By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 84 of 86

• CVE-2026-49370LOW 3.4

  JetBrains YouTrack versions before 2026.1.13162 contain an information disclosure vulnerability affecting the fetchApp request handler. An authenticated user with high privileges can trigger unintended data exposure through a request that includes user interaction, though the scope of disclosed information is limited. This is a low-severity issue that requires administrative or privileged account access to exploit.

• CVE-2026-49381LOW 3.4

  CVE-2026-49381 is a stored cross-site scripting (XSS) vulnerability in JetBrains TeamCity's SAML login page that existed prior to version 2026.1. An attacker with high privileges could inject malicious scripts into the login interface, which would then execute in the browsers of users who interact with that page. The vulnerability requires user interaction to trigger and has limited scope, affecting only the confidentiality of information visible to the victim during their session.

• CVE-2026-9062LOW 3.4

  The Store Locator WordPress plugin versions before 1.6.9 contain a path traversal vulnerability that allows site administrators to read sensitive files from the server, such as PHP configuration files containing database credentials and authentication keys. The vulnerability requires an authenticated administrator account to exploit, limiting its immediate risk to insider threats or compromised admin accounts.

• CVE-2025-15667LOW 3.3

  GPAC, a popular multimedia framework used for MP4 file processing, contains a double-free memory vulnerability in its MP4Box component. The flaw exists in the `gf_isom_nalu_sample_rewrite` function and can be triggered by manipulating a specific argument (`nalu_out_bs`). An attacker with local access can craft a malicious MP4 file that, when processed by GPAC, causes the application to free the same memory region twice, potentially crashing the process. The vulnerability has been publicly disclosed, and a patch is available.

• CVE-2025-15668LOW 3.3

  GPAC, an open-source multimedia framework widely used for MP4 processing and streaming, contains a heap-based buffer overflow vulnerability in its MP4Box component. The flaw resides in the sgpd_del_entry function, which fails to properly validate the data argument before using it in memory operations. An attacker with local access to a system running a vulnerable version of GPAC can trigger this overflow by providing malformed input to the MP4Box tool, potentially causing the application to crash or, in specific configurations, execute arbitrary code. A patch has been publicly released, and exploit code is known to exist in the wild.

• CVE-2025-48616LOW 3.3

  CVE-2025-48616 is a logic error in Android's KeyguardViewMediator that allows a local attacker with basic user privileges to bypass lockdown mode when screen pinning is active, potentially exposing sensitive information on the device. The vulnerability requires no user interaction and poses a localized risk to data confidentiality on affected Android devices.

• CVE-2025-62338LOW 3.3

  CVE-2025-62338 is a low-severity vulnerability in HCL BigFix Cloud Lifecycle Management caused by insufficient input validation. An authenticated local user can exploit this flaw to bypass security controls and access sensitive information they shouldn't have permission to view. The issue does not allow attackers to modify data or crash the system, only to read information they're not authorized to access.

• CVE-2026-0016LOW 3.3

  A permissions validation flaw in Android's credential management system allows a local attacker with limited user privileges to read sensitive information across other user accounts without special permissions or user interaction. The vulnerability resides in how the system handles credential provider updates when services are removed, creating a bypass that exposes data intended to be isolated between users.

• CVE-2026-0050LOW 3.3

  CVE-2026-0050 is a local information disclosure vulnerability in Android's Bluetooth adapter service. A malicious app with basic user-level permissions can bypass security checks in the handleBondStateChanged function to read sensitive Bluetooth-related information without requiring additional privileges or user interaction. The impact is limited to information disclosure; the attacker cannot modify data or crash the system.

• CVE-2026-0056LOW 3.3

  CVE-2026-0056 is a memory safety issue in Android's ResourceTypes.cpp component where an incorrect bounds check allows a local process to read data outside intended memory boundaries. This flaw exposes sensitive information resident in adjacent memory to any app with basic local access—no special permissions, elevated privileges, or user interaction required. The vulnerability is classified as low severity due to its limited scope and local-only nature.

• CVE-2026-0057LOW 3.3

  A permissions enforcement gap in Android's Contacts Provider allows local applications to view incoming call phone numbers and related metadata without explicit authorization. The issue requires local access to the device but no special privileges or user action during exploitation, making it a concern for applications that should be restricted from call monitoring data.

• CVE-2026-0134LOW 3.3

  A logic error in Android's factory reset process allows sensitive data to persist on the device after a reset completes. An attacker with local access to the device can read this leftover information without needing special privileges or user interaction. While the exposure is limited to local information disclosure, the issue is particularly concerning because factory reset is a key data-wiping mechanism users rely on before selling, donating, or recycling devices.

• CVE-2026-0142LOW 3.3

  CVE-2026-0142 is a local information disclosure vulnerability in Android's AVB (Android Verified Boot) RSA key parsing code. A local user can trigger an out-of-bounds memory read by supplying malformed key data, potentially exposing sensitive information from adjacent memory. The flaw requires only local access and user-level privileges—no special permissions or user interaction is required to exploit it.

• CVE-2026-0145LOW 3.3

  CVE-2026-0145 is a permission bypass vulnerability in Android's KeyMint component that allows a local attacker with basic user privileges to read sensitive information without needing to interact with the system or escalate their access level. The flaw stems from a logic error in how permissions are validated, creating an unintended pathway for unauthorized data access.

• CVE-2026-0158LOW 3.3

  A flaw in Android's Camera application allows a local user to view photos they shouldn't be able to access. The vulnerability stems from missing permission validation when accessing photo data. Since no special privileges or user interaction are required beyond initial device access, any app or user account on the device could potentially read private photos. The actual impact is limited to unauthorized photo disclosure—the vulnerability doesn't enable device compromise or broader system damage.

