By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 81 of 86

• CVE-2026-8422MEDIUM 4.3

  The Remove meta boxes per user role WordPress plugin contains a security flaw that allows attackers to change how meta boxes (content panels) are hidden or shown for different user roles on a WordPress site. An attacker can't do this directly, but by tricking a site administrator into clicking a malicious link, the attacker can force the admin's browser to make unauthorized changes to these visibility settings. The vulnerability affects all versions up to and including 1.01.

• CVE-2026-8472MEDIUM 4.3

  GitLab Enterprise Edition (EE) contains a flaw that allows authenticated users with minimal permissions to access sensitive work item metadata from private projects they shouldn't be able to view. The vulnerability stems from missing authorization checks in the application logic, meaning the system failed to properly verify whether a user had legitimate access before exposing this information. An attacker would need valid GitLab credentials and some level of access to the platform, but the actual permissions required are low, making this a concerning insider-risk scenario.

• CVE-2026-8480MEDIUM 4.3

  Stormshield Network Security contains a certificate validation flaw that allows attackers possessing revoked client certificates to bypass authentication controls and gain administrative access to the captive-admin portal. This affects multiple versions across the 4.3, 4.4–4.8, and early 5.0 release lines. An attacker on the local network with a previously valid but now-revoked certificate can authenticate as an administrator without current credentials or legitimate access rights.

• CVE-2026-8482MEDIUM 4.3

  StormShield Network Security contains a credential disclosure vulnerability affecting versions 4.3.0 through 4.3.41, 4.8.0 through 4.8.15, and 5.0.0 through 5.0.5. When administrative commands are executed via the CLI tool, sensitive authentication material—specifically the proxy Certificate Authority passphrase and TPM password—can be exposed to users with SSH access to the firewall. This risk materializes only when SSH multiuser mode is enabled, limiting the attack surface to environments where multiple administrative users share SSH credentials or access.

• CVE-2026-8611MEDIUM 4.3

  A WordPress plugin called Klamra Paycal for Aspaclaria contains a flaw that allows authenticated users with subscriber-level permissions to access and download invoices belonging to other customers. The vulnerability stems from insufficient access controls on invoice retrieval—an attacker can simply modify an invoice identifier in a request to view sensitive billing data from any customer, including names, email addresses, phone numbers, order amounts, and internal notes. No special privileges or user interaction are required beyond basic authenticated access.

• CVE-2026-8614MEDIUM 4.3

  The Assistio plugin for WordPress contains a vulnerability that allows authenticated users with basic Subscriber-level permissions to delete critical plugin settings, including OAuth configuration data. The vulnerability exists because the plugin fails to verify that a user has proper authorization and fails to include a security token (nonce) on the function that deletes settings. An attacker with even minimal WordPress account access can exploit this to break the plugin's connection to the Assistio bot service.

• CVE-2026-8682MEDIUM 4.3

  The 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On WordPress plugin contains a flaw that allows users with basic subscriber access to change critical plugin settings they should not be able to modify. An authenticated attacker can bypass authorization checks to write arbitrary data directly to the plugin's configuration stored in the database, potentially affecting how the 3D viewer and virtual try-on features function across the site.

• CVE-2026-8688MEDIUM 4.3

  The Advance Nav Menu Manager plugin for WordPress contains an authorization bypass flaw that allows low-privilege users—those with subscriber-level access or higher—to manipulate navigation menu items without proper permission checks. Attackers can duplicate, copy, move, or publish navigation items, potentially defacing site structure or injecting malicious navigation elements. The vulnerability stems from inadequate permission validation during menu item operations and affects all versions up to and including 1.3.

• CVE-2026-8689MEDIUM 4.3

  The Visualizer: Tables and Charts Manager WordPress plugin contains an authorization bypass flaw that allows logged-in users with minimal privileges (Subscriber level and above) to create chart posts without proper permission checks and to view or modify charts belonging to other users, including site administrators. The vulnerability affects all versions through 3.11.14 and stems from missing capability validation in two critical AJAX functions. While the flaw requires an authenticated account, the low barrier to entry and potential for unauthorized data access make it a meaningful risk for multi-user WordPress installations.

• CVE-2026-8902MEDIUM 4.3

  The AJAX Report Comments plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 2.0.4. An attacker can trick a WordPress site administrator into unknowingly changing critical plugin settings—such as notification email addresses, comment thresholds, success messages, and cookie durations—by crafting a malicious link or webpage. The attack requires social engineering to get an admin to click a link, but once successful, the attacker can alter how the plugin behaves without any authentication.

• CVE-2026-8904MEDIUM 4.3

  The FastPicker plugin for WordPress, which integrates order picking and management capabilities with WooCommerce, contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 1.0.2. An attacker cannot exploit this vulnerability directly; instead, they must trick a WordPress site administrator into clicking a malicious link while logged in. If successful, the attacker can alter critical plugin settings—including webhook toggles and API endpoint URLs for FastPicker and KDZ services—without the administrator's knowledge or consent. This is a configuration-tampering risk rather than a direct data breach vector.

• CVE-2026-8909MEDIUM 4.3

  The WpMobi WordPress plugin contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick administrators into modifying plugin settings and injecting malicious scripts. An unauthenticated attacker can craft a malicious link or webpage that, when clicked by a site admin, silently changes the plugin's General Settings without the admin's knowledge or consent. The vulnerability is particularly concerning because the injected script executes in the admin's browser even when the malicious input fails validation, meaning the attack works regardless of server-side data checks.

