction (such as visiting a malicious link or form submission) and has limited impact on confidentiality, but can compromise the integrity of rendered content.

• CVE-2026-56772MEDIUM 4.3

  NewsBlur, a self-hosted RSS reader and social platform, has a flaw in how it checks permissions on its social interaction endpoint. An authenticated user can request another user's notification feed—containing follows, replies, and activity—simply by guessing or enumerating user ID numbers. The application fails to verify that the requester owns or has permission to view that data. While an attacker needs a valid NewsBlur account, the barrier to accessing private social information is minimal once authenticated.

• CVE-2026-57283MEDIUM 4.3

  A CSRF vulnerability in Jenkins Pipeline: Groovy Plugin allows authenticated attackers to manipulate job or system configuration through the Pipeline Snippet Generator without requiring user interaction. An attacker with valid Jenkins credentials can craft malicious requests that, when processed by a targeted Jenkins administrator or user, result in unintended configuration changes. This is a cross-site request forgery issue, meaning the attack leverages the trust relationship between a user and Jenkins to perform unauthorized actions.

• CVE-2026-57284MEDIUM 4.3

  Jenkins Pipeline: Groovy Plugin versions 4331.v9d06ed4658ff and earlier contain a vulnerability in the Pipeline Snippet Generator that allows authenticated attackers to instantiate arbitrary types beyond the intended Pipeline step components. This could enable attackers to instantiate types related to job or system configuration, potentially leading to unauthorized modification of pipeline definitions or system settings. The vulnerability requires authentication and does not involve user interaction, making it a concern for organizations where Jenkins access is broadly distributed among developers.

• CVE-2026-57285MEDIUM 4.3

  Jenkins GitHub Branch Source Plugin versions 1967.1969.v205fd594c821 and earlier contain a security gap that allows any user with basic read permissions to discover the URLs of GitHub Enterprise servers connected to the Jenkins instance. This is an information disclosure issue—attackers cannot modify systems or take actions, but they can learn infrastructure details that may inform further attacks. The vulnerability requires authentication and is not currently exploited in the wild.

• CVE-2026-57286MEDIUM 4.3

  The Jenkins Git Parameter Plugin has a permission enforcement gap that lets users with basic read access to jobs extract sensitive information about the repositories those jobs use. Specifically, attackers can discover branch names, tag names, and revision metadata without needing higher-level permissions. While exploitation requires already having some level of access to Jenkins, this still represents a meaningful information disclosure risk in environments where job visibility is meant to be restricted.

• CVE-2026-57287MEDIUM 4.3

  The Jenkins Job Configuration History Plugin fails to hide encrypted secrets when showing past versions of job and agent configurations. An attacker with Extended Read permissions can view these encrypted secret values in the configuration history, bypassing the normal redaction that would hide them elsewhere in the interface. This is a credentials exposure issue that affects Jenkins administrators and users who rely on the plugin to maintain secure configuration records.

• CVE-2026-57290MEDIUM 4.3

  A cross-site request forgery (CSRF) flaw in the Jenkins Priority Sorter Plugin versions 936.v2c01c6b_84449 and earlier allows attackers to trick administrators into unknowingly changing the plugin's job priority settings. An attacker can craft a malicious link or webpage that, when visited by a logged-in Jenkins administrator, silently modifies how jobs are prioritized in the queue—potentially disrupting workflow fairness or enabling job manipulation for malicious purposes.

• CVE-2026-57293MEDIUM 4.3

  The Jenkins Gitee Plugin contains a flaw in how it checks permissions when users attempt to view credential information. An attacker with global Item/Configure permission—but who hasn't been granted access to any specific job—can exploit this inconsistency to discover the names or IDs of credentials stored elsewhere in the Jenkins system. This is an information disclosure issue: the attacker learns what credentials exist, but cannot read their actual values or use them directly.

• CVE-2026-57297MEDIUM 4.3

  A permission flaw in the Jenkins Contrast Continuous Application Security Plugin version 3.11 and earlier allows low-privileged users who have been granted basic read access to Jenkins to make unauthorized connections to external systems on behalf of the plugin. By exploiting this gap, attackers can specify which URL to connect to along with credentials (username, API key, and service key) to use—potentially allowing lateral movement, credential harvesting, or interaction with attacker-controlled infrastructure while appearing to originate from the Jenkins instance.