• CVE-2026-8940MEDIUM 4.3

  The WP Meta Sort Posts WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to 0.9. An attacker can craft a malicious link or webpage that, when clicked by an administrator, silently changes plugin settings without their knowledge or consent. Specifically, the vulnerability allows modification of the msp_loop_file and msp_nav_location settings. This is possible because the plugin fails to properly validate security tokens (nonces) on the options page. The attack requires social engineering to trick an admin into clicking a link, but once successful, can alter how the plugin sorts and displays posts on the website.

• CVE-2026-8944MEDIUM 4.3

  A WordPress plugin called 'Plugin for Google Analytics by IO technologies' (versions 1.1 and earlier) fails to properly validate requests made to its settings page. This allows an attacker to trick a site administrator into clicking a malicious link that would change the plugin's Google Analytics tracking ID without the admin's knowledge or consent. The attacker cannot see sensitive data or crash the site, but can redirect analytics to their own account, potentially allowing them to spy on site traffic.

• CVE-2026-8976MEDIUM 4.3

  The RSS Aggregator by Feedzy plugin for WordPress fails to properly verify user permissions, allowing contributors and higher-level users to perform administrative actions they shouldn't be able to access. An authenticated attacker with basic contributor rights can create RSS import jobs, delete all posts from any import, clear error logs, and view sensitive taxonomy and post metadata information. The vulnerability is particularly dangerous because the security token needed to perform these actions is automatically exposed to anyone who can edit posts through the block editor interface—no additional hacking or theft is required.

• CVE-2026-8995MEDIUM 4.3

  The Poll Maker – Versus Polls plugin for WordPress has a flaw that lets logged-in users see sensitive account information they shouldn't access, including password hashes. The vulnerability stems from an AJAX endpoint that returns the entire WordPress user object without proper security checks. Any subscriber or higher can call this endpoint and retrieve not just their own data, but potentially others' account details including email addresses, registration dates, roles, and capabilities. While the exposure doesn't immediately compromise an account, the password hash data could be targeted by offline cracking attempts.

• CVE-2026-9008MEDIUM 4.3

  The Page-list plugin for WordPress contains an authorization flaw in its shortcode feature that allows authenticated users with contributor-level or higher permissions to view sensitive content they shouldn't be able to access. By inserting a specially crafted shortcode into a draft post and previewing it, attackers can extract titles, body text, and metadata from private or draft pages across the entire site. The vulnerability exists because the plugin doesn't verify whether the current user is permitted to view the pages being queried.

• CVE-2026-9013MEDIUM 4.3

  The Bogo WordPress plugin contains a flaw that allows authenticated users with basic subscriber-level permissions or higher to read sensitive content from private, draft, and password-protected posts on a site. An attacker exploits this by requesting a translation of a post they shouldn't have access to, then extracting the raw text from the duplicated version that the translation feature creates. The vulnerability is most impactful when the attacker has contributor-level access, since that's when they can actually view the exposed content. Any WordPress site using Bogo version 3.9.1 or earlier is potentially at risk.

• CVE-2026-9015MEDIUM 4.3

  The Equalize Digital Accessibility Checker plugin for WordPress contains a flaw that allows users with basic subscriber access to modify accessibility audit findings they shouldn't be able to touch. An authenticated attacker can change whether issues are marked as ignored, alter the reason for ignoring them, and add comments to any accessibility finding on the site. In some cases, they can perform bulk modifications across multiple related findings at once. This means someone with minimal privileges could systematically hide or dismiss accessibility compliance problems, undermining the integrity of WCAG and ADA audit records without proper authorization.

• CVE-2026-9048MEDIUM 4.3

  Slider Revolution, a popular WordPress plugin, contains a vulnerability that allows authenticated users with basic contributor privileges to view sensitive social media API credentials through a specific AJAX action. An attacker with contributor-level access or higher can call the 'slider.get.full' AJAX action to retrieve raw API tokens and keys—including Instagram OAuth tokens, Flickr API keys, YouTube Data API credentials, and Facebook App IDs—that have been configured within slider settings. This exposure affects plugin versions 7.0.0 through 7.0.14.

• CVE-2026-9050MEDIUM 4.3

  Slider Revolution, a popular WordPress plugin, contains a flaw that allows contributors and higher-privileged users to disable any plugin on a WordPress site without proper authorization checks. An attacker with basic contributor access—a common account level in multi-author sites—can leverage this to shut down security plugins, backup solutions, or other critical extensions. The vulnerability affects versions 6.0.0 through 6.7.55 and 7.0.0 through 7.0.14.

• CVE-2026-9162MEDIUM 4.3

  Mattermost has a session management flaw affecting versions 11.7.0, 11.6.2 and earlier, 11.5.5 and earlier, and 10.11.17 and earlier. When an administrator revokes a user's global session—such as during offboarding or after detecting unauthorized access—the system fails to immediately disconnect active WebSocket connections used for real-time messaging and notifications. An attacker or departing employee with an existing connection can remain authenticated and continue receiving live team communications until their cached session naturally expires or they manually reconnect. This is a persistence risk in environments where rapid session termination is critical for security or compliance.

• CVE-2026-9183MEDIUM 4.3

  The 24liveblog WordPress plugin leaks sensitive API credentials to authenticated users with basic contributor access or higher. When these users open the WordPress block editor, the plugin inadvertently exposes authentication tokens and account identifiers as JavaScript data embedded in the page source. An attacker with even minimal WordPress account privileges can view this sensitive information by inspecting the browser's page source, gaining unauthorized access to the site's 24liveblog integration account.

• CVE-2026-9184MEDIUM 4.3

  The 24liveblog WordPress plugin fails to properly validate who is making certain administrative requests, allowing logged-in authors and higher-privilege users to hijack the plugin's connection to the 24liveblog service. An attacker with author-level access can inject false credentials that redirect the plugin to use the attacker's 24liveblog account instead of the legitimate site owner's, or alternatively overwrite administrator accounts' tokens to lock them out of the integration.