• CVE-2026-57299MEDIUM 4.3

  The Jenkins Contrast Continuous Application Security Plugin versions 3.11 and earlier contain a permission-check vulnerability that allows users with basic read access to discover the names of Contrast security configurations stored in Jenkins. While an attacker cannot modify or delete these configurations with this flaw alone, the ability to enumerate configuration names could support reconnaissance for follow-up attacks or reveal sensitive architectural details about an organization's security scanning setup.

• CVE-2026-57300MEDIUM 4.3

  Jenkins MCP Server Plugin versions 0.177.v629fdb_2557fe and earlier contain a missing permission check that allows attackers with basic Item/Read access to read Pipeline replay scripts from jobs they can browse. While the attacker cannot modify or disrupt those scripts, they can view their contents—potentially exposing sensitive logic, credentials, or other secrets embedded in replay configurations. This is a controlled-access vulnerability: the attacker must already have some permission within Jenkins to exploit it.

• CVE-2026-57302MEDIUM 4.3

  Jenkins FitNesse Plugin versions 1.36 and earlier fail to encrypt passwords before storing them in job configuration files on the Jenkins controller. This means any Jenkins user granted Extended Read permission—or anyone with direct file system access to the controller—can read these plaintext credentials. The vulnerability is localized to the Jenkins instance itself and does not enable remote code execution or wider system compromise, but it does create an unauthorized information disclosure risk for sensitive authentication data.

• CVE-2026-57521MEDIUM 4.3

  Bitwarden Server versions before 2026.5.0 contain a flaw in how they control access to billing information. Any user with a valid login can retrieve billing and invoice details from any organization in the system—not just ones they belong to—by simply providing a different organization's ID to the preview invoice feature. This allows unauthorized access to sensitive financial data including Stripe tax calculations, subscription status, and customer information.

• CVE-2026-57637MEDIUM 4.3

  The Abandoned Cart Lite for WooCommerce plugin up to version 6.8.0 contains a Cross Site Request Forgery (CSRF) vulnerability that does not require authentication. This means an attacker can craft a malicious webpage or email that, when visited by a logged-in WordPress administrator or user with relevant permissions, triggers unintended actions within the plugin without the user's knowledge or consent. The attacker cannot steal data directly, but can manipulate the plugin's behavior—such as modifying cart recovery settings or email configurations—by leveraging the user's existing session.

• CVE-2026-57657MEDIUM 4.3

  Gmail SMTP versions 1.2.3.19 and earlier contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated user without their knowledge or consent. An attacker can craft a malicious webpage or email that, when visited by a Gmail SMTP user, silently executes unwanted commands in their email session. This attack requires user interaction (visiting a malicious link or page) but does not require the attacker to authenticate.

• CVE-2026-57664MEDIUM 4.3

  Bopo, a WooCommerce plugin for building product bundles, contains a flaw in versions 1.1.6 and earlier that allows authenticated users to view sensitive information they shouldn't normally access. The vulnerability requires a valid WordPress login but does not require elevated privileges, and attackers cannot modify or delete data—only read it. This is a moderate-severity issue that primarily affects e-commerce sites using this plugin.

• CVE-2026-57676MEDIUM 4.3

  CVE-2026-57676 is an authorization bypass vulnerability in the Matteo Manna Simple User Avatar plugin affecting versions 4.9 and earlier. An authenticated attacker can manipulate user-controlled keys to circumvent access control checks and view sensitive information they should not have access to. The vulnerability requires login credentials but poses a real risk to any deployment where user privacy or data segregation is important.

• CVE-2026-57685MEDIUM 4.3

  A broken access control vulnerability exists in Martfury, a WooCommerce marketplace WordPress theme, affecting versions 3.2.8 and earlier. The flaw allows authenticated subscribers to modify data or perform actions they shouldn't be able to access, though the impact is limited to integrity rather than confidentiality or availability. This is a privilege escalation issue requiring a valid user account to exploit.