• CVE-2026-9199MEDIUM 4.3

  The Equalize Digital Accessibility Checker WordPress plugin contains a flaw that allows authors and higher-privileged users to manipulate accessibility audit records on the entire site, not just their own posts. An attacker with author-level access can use an accessibility issue from one of their posts as a 'skeleton key' to dismiss, ignore, or restore similar issues site-wide—including those attached to administrator posts. While this doesn't grant direct read access to sensitive data, it enables unauthorized modification of critical compliance records, undermining audit integrity.

• CVE-2026-9228MEDIUM 4.3

  A WordPress plugin called Timetable and Event Schedule by MotoPress has a flaw that allows users with contributor-level access or higher to see confidential information they shouldn't have access to. Specifically, they can view drafts, pending reviews, and private event posts created by other users, including the content, excerpts, and author information. The vulnerability stems from the plugin failing to properly validate user input when retrieving event data, making it possible to directly access posts by guessing or enumerating their IDs.

• CVE-2026-9230MEDIUM 4.3

  The Quiz and Survey Master plugin for WordPress contains a flaw that allows users with contributor-level permissions (or higher) to modify quizzes owned by other users, alter quiz result pages, and redirect notification emails to addresses they control. The vulnerability stems from incomplete permission checks when users attempt to modify quiz configurations. An attacker exploits this by first retrieving a valid authentication token from one quiz, then reusing it to gain unauthorized access to another user's quiz settings.

• CVE-2026-9233MEDIUM 4.3

  The Quiz and Survey Master plugin for WordPress has a flaw that allows users with basic contributor permissions (or higher) to manipulate quiz output templates in ways they shouldn't be able to. An authenticated attacker can create, modify, or delete templates and inject unfiltered HTML and scripts into them. While the vulnerability requires an existing WordPress account, it sidesteps proper permission checks that should prevent lower-privilege users from touching these administrative templates.

• CVE-2026-9234MEDIUM 4.3

  The JTL-Connector for WooCommerce plugin contains authorization flaws that allow low-privileged WordPress users (Subscriber level and above) to perform administrative actions without proper permission checks. Specifically, attackers can change plugin configuration, download sensitive log files containing developer information, and delete those logs. This bypasses WordPress's built-in permission model and could lead to configuration tampering or information disclosure.

• CVE-2026-9235MEDIUM 4.3

  The DHL eCommerce (Benelux) for WooCommerce plugin contains a flaw that allows low-privileged users to create or delete shipping labels for any order in a WooCommerce store. An attacker with even a basic Subscriber account can manipulate shipping operations belonging to other customers or administrators, disrupting order fulfillment and potentially causing financial or operational harm. The vulnerability exists because the plugin fails to verify user permissions and prevent cross-site request forgery attacks on these sensitive functions.

• CVE-2026-9237MEDIUM 4.3

  A flaw in the Crew HRM WordPress plugin (versions up to 1.2.2) allows any logged-in user with basic subscriber access to delete, modify, or duplicate job listings that belong to other users or the organization. The vulnerability exists because the plugin fails to verify whether a user actually has permission to perform these actions. Additionally, the security token the plugin relies on to prevent unauthorized requests is accidentally exposed to all logged-in visitors, making it trivial for attackers to bypass the intended safeguard.

• CVE-2026-9240MEDIUM 4.3

  The Colissimo Officiel shipping plugin for WooCommerce has a flaw that allows any authenticated user—even those with basic Subscriber access—to modify shipping details on orders that don't belong to them. An attacker can change the shipping method, pickup point, or delivery address for any order in the system without needing special permissions or providing a security token. This is a privilege escalation issue: an attacker with minimal account rights gains the ability to tamper with fulfillment data across the entire store.

• CVE-2026-9241MEDIUM 4.3

  The FOX – Currency Switcher Professional for WooCommerce plugin contains a flaw that lets authenticated users trick the system into thinking they have higher privileges than they actually do. By manipulating a request parameter, a subscriber-level user can impersonate a wholesale customer or administrator to access pricing they shouldn't be able to see. This only matters if your store uses the fixed user-role pricing feature and has set special prices for privileged customer types.

• CVE-2026-9599MEDIUM 4.3

  The Tectite Forms plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions through 1.3. An attacker can trick a site administrator into clicking a malicious link, which then allows the attacker to change the plugin's settings without the administrator's knowledge. This could include modifying the tectite_forms_button option or other plugin configurations. The vulnerability requires social engineering but poses a real risk to WordPress sites using this plugin.

• CVE-2026-9616MEDIUM 4.3

  The Generate Security.txt plugin for WordPress has an authorization flaw that allows any logged-in subscriber (or higher-privilege user) to delete the site's security.txt file or create a .well-known directory without proper permission checks. An attacker with even basic subscriber access can invoke these actions directly through the plugin's AJAX endpoints, bypassing intended access controls. This affects all versions up to and including 1.0.12.

• CVE-2026-9618MEDIUM 4.3

  The PeachPay plugin for WordPress, which integrates payment processing for Stripe, PayPal, Square, and other providers, contains a cross-site request forgery (CSRF) vulnerability in all versions up to 1.120.46. An attacker can craft a malicious link or webpage that, when clicked by a site administrator, silently deletes all stored Stripe credentials from the site's database without the administrator's knowledge or consent. This disables Stripe payments immediately and requires the administrator to reconfigure the integration. The attack requires social engineering to trick an admin into clicking the link, but requires no special authentication or technical sophistication once the admin takes the bait.

• CVE-2026-9619MEDIUM 4.3

  The Reviews and Rating – Docplanner plugin for WordPress contains a flaw that allows any logged-in user with subscriber-level permissions or higher to perform actions they shouldn't be able to do. Specifically, attackers can make the plugin fetch content from external websites without authorization, store that scraped data in the WordPress database, and send emails impersonating the site administrator. This requires an attacker to already have legitimate WordPress access, but the damage they can inflict goes well beyond what a normal subscriber should control.

• CVE-2026-9676MEDIUM 4.3

  A flaw in the F4 Post Tree WordPress plugin versions prior to 2.0.5 allows authenticated users with basic Subscriber privileges to restructure posts without proper authorization checks. The vulnerability stems from missing security verification (capability checks and CSRF tokens) on an AJAX endpoint, meaning any logged-in user can rearrange the parent post relationships and menu ordering of any post in the system—even content created by administrators or belonging to restricted sections.

• CVE-2026-9719MEDIUM 4.3

  The LatePoint WordPress plugin, which handles calendar booking and appointment scheduling, contains a security flaw that allows attackers to manipulate invoice statuses without proper authorization. An attacker can craft a malicious link or webpage and, if they trick a WordPress administrator into clicking it, change the status of any invoice—including fraudulently marking unpaid invoices as paid. This works because the plugin fails to properly validate requests before processing status changes.

• CVE-2026-9721MEDIUM 4.3

  The Book a Room Event Calendar WordPress plugin fails to protect its settings page against Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious webpage or email that, when clicked by a site administrator, silently changes critical plugin configuration—including database host, credentials, encryption keys, and registration URLs—without the administrator's knowledge or consent. All versions up to 1.9 are affected. The vulnerability requires social engineering (tricking an admin to click a link) but carries no additional barriers once that click happens.

• CVE-2026-9722MEDIUM 4.3

  The Laiser Tag plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting all versions through 1.2.5. An attacker can craft a malicious link or webpage that, when clicked by a site administrator, silently modifies critical plugin settings without the administrator's knowledge or consent. This includes changes to API keys, tag filtering rules, and tagging behavior—settings that directly control how the plugin functions across the site.

• CVE-2026-9723MEDIUM 4.3

  The Google Plus One Bottom plugin for WordPress contains a cross-site request forgery (CSRF) flaw that allows attackers to manipulate plugin settings without proper authorization. An attacker can craft a malicious link or web page that, when clicked by a site administrator, will change critical plugin configuration options—such as language preferences, callback functions, and URLs—without the administrator's knowledge or consent. This attack requires social engineering to trick an admin into clicking the malicious link, but requires no authentication or technical exploit code to execute.

• CVE-2026-9724MEDIUM 4.3

  The MotorDesk plugin for WordPress has a cross-site request forgery (CSRF) vulnerability that allows an attacker to trick a site administrator into unwittingly changing the plugin's settings. By crafting a malicious link or webpage, an unauthenticated attacker can alter critical configuration like the search page URI and custom template directory path if they can convince an admin to click a link while logged in. The vulnerability affects all versions up to and including 1.1.2 and requires social engineering but poses a real risk to site integrity and functionality.

• CVE-2026-9730MEDIUM 4.3

  The Remove NoFollow Commenter URL plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows unauthenticated attackers to change how the plugin displays comments. An attacker can craft a malicious link or webpage that, when clicked by a WordPress site administrator, silently modifies the plugin's comment settings without the administrator's knowledge or consent. This requires social engineering to trick an admin into visiting the attacker's content, but requires no special technical skills to exploit once that condition is met.

• CVE-2026-9731MEDIUM 4.3

  The Wp Js Detect plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows attackers to manipulate plugin settings without proper authorization. By tricking a site administrator into clicking a malicious link, an attacker can change the plugin's notification text and CSS settings, then inject harmful content that appears on the website to visitors. The vulnerability affects all versions up to 1.0.9 and requires no special privileges or technical sophistication to exploit.

• CVE-2026-9732MEDIUM 4.3

  The EmergencyWP plugin for WordPress has a security flaw that allows attackers to change important plugin settings without authorization. An attacker would need to trick a WordPress site administrator into clicking a malicious link, but if successful, they could alter access controls, email addresses, and other critical configurations. This is a cross-site request forgery (CSRF) vulnerability caused by the plugin failing to properly validate requests before processing them.

• CVE-2026-9791MEDIUM 4.3

  An authenticated user who belongs to a Keycloak organization can request tokens or access APIs in ways that expose organization metadata, even after an administrator has turned off the Organizations feature. This metadata leakage could cause downstream applications (resource servers) to make incorrect access control decisions based on stale or unintended organization information.

• CVE-2026-9798MEDIUM 4.3

  Keycloak's account lockout feature, which temporarily disables accounts after repeated failed login attempts, can be bypassed when an attacker possesses valid client credentials. By using the Client-Initiated Backchannel Authentication (CIBA) flow—a legitimate OAuth 2.0 feature—attackers can circumvent the lockout and continue attempting to authenticate or obtain tokens. This undermines brute-force protection and creates a secondary path for unauthorized access once the attacker has obtained initial client credentials.

• CVE-2026-9807MEDIUM 4.3

  GitLab has patched a flaw in its Community and Enterprise editions where a Project Access Token that was supposed to be blocked could still access private project resources. This happened because the authorization checks weren't applied correctly when a token was revoked or blocked. An authenticated user with permissions to create or manage tokens could potentially exploit this before the fix was released, though the vulnerability requires prior login access and the attacker would need knowledge of or ability to create a blocked token.

• CVE-2026-9857MEDIUM 4.3

  The Invoice123 WordPress plugin contains a flaw that allows users with basic subscriber accounts to make unauthorized changes to critical invoice and payment settings. Specifically, attackers can replace the plugin's API key, reconfigure invoice settings, and modify tax rate information in WooCommerce—actions they should not be able to perform. This vulnerability affects all versions up to and including 1.7.0 and requires no special technical knowledge to exploit, only valid WordPress login credentials at the subscriber level or higher.