• CVE-2026-57720MEDIUM 4.3

  ThumbPress versions up to 6.3.2 contain a missing authorization flaw that allows authenticated users to perform actions they shouldn't be permitted to execute. An attacker with valid credentials can exploit incorrectly configured access controls to cause service disruption or data unavailability, though the vulnerability does not expose sensitive information or enable unauthorized modifications to data.

• CVE-2026-57921MEDIUM 4.3

  JetBrains YouTrack had a flaw that allowed authenticated users to read other users' private data through the comment templates endpoint. The vulnerability affects YouTrack versions before 2026.2.16593 and requires a valid login to exploit. While the exposure is limited to information disclosure with no ability to modify data or crash the system, it poses a privacy risk in multi-tenant or shared YouTrack deployments where sensitive project or user information may be exposed.

• CVE-2026-57924MEDIUM 4.3

  JetBrains YouTrack versions before 2026.2.16593 contain a configuration vulnerability where default role settings inadvertently expose sensitive user profile information to authenticated users. An attacker with valid credentials can view personal details they shouldn't normally access, but cannot modify data or disrupt service. This is a localized information disclosure issue stemming from overly permissive default access controls.

• CVE-2026-57925MEDIUM 4.3

  JetBrains YouTrack versions before 2026.2.16593 contain an access control flaw that allows authenticated users to read saved queries and tags they should not have permission to access. An attacker with valid login credentials can view sensitive search configurations and organizational metadata without proper authorization checks. This is not a pre-authentication or unauthenticated attack; it requires an existing account on the YouTrack instance.

• CVE-2026-57945MEDIUM 4.3

  PhotoPrism, a photo management application, has a flaw in how it validates user permissions when allowing authenticated users to modify profile information. An attacker who has logged-in access can change another user's profile details—such as their name, email, or other settings—by directly manipulating API requests. The vulnerability exists because the system doesn't properly verify that a user can only edit their own profile; it instead accepts modification requests for any user ID. This is not a critical flaw because it requires an attacker to already have legitimate account credentials, but it does allow unauthorized data tampering.

• CVE-2026-57954MEDIUM 4.3

  Elide, a Java framework for building APIs, contains a flaw in how it validates sorting requests. When users ask an API to sort data by a specific field, Elide is supposed to check whether they have permission to see that field. In versions up to 7.1.17, this permission check is skipped for sort expressions, meaning an attacker with basic API access can sort results by fields they shouldn't be able to access. By observing how the rows reorder when sorting by different fields, an attacker can infer the relative values of hidden fields—essentially reading data they have no permission to see. This vulnerability affects both JSON:API and GraphQL endpoints.

• CVE-2026-5796MEDIUM 4.3

  GitLab has patched a flaw affecting multiple versions of its Community Edition (CE) and Enterprise Edition (EE) where an authenticated user with Reporter-level permissions in a group could view package metadata even when the Package Registry feature was disabled at the project level. The issue stems from incomplete authorization logic that failed to properly enforce registry access controls, allowing information disclosure without requiring higher privileges or user interaction.

• CVE-2026-58209MEDIUM 4.3

  NATS Server has a flaw in how it enforces message access controls when delivering retained messages and replaying durable messages over MQTT. Specifically, the server fails to consistently verify that a subscriber's deny rules should block a message before delivering it. An authenticated attacker with subscriber access could receive messages they should not have access to because the server bypasses access checks during certain message delivery scenarios. This affects versions before 2.14.3 and 2.12.12.

• CVE-2026-58214MEDIUM 4.3

  A flaw in NATS Server versions before 2.14.3 and 2.12.12 allows an authenticated MQTT client to bypass configured access controls and subscribe to internal system topics that handle MQTT quality-of-service acknowledgments. This exposes sensitive protocol metadata about other MQTT sessions in the account, but does not allow modification or disruption of services.

• CVE-2026-58315MEDIUM 4.3

  A cross-site request forgery (CSRF) vulnerability in SEIKO EPSON Web Config allows an attacker to trick a logged-in user into unknowingly performing unintended operations. An attacker could craft a malicious webpage that, when viewed by someone authenticated to the Web Config interface, silently executes administrative commands on their behalf. The vulnerability requires user interaction—the victim must actively visit the attacker's page while already logged in—but does not require the attacker to know or steal credentials.