• CVE-2026-9907MEDIUM 4.3

  A memory read vulnerability in Google Chrome's Dawn graphics component allows attackers to access sensitive data from different website origins. An attacker can craft a malicious web page that, when visited by a user, tricks Chrome into reading memory beyond intended boundaries and leaking information from other websites the user may have open. This affects Windows systems running Chrome versions prior to 148.0.7778.216.

• CVE-2026-9911MEDIUM 4.3

  CVE-2026-9911 is a memory safety issue in the ANGLE graphics library used by Google Chrome. When a user visits a specially crafted webpage, an attacker can read small amounts of sensitive data from the browser's memory. The vulnerability requires user interaction—visiting the malicious page—but needs no special permissions or browser configuration to exploit. While the data exposure is limited in scope, it could leak sensitive information like passwords, tokens, or cached credentials stored in memory.

• CVE-2026-9913MEDIUM 4.3

  A flaw in the ANGLE graphics library component of Google Chrome prior to version 148.0.7778.216 could allow an attacker to access memory outside intended bounds when a user visits a malicious website. The vulnerability requires user interaction (visiting a crafted page) but does not require special privileges. Potential impacts include disclosure of sensitive information, though the attacker cannot modify data or crash the browser directly through this flaw.

• CVE-2026-9919MEDIUM 4.3

  A WebGL processing flaw in Google Chrome for Android allows attackers to read data they shouldn't have access to by tricking users into visiting a malicious webpage. The vulnerability exists in how Chrome handles certain graphics operations and can leak information across website boundaries, but only affects the Android version of Chrome and requires user interaction to exploit.

• CVE-2026-9921MEDIUM 4.3

  Google Chrome on Android contains a flaw in its WebGL graphics processing where memory buffers may not be properly initialized before use. An attacker can exploit this by crafting a malicious HTML page that, when visited, allows them to read sensitive information from other websites—a cross-origin data leak. The vulnerability requires user interaction (clicking a link or viewing a page) but does not require special privileges or complex attack setup.

• CVE-2026-9929MEDIUM 4.3

  A flaw in how Google Chrome on Android handles WebGL—a technology that enables 3D graphics in web browsers—could allow an attacker to trick a user into visiting a malicious webpage and expose data from other websites the user has open. The attacker cannot force this to happen; the user must interact with the page, such as by clicking or scrolling. This is a cross-origin data leak, meaning sensitive information from one domain could become visible to JavaScript code running on an attacker's domain.

• CVE-2026-9930MEDIUM 4.3

  An out-of-bounds write vulnerability exists in the Dawn graphics component of Google Chrome on macOS. An attacker can craft a malicious HTML page that, when viewed by a user, writes data to memory locations outside the intended bounds of a buffer. This memory corruption could allow an attacker to modify sensitive data or potentially achieve code execution, though the CVSS assessment indicates the integrity impact is limited. The vulnerability requires user interaction—the victim must visit or be directed to the malicious page—and affects Chrome versions prior to 148.0.7778.216 on macOS.

• CVE-2026-9935MEDIUM 4.3

  CVE-2026-9935 is a memory safety issue in Google Chrome's ANGLE graphics library that allows attackers to steal sensitive data from other websites. When you visit a malicious webpage, an attacker can craft it to leak information that should be isolated to other sites you have open. The vulnerability requires user interaction—you must visit the attack page—but the bar for exploitation is otherwise low. Google has classified this as High severity internally, though the CVSS score reflects a more limited scope.

• CVE-2026-9943MEDIUM 4.3

  A memory access flaw in Google Chrome's WebGL implementation on Android allows attackers to read data from other websites through a specially crafted web page. When a user visits the malicious page, the attacker can extract information (such as authentication tokens, session cookies, or sensitive content) from sites the user is logged into. This is a cross-origin data leak—meaning the attacker can access information meant to be isolated to other domains.

• CVE-2026-9955MEDIUM 4.3

  A vulnerability in Google Chrome on iOS versions before 148.0.7778.216 allows attackers to extract sensitive information from websites the user visits. An attacker would craft a malicious webpage and trick a user into visiting it; the page can then read data intended to be private to other websites. This is a cross-origin data leak—a violation of the browser's same-origin policy that normally prevents websites from accessing each other's information.

• CVE-2026-10640MEDIUM 4.2

  Zephyr RTOS contains a use-after-free vulnerability in its IPv6 Neighbor Discovery implementation. When a Zephyr device sends IPv6 neighbor advertisement or solicitation messages, the code attempts to update traffic statistics after the network packet has already been freed by the underlying driver. An attacker on the same network segment can trigger this flaw by sending crafted ICMPv6 packets, potentially causing the device to crash or corrupt memory. The vulnerability affects Zephyr versions 3.3.0 through 4.4.0 and requires no authentication—any adjacent device can trigger it.

• CVE-2026-10644MEDIUM 4.2

  A flaw in Microchip's SERCOM-G1 UART driver for PIC32CM-JH microcontrollers causes a one-byte memory write immediately after a receive buffer when asynchronous DMA reception is enabled with a minimal buffer size. An attacker with access to the serial interface can supply data that overwrites one byte in adjacent memory, potentially crashing the device or causing localized corruption. The vulnerability requires specific configuration (async UART mode and single-byte buffer usage) that is not enabled by default, limiting its immediate risk in most deployments.

• CVE-2026-11479MEDIUM 4.2

  A weakness in the grepai hash implementation allows authenticated users to manipulate how files are indexed and chunked in the Qdrant backend, potentially corrupting data integrity or availability. The vulnerability requires login credentials and involves complex exploitation techniques, making opportunistic attacks unlikely. A fix has been proposed but not yet merged into the main codebase.

• CVE-2026-11570MEDIUM 4.2

  A WordPress plugin called User Submitted Posts has a security flaw where user-supplied content isn't properly cleaned before being displayed on the website. This allows attackers to inject malicious code that gets stored and executed in the browsers of site visitors—but only if the site administrator has enabled a non-default display option. The attack requires user interaction (like clicking a link) and cannot affect the site's availability or steal passwords, but it can compromise user sessions or steal sensitive information visible to those users.

• CVE-2026-12453MEDIUM 4.2

  Google Chrome versions before 149.0.7827.155 contain a flaw where insufficient input validation allows an attacker who has already compromised the browser's renderer process to circumvent the same-origin policy through a specially crafted webpage. This means a sandboxed renderer could potentially access or modify data from websites it should not be able to reach, though the attacker must first gain control of the renderer itself—a significant prerequisite.

• CVE-2026-12456MEDIUM 4.2

  A vulnerability in how Google Chrome handles extensions before version 149.0.7827.155 allows a malicious extension to bypass the same-origin policy, which normally prevents web pages from accessing data belonging to other websites. An attacker would need to trick a user into installing a specially crafted malicious extension. If successful, the extension could read or modify sensitive information from other websites the user visits. This is a user-consent attack—the user must be socially engineered into installing the extension first.

• CVE-2026-12457MEDIUM 4.2

  Google Chrome versions prior to 149.0.7827.155 contain a flaw in how extensions are implemented that allows an attacker who has already compromised Chrome's renderer process to escape the site isolation sandbox and access content from different websites. Site isolation is Chrome's core defense that prevents malicious code running on one site from stealing data from another. This vulnerability requires the attacker to have already gained code execution in the renderer—a significant prerequisite—but if achieved, it undermines that critical isolation boundary.

• CVE-2026-12460MEDIUM 4.2

  Google Chrome versions prior to 149.0.7827.155 contain a weakness in how the browser enforces file system access policies. An attacker who has already compromised Chrome's renderer process (the part that executes web content) can exploit this flaw by serving a specially crafted PDF file to bypass Site Isolation—Chrome's security feature that isolates web content from different sites. The vulnerability requires both an existing renderer compromise and user interaction, limiting its standalone exploitability but reflecting a real protection gap once a renderer is already under attacker control.

• CVE-2026-13024MEDIUM 4.2

  Google Chrome versions prior to 149.0.7827.197 contain a flaw in how it validates user input during navigation operations. An attacker who has already compromised Chrome's renderer process—the component that interprets and displays web content—can exploit this weakness to bypass Chrome's site isolation security feature. Site isolation is a critical defense that prevents malicious websites from accessing data belonging to other sites. This vulnerability requires an attacker to have already gained control of the renderer process, making it a secondary attack that follows initial compromise.

• CVE-2026-13218MEDIUM 4.2

  KubeVirt's virt-handler component contains a symlink-following vulnerability in its network cache handling. When virt-handler writes cached network configuration files, it does not validate whether the target path is a symlink. An attacker with access to a virt-launcher container can plant a symlink at the expected cache file location, tricking virt-handler into overwriting an arbitrary file on the host system and changing its ownership. This is a local privilege escalation vector that requires container-level access to exploit but can impact the integrity of host system files.

• CVE-2026-13857MEDIUM 4.2

  A flaw in Google Chrome's geometry rendering engine allows an attacker to trick users into performing specific on-screen gestures—such as clicking or dragging in particular areas—which enables UI spoofing. By hosting a malicious HTML page, an attacker can make the browser display fake interface elements that appear legitimate, potentially deceiving users into taking unintended actions. The vulnerability requires user interaction and affects Chrome versions before 150.0.7871.47.

• CVE-2026-13860MEDIUM 4.2

  Google Chrome on Windows contains a flaw in its Autofill security user interface that allows an attacker to trick users into performing specific gestures on a malicious webpage, resulting in UI spoofing. The vulnerability requires user interaction and does not lead to information disclosure, but can allow an attacker to manipulate what appears on screen or degrade application availability. Chrome versions prior to 150.0.7871.47 on Windows are affected.

• CVE-2026-13895MEDIUM 4.2

  Google Chrome's autofill feature contained a flaw that could allow an attacker to trick users into performing specific actions on a malicious webpage, creating a false appearance of legitimate browser or website content. The vulnerability requires user interaction and is considered moderately severe. Google Chrome versions prior to 150.0.7871.47 are affected.

• CVE-2026-13905MEDIUM 4.2

  Google Chrome for iOS contains a race condition that could allow an attacker with physical access to an iOS device to read sensitive information from the browser's process memory. The vulnerability requires the attacker to be present at the device and involves timing-sensitive manipulation, making opportunistic exploitation difficult. This affects Chrome versions before 150.0.7871.47 on iOS.

• CVE-2026-13907MEDIUM 4.2

  Google Chrome on iOS contains a user interface spoofing vulnerability that could allow an attacker to deceive users into believing they are interacting with legitimate content when they are not. The vulnerability requires the attacker to convince a user to perform specific gestures on a crafted webpage, but does not require the user to have special privileges or for the attacker to have prior network access. Patches are available in Chrome 150.0.7871.47 and later.

• CVE-2026-13956MEDIUM 4.2

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the PageInfo security UI displays information to users. An attacker can craft a malicious HTML page that, when shown to a user alongside specific browser interactions, tricks the user into believing they're interacting with legitimate security information. The attacker must convince the user to perform certain UI gestures to make the spoofing work. The impact is limited to tampering with what the user sees on screen, not to stealing data or causing system crashes.