• CVE-2026-58373MEDIUM 4.3

  CVAT, a computer vision annotation tool, has an authorization flaw that lets authenticated users discover which quality reports exist in other organizations. An attacker with valid login credentials can probe the quality reports API by trying different report IDs and observing whether the system returns a 'not found' or 'server error' response—leaking the fact that a report exists without revealing its contents. This affects CVAT versions before 2.69.0.

• CVE-2026-58450MEDIUM 4.3

  Invoice Ninja versions up to 5.13.26 contain a flaw in the client login portal that allows attackers to craft a deceptive login link. When a user logs in through this malicious link, they are automatically redirected to an attacker's website rather than the legitimate Invoice Ninja dashboard. The vulnerability doesn't require any special access or authentication from the attacker—they simply construct a fake login URL and trick users into clicking it via phishing or social engineering. After successful authentication, victims are silently redirected away from Invoice Ninja to a site the attacker controls, making this an effective stepping stone for credential theft or malware distribution.

• CVE-2026-58517MEDIUM 4.3

  A flaw in MediaWiki's WikiLambda extension allows authenticated users to bypass intended access controls by improperly handling input terminators. An attacker with login credentials could potentially manipulate their permissions or perform actions beyond their assigned role, though the vulnerability requires authentication and does not lead to data disclosure or system unavailability.

• CVE-2026-58597MEDIUM 4.3

  Microsoft Edge (Chromium-based) contains a UI design flaw that fails to adequately warn users before dangerous operations, creating an opening for attackers to conduct spoofing attacks over the network. An attacker cannot exploit this directly without user interaction—the vulnerability requires a person to be tricked into performing an action they would normally avoid if properly warned. The risk stems from insufficient UI clarity rather than a code execution flaw.

• CVE-2026-58653MEDIUM 4.3

  PraisonAI versions prior to 0.1.7 contain a cross-tenant data isolation flaw that allows authenticated users to create or modify issues within one workspace while secretly assigning them to projects in other workspaces. The vulnerability bypasses validation on the project_id parameter, enabling attackers to pollute project statistics and metrics across tenant boundaries without authorization. This is a privilege escalation and data integrity issue rather than a confidentiality breach, as the attacker cannot read data outside their workspace, only corrupt it.

• CVE-2026-58654MEDIUM 4.3

  The Grav API plugin version 1.0.0 has a flaw in how it handles avatar uploads. When a user uploads an avatar image, the system only checks the label that the browser sends (saying 'this is an image') but doesn't actually verify what the file really is. This means someone could upload malicious code — like a PHP script or a JavaScript-laden SVG file — disguised as an image. While the web server blocks direct access to these files via HTTP, they still exist on disk and could potentially be exploited if there are other weaknesses in the server setup or if attackers find creative ways to access them. The vulnerability was fixed in version 1.0.1.

• CVE-2026-58661MEDIUM 4.3

  n8n workflow automation platform versions before 2.28.0 (or 1.123.58 on the legacy 1.x branch) contain a disk space exhaustion vulnerability in file upload functionality. An authenticated attacker can repeatedly upload files through the data-table endpoint without triggering proper quota enforcement, causing files to accumulate in temporary storage until the system's periodic cleanup cycle runs. This can eventually consume all available disk space on the server, leading to service disruption. The vulnerability requires valid user credentials to exploit, limiting exposure to authenticated threat actors.

• CVE-2026-59217MEDIUM 4.3

  Open WebUI before version 0.10.0 contains an authorization bypass flaw that allows read-only users of a knowledge base to upload files and attach them to knowledge bases they shouldn't be able to modify. When users upload files, the application accepts a metadata parameter specifying which knowledge base to link the files to, but fails to check whether the uploading user actually has write access to that knowledge base. This lets lower-privilege users escalate their capabilities within the platform by injecting content into knowledge bases they can only read.

• CVE-2026-59223MEDIUM 4.3

  Open WebUI versions before 0.10.0 contain a flaw in how they validate domain blocklists used to control which external URLs can be fetched by the platform. An authenticated attacker can bypass these restrictions by manipulating the URL path or exploiting sibling-domain matching logic, potentially gaining access to internally restricted resources. The fix is available in version 0.10.0 and later.