• CVE-2026-13957MEDIUM 4.2

  Google Chrome versions before 150.0.7871.47 contain a security UI flaw in its Extensions feature that allows attackers to execute unauthorized scripts or inject HTML content into web pages—a technique called Unsafe Cross-Site Scripting (UXSS). The attack requires two conditions: first, an attacker must trick a user into installing a malicious browser extension, and second, the user must visit a specially crafted webpage. Once those conditions are met, the attacker gains the ability to run arbitrary code within the browser's rendering context.

• CVE-2026-13973MEDIUM 4.2

  Google Chrome versions before 150.0.7871.47 contain a UI implementation flaw that allows attackers to display fake interface elements—like fake login prompts or warning dialogs—if they can trick users into specific mouse or keyboard interactions on a malicious website. The attacker cannot steal data directly, but can confuse users into revealing passwords or credentials by making the fake UI look legitimate.

• CVE-2026-13983MEDIUM 4.2

  A vulnerability in Chrome on iOS allows attackers to trick users into believing they are visiting a legitimate website by spoofing the Omnibox (the URL bar that displays the website address). An attacker would need to convince a user to perform specific UI gestures—such as particular taps or swipes—on a crafted webpage to trigger the spoofing. The attack does not grant access to sensitive data but can mislead users about which site they are actually visiting, potentially leading to credential theft or other social engineering attacks. This affects Chrome for iOS versions prior to 150.0.7871.47.

• CVE-2026-13986MEDIUM 4.2

  A flaw in Google Chrome's Media UI on ChromeOS allows an attacker to deceive users through visual spoofing. By crafting a malicious webpage and convincing a user to perform specific gestures (such as clicks or interactions with media controls), an attacker can make the browser display fake UI elements that trick the user into taking unintended actions. This is a user-interaction dependent vulnerability with limited scope—it doesn't enable direct system compromise but can facilitate phishing, credential theft, or social engineering attacks.

• CVE-2026-13992MEDIUM 4.2

  Google Chrome on macOS contains a UI implementation flaw that allows attackers to create convincing fake interface elements—a technique known as UI spoofing. An attacker would need to host a malicious webpage and convince a user to interact with specific interface elements in a particular way to trigger the vulnerability. The flaw affects Chrome versions prior to 150.0.7871.47 on macOS. While the attack requires user interaction and deliberate UI manipulation, it can lead to confusion about application state or permissions, potentially tricking users into unintended actions.

• CVE-2026-13993MEDIUM 4.2

  Google Chrome versions before 150.0.7871.47 contain a flaw in how it displays security warnings during Web App installation. An attacker can craft a malicious webpage that, when a user performs specific interactions (like clicking or gesturing in a particular way), tricks the browser into displaying a misleading security UI. This allows the attacker to spoof a domain—making it appear that a trusted site is actually the attacker's site—potentially deceiving users into entering credentials or trusting malicious content. The attack requires deliberate user interaction and doesn't directly compromise data or system availability, but it can deceive users about what website they're interacting with.

• CVE-2026-13997MEDIUM 4.2

  Google Chrome on Android contains a flaw in how it displays security warnings for browser extensions. An attacker can craft a malicious webpage that tricks users into performing certain taps or swipes, making the extension security UI appear different than it actually is. This deception (called UI spoofing) could lead users to install or interact with harmful extensions without realizing the danger. The vulnerability requires the attacker to convince a user to perform specific gestures, which makes it moderately difficult to exploit in the wild.

• CVE-2026-13998MEDIUM 4.2

  Google Chrome on macOS contains a flaw in how it displays security warnings when users interact with file input controls. An attacker could craft a deceptive web page that, when a user performs certain mouse or keyboard actions, disguises malicious activity as a legitimate system dialog. This allows the attacker to trick users into believing they are interacting with Chrome's genuine security interface rather than attacker-controlled content. The vulnerability requires user interaction and specific gestures to exploit, limiting its immediate risk but still representing a meaningful social engineering vector.

• CVE-2026-14026MEDIUM 4.2

  Google Chrome versions before 150.0.7871.47 contain a UI security flaw in the SplitView feature that allows an attacker to trick users into performing certain click or gesture actions on a specially crafted webpage. When exploited, the vulnerability enables UI spoofing—displaying false security indicators or interface elements that mislead the user about what is actually happening in the browser. This could be used in social engineering attacks where an attacker makes the browser appear to show something it isn't, such as a fake security warning or address bar state.

• CVE-2026-14028MEDIUM 4.2

  A flaw in Chrome for iOS versions before 150.0.7871.47 can be exploited to show users fake security or interface elements. An attacker would need to craft a malicious webpage and convince the user to perform specific touch gestures—such as tapping in particular ways—to trigger the spoofing. The vulnerability doesn't directly steal data or crash the browser, but it could deceive users into thinking they're interacting with legitimate Chrome UI when they're actually viewing attacker-controlled content.

• CVE-2026-14030MEDIUM 4.2

  A vulnerability in Google Chrome's SplitView feature on Linux allows an attacker to trick users into believing they are visiting a legitimate website by spoofing the address bar. This happens when a user performs certain UI interactions with a malicious webpage. The flaw affects Chrome versions before 150.0.7871.47 and requires user interaction to exploit, making it a limited but real risk to users who fall for social engineering.

• CVE-2026-14129MEDIUM 4.2

  Google Chrome on Android contains a flaw in how it displays the preview tab interface that allows an attacker to trick users into thinking they're interacting with legitimate content when they're actually looking at a spoofed version. An attacker would need to craft a malicious webpage and convince a user to perform specific touch gestures (like swiping or tapping in particular ways) to trigger the vulnerability. The impact is limited but real: users could be misled about what content they're viewing or interacting with.

• CVE-2026-14133MEDIUM 4.2

  A race condition in Google Chrome's history embeddings feature could allow an attacker to trick users into seeing fake browser UI elements through a specially crafted webpage. The vulnerability requires user interaction and is difficult to exploit reliably, but successful exploitation could lead to minor information disclosure or allow the attacker to manipulate what the user sees on screen. Chrome versions before 150.0.7871.47 are affected.

• CVE-2026-14137MEDIUM 4.2

  A vulnerability in Chrome for iOS allows attackers to trick users into performing specific gestures on a crafted webpage, resulting in fake UI elements appearing to come from Chrome itself. This 'UI spoofing' attack could mislead users about the source or nature of content they're interacting with, though the underlying browser functionality and user data remain protected. The attack requires user interaction and is rated Medium severity.

• CVE-2026-14138MEDIUM 4.2

  Google Chrome on Windows contains a UI spoofing vulnerability in its WebAppInstalls feature that could allow an attacker to deceive users through a specially crafted webpage. The vulnerability requires user interaction—specifically, deliberate UI gestures—to be exploited. While the underlying implementation flaw is considered low severity by Google, the CVSS scoring reflects the potential for integrity and availability impacts when successfully exploited.

• CVE-2026-14139MEDIUM 4.2

  Google Chrome versions prior to 150.0.7871.47 contain a UI spoofing vulnerability in the TabStrip component that could allow an attacker to deceive users through a malicious webpage. The attack requires the victim to perform specific user interface gestures—such as particular mouse or keyboard interactions—making it less likely to succeed in practice than attacks that trigger automatically. The vulnerability affects Chrome across Windows, macOS, and Linux systems.

• CVE-2026-14144MEDIUM 4.2

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser renders security-related UI elements in the Views framework. An attacker could craft a malicious webpage that, when viewed by a user who performs certain mouse or keyboard interactions, tricks the user into believing they are interacting with legitimate browser UI (like permission dialogs or address bar elements) when they are actually interacting with attacker-controlled content. This is a UI spoofing vulnerability that relies on convincing users to take specific actions on a specially crafted page.

• CVE-2026-14612MEDIUM 4.2

  FreeIPA's ipa-otpd daemon contains two off-by-one errors in its OAuth2 device authorization handler that can cause it to read or write one byte beyond the bounds of a fixed-size buffer. This flaw is triggered when processing oversized responses from an external OAuth2 or OIDC identity provider. An attacker would need to either control the identity provider or position themselves in the network path between FreeIPA and that provider to exploit this vulnerability. The primary risk is denial of service to the ipa-otpd daemon, though limited data integrity issues are also possible. Exploitation requires an actual user to initiate the OAuth2 device authorization flow, which adds a layer of practical constraint.

• CVE-2026-14896MEDIUM 4.2

  HashiCorp Nomad has an authorization flaw in its dynamic host volumes feature that allows an operator with volume deletion rights in one namespace to delete volume claims belonging to jobs in a different namespace. This cross-namespace bypass undermines the multi-tenant isolation model that Nomad administrators rely on to prevent unauthorized access across organizational boundaries. The vulnerability affects both community and enterprise editions across multiple versions.

• CVE-2026-2299MEDIUM 4.2

  The Mattermost Google Drive plugin contains an authorization bypass flaw that allows authenticated users to share files to private channels they shouldn't have access to and expose confidential channel membership details. The vulnerability exists in versions before 1.1.0 and requires an attacker to have valid Mattermost credentials and a connected Google account. While the impact is limited to information disclosure and minor integrity issues, it creates a pathway for insider threats or compromised accounts to leak sensitive organizational structure and collaboration details.

• CVE-2026-24315MEDIUM 4.2

  SAP Fiori Launchpad contains a URL-crafting vulnerability that allows attackers to trigger unauthorized service calls within the Fiori application domain. When a user clicks a malicious link, the attacker can potentially steal credentials or compromise the user's account. The attack requires the attacker to have detailed knowledge of the system and depends on user interaction—the vulnerability cannot be exploited remotely without a victim opening the malicious URL.

• CVE-2026-41839MEDIUM 4.2

  Spring Framework versions 5.3, 6.1, 6.2, and 7.0 contain a session management flaw in WebFlux applications. If an attacker first compromises a subdomain (through XSS or similar attack), they can trade a known session ID for one belonging to an authenticated user, potentially gaining unauthorized access to that user's account or data. The flaw requires two conditions: initial subdomain compromise and user interaction, which limits its immediate exploitability but remains a meaningful risk in multi-tenant or loosely-segmented environments.

• CVE-2026-41844MEDIUM 4.2

  CVE-2026-41844 is a redirect vulnerability in Spring Framework that allows attackers to craft malicious links causing users' browsers to redirect to arbitrary external websites. The flaw exists in Spring MVC and Spring WebFlux applications configured with a catch-all URL mapping ("/**") where the view name is not explicitly set. An attacker can exploit the 'redirect:' prefix to bypass intended routing controls and send users to phishing sites or other malicious hosts. This requires user interaction—the victim must click a crafted link—and impacts four widely-used versions of Spring Framework spanning multiple release series.

• CVE-2026-41854MEDIUM 4.2

  CVE-2026-41854 is a server-side request forgery (SSRF) vulnerability in Spring Framework caused by incorrect parsing of host names in URLs. When an application uses Spring's UriComponentsBuilder to process a URL provided by an external user, an attacker could craft a malicious URL that causes the application to make unintended requests to internal systems or services. The vulnerability affects Spring Framework versions 7.0.0 through 7.0.7 and 6.2.0 through 6.2.18. Exploitation requires user interaction and presents moderate risk.