• CVE-2026-59227MEDIUM 4.3

  Open WebUI, a self-hosted AI platform, contains an authorization bypass vulnerability in its image-editing API endpoint. Prior to version 0.10.0, any verified user could invoke server-side image editing operations without permission checks, even if administrators had disabled the feature globally or restricted it at the user level. This allowed non-admin users to consume server resources and leverage admin-configured AI provider credentials for image manipulation tasks they should not have access to.

• CVE-2026-5952MEDIUM 4.3

  GitLab has patched a privilege escalation weakness in its Community and Enterprise editions that allowed developers to bypass package protection rules and modify Maven package metadata they shouldn't have been able to access. The flaw required an authenticated account with developer permissions and affected versions 17.11 through 18.11.5, 19.0.0 through 19.0.2, and 19.1.0. Attackers couldn't steal data or crash systems, but they could alter package contents in repositories that should have been locked down.

• CVE-2026-59520MEDIUM 4.3

  CrawlWP SEO, a WordPress plugin for SEO crawling and analysis, contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. An attacker can craft a malicious webpage or email that, when visited by a logged-in administrator or user with relevant permissions, triggers unintended changes to the plugin's settings or configuration without the user's knowledge or consent. The vulnerability affects CrawlWP SEO versions up to and including 3.0.16.

• CVE-2026-59709MEDIUM 4.3

  Ghostfolio contains an authorization bypass vulnerability in its portfolio holding tag management feature. Users who are granted read-only access to a portfolio through share tokens can unexpectedly modify tags on holdings belonging to the portfolio owner. The vulnerability stems from improper permission validation when the system processes impersonation requests, allowing attackers to escalate their limited access rights to perform modification actions they should not be permitted to execute.

• CVE-2026-59930MEDIUM 4.3

  Mistune, a popular Python Markdown parser, contains a predictability flaw in how it generates anchor IDs for table-of-contents elements. Before version 3.3.0, the toc plugin and TableOfContents directive create heading IDs using a simple sequential pattern (toc_1, toc_2, etc.) without considering the actual heading text. An attacker who controls Markdown content can craft headings with matching IDs that collide with these predictable anchors, potentially redirecting users to unintended locations or interfering with page navigation and styling rules that depend on those IDs.

• CVE-2026-6277MEDIUM 4.3

  GitLab EE contains an authorization bypass that allows authenticated users with Security Manager role to modify project security settings even when that feature is supposed to be disabled. An attacker with this role can circumvent intended access controls to manage security configurations that should be locked down, potentially weakening project defenses.

• CVE-2026-6292MEDIUM 4.3

  The MP Customize Login Page WordPress plugin contains a CSRF vulnerability affecting all versions up to 1.0. An attacker can trick an administrator into visiting a malicious website that submits a forged request to change plugin settings—such as the login page background, logo, colors, and messages. The vulnerability exists because the plugin's nonce validation is inverted (it rejects valid requests instead of invalid ones) and missing a required parameter, making the security check completely ineffective. Unauthenticated attackers can exploit this without needing any special privileges.

• CVE-2026-6412MEDIUM 4.3

  CVE-2026-6412 is a medium-severity certificate handling issue in WolfSSL in which the library continues to accept SHA-1 and MD5 hashing algorithms when processing X.509 certificates, despite these algorithms being cryptographically obsolete and violating modern RFC 8446 (TLS 1.3) compliance requirements. An authenticated attacker could exploit this to bypass certificate validation controls, potentially enabling man-in-the-middle attacks or acceptance of fraudulent certificates within encrypted sessions. The vulnerability requires prior authentication and does not directly compromise confidentiality, but does introduce integrity risks through improper certificate chain validation.

• CVE-2026-6440MEDIUM 4.3

  The GoodMeet plugin for WordPress, which integrates Google Meet into sites, has a security flaw in versions 1.1.8 and earlier. An attacker can trick a site administrator into visiting a malicious link, which would silently delete the plugin's Google Meet API credentials. This doesn't directly expose sensitive data or let attackers log in, but it disables the Google Meet feature on the affected site and forces administrators to reconfigure it. The vulnerability exists because the plugin fails to use a security token (nonce) to verify that credential-reset requests are legitimate.

• CVE-2026-6689MEDIUM 4.3

  Mattermost has a permissions bypass vulnerability affecting multiple versions where authenticated users with team-creation rights can inappropriately configure invitation settings during team setup. Specifically, users lacking the PermissionInviteUser permission can set AllowOpenInvite (making a team publicly joinable) and AllowedDomains (restricting team membership to specific domains) during POST-based team creation—settings they would normally be blocked from configuring on existing teams. The vulnerability requires an authenticated account and results in unauthorized configuration of team access controls, not data disclosure or system failure.

• CVE-2026-7047MEDIUM 4.3

  The Frontend User Notes plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting all versions through 2.1.1. An attacker can craft a malicious webpage that, when visited by a logged-in WordPress user, silently overwrites that user's own notes without their knowledge or consent. The attack requires social engineering—tricking the victim into clicking a link or visiting a malicious site—but once successful, allows unauthorized modification of the victim's note content. Importantly, the vulnerability is self-contained: attackers cannot use it to tamper with other users' notes, only those belonging to the person they've tricked.

• CVE-2026-7492MEDIUM 4.3

  GitLab Community Edition and Enterprise Edition contain a flaw in how they control access to cross-project reference pages. An attacker with a valid GitLab login can query these pages to determine whether private projects exist—information that should remain hidden. The vulnerability affects many versions released over the past several years, though no unauthenticated exploitation path has been confirmed. GitLab has released patches for the most recent major versions.

• CVE-2026-7516MEDIUM 4.3

  A vulnerability in Lenovo's Android application for tablets sold in China allows websites visited through the device's built-in browser to manipulate the system clipboard. An attacker could craft a malicious website that, when visited, overwrites clipboard contents with arbitrary data—potentially redirecting a user's next paste action to unintended destinations or injecting malicious content into applications that rely on clipboard input.

• CVE-2026-7523MEDIUM 4.3

  The Alba Board plugin for WordPress contains a flaw that allows attackers to bypass access controls and view sensitive project information they shouldn't be able to see. An authenticated user with basic subscriber access can retrieve private card data—titles, descriptions, due dates, and comments—that should be restricted to administrators and editors only. More critically, the vulnerability can be exploited by unauthenticated site visitors if the Alba Board shortcode appears anywhere on the website, because the security token (nonce) is exposed in the page source. All versions up to and including 2.1.3 are affected.

• CVE-2026-7526MEDIUM 4.3

  The PDF Embedder plugin for WordPress contains a flaw that allows authenticated users with basic contributor permissions or higher to access sensitive configuration information. If the premium add-on is installed with a saved license key, that key can be exposed; on free installations, the exposure is limited to non-sensitive viewer settings like dimensions and toolbar options. An attacker would need valid WordPress login credentials at the contributor level or above to exploit this, but no user interaction or network complexity is required once authenticated.

• CVE-2026-7533MEDIUM 4.3

  The Easy Digital Downloads plugin for WordPress contains a security flaw that allows attackers to hijack a store's Square payment processing account. An attacker can send a malicious link to a WordPress administrator; if clicked while logged in, the link silently changes the store's Square payment credentials to attacker-controlled ones, redirecting future payments to the attacker. The vulnerability exists because the plugin does not verify that payment configuration requests come from legitimate, authorized actions—a standard web security practice called CSRF protection.

• CVE-2026-7621MEDIUM 4.3

  The SMTP2GO for WordPress plugin contains an authorization flaw that allows any logged-in user with subscriber-level permissions or higher to delete all SMTP email logs from the database or export sensitive email records to CSV format. This affects all versions up to 1.16.0 and exposes recipient addresses, sender information, message subjects, and API response data. An attacker with basic user access can perform these destructive and data-exfiltration actions without additional authentication checks.

• CVE-2026-7624MEDIUM 4.3

  The Squirrly SEO plugin for WordPress has an access control flaw that allows lower-privileged users to perform actions meant only for administrators. Specifically, a contributor-level user can disconnect the website from Google Search Console and Google Analytics by invoking backend API calls that should be blocked. This is a privilege escalation issue affecting all versions up to 12.4.16.