• CVE-2026-10197LOW 3.3

  Assimp, a widely-used open-source 3D model import library, contains a flaw in its glTF2 file handler that can cause the application to crash when processing maliciously crafted glTF2 files with embedded textures. An attacker with local file system access can trigger a null pointer dereference by supplying a crafted glTF2 file, leading to denial of service. The vulnerability affects versions up to and including 6.0.4. A fix exists in pending pull request form but has not yet been merged into a stable release.

• CVE-2026-10198LOW 3.3

  Assimp, a popular open-source 3D model import library, contains a flaw in its glTF file import handler that can cause the application to crash. The vulnerability stems from improper handling of certain glTF mesh data, leading to a null pointer dereference when the ImportMeshes function processes malformed or specially crafted files. An attacker with local access to a system running a vulnerable version of Assimp could trigger this crash, resulting in denial of service. The issue affects Assimp versions up to and including 6.0.4.

• CVE-2026-10199LOW 3.3

  Assimp, a popular 3D asset library, contains a null pointer dereference vulnerability in its glTF2 parsing code. An attacker with local access can craft a malicious glTF2 file that triggers a crash when processed, causing a denial of service. The vulnerability affects Assimp versions up to 6.0.4 and has been publicly disclosed, though it requires local interaction and low privileges to exploit.

• CVE-2026-10201LOW 3.3

  CVE-2026-10201 is a divide-by-zero flaw in Assimp (Asset Importer Library), a widely-used 3D model processing library. The defect exists in the UV Channel Handler component, specifically within the FBXExporter::WriteObjects function in FBXExporter.cpp. When a user with local access supplies specially crafted input, the vulnerability triggers a division-by-zero error that crashes the application. Because this is a local-only attack requiring user-level privileges and the impact is availability-focused (denial of service via crash), the risk is classified as low. However, the fact that proof-of-concept code has been publicly released means defenders should not assume this will remain a theoretical concern.

• CVE-2026-10233LOW 3.3

  Assimp, a popular open-source 3D model importing library, contains an out-of-bounds read vulnerability in its Half-Life 1 MDL file loader. When processing specially crafted MDL files, the vulnerability allows an attacker with local access to read memory outside intended boundaries. While the issue has been publicly disclosed, the impact is limited to information disclosure with no ability to modify or crash systems. This vulnerability requires local file system access and authenticated user privileges to trigger.

• CVE-2026-10267LOW 3.3

  A flaw in the Janet programming language (version 1.41.0 and earlier) allows a local user to read memory beyond intended boundaries in the debug frame handling code. The vulnerability requires local system access and valid user credentials to exploit, but poses a confidentiality risk by enabling unauthorized disclosure of sensitive data in memory.

• CVE-2026-10268LOW 3.3

  A vulnerability exists in Janet language versions up to 1.41.0 that allows an integer overflow when processing serialized fiber data. An attacker with local system access can exploit this condition to cause a denial of service by crashing the affected application. The vulnerability is not critical but represents a real risk in environments where untrusted users have local access to systems running vulnerable Janet versions.

• CVE-2026-10295LOW 3.3

  CVE-2026-10295 is a low-severity denial-of-service vulnerability in SourceCodester Customer Review App version 1.0. By manipulating the 'name' or 'comment' parameters in the review submission functions, an attacker with local access can crash or degrade the application's availability. While an exploit has been published, the attack surface is limited because local authentication is required—this is not a remote vulnerability that can be exploited from the internet.

• CVE-2026-10298LOW 3.3

  A null pointer dereference vulnerability exists in whisper.cpp versions up to 1.8.2, specifically in the model loading function. An attacker with local system access can trigger this flaw to cause the application to crash or become unavailable. The vulnerability requires user privileges to exploit and does not directly compromise data confidentiality or integrity. Public exploit code is available, though the impact remains limited to denial of service on the affected system.

• CVE-2026-10528LOW 3.3

  Orthanc DICOM Server versions up to 1.12.11 contain a stack-based buffer overflow vulnerability in the DCMTK parser component. The flaw exists in the DcmItem::read function and can be triggered through malicious DICOM file manipulation. An attacker with local system access can exploit this to cause a denial of service condition. The vulnerability has been publicly disclosed with working exploit code available.

• CVE-2026-10722LOW 3.3

  A local integer overflow vulnerability exists in Cilium eBPF's BTF (BPF Type Format) loading functionality. An attacker with local system access can manipulate offset parameters during eBPF collection loading, causing the application to miscalculate memory boundaries. While the impact is limited to denial of service on the affected system, the public disclosure means exploitation tools may become available. This is a localized threat requiring prior system access but warrants patching to maintain system stability.

• CVE-2026-11312LOW 3.3

  A flaw in ByteDance's InfiniStore library (versions up to 0.2.33) allows a local user to trigger inefficient algorithmic behavior in the key-value map purge function. An attacker with local access can manipulate input to the purge_kv_map routine, causing the function to consume excessive CPU or processing time. The vulnerability requires local system access and valid user privileges, limiting its scope, but public exploit code now exists.

• CVE-2026-11459LOW 3.3

  SecureAge CatchPulse versions up to 10.9.3 contain a vulnerability in the saappctl.sys driver that can leak sensitive information to authenticated local users. An attacker with a valid local account on the affected system can trigger the IOCTL handler to access data they shouldn't normally see. The vulnerability has been publicly disclosed and active exploitation is possible, though it requires legitimate access to the target machine.

• CVE-2026-11478LOW 3.3

  CVE-2026-11478 is a denial-of-service vulnerability in the kokke tiny-regex-c library that allows a local attacker to trigger inefficient regular expression processing through the matchstar function. An attacker with local access and basic privileges can craft a malicious regex pattern that causes excessive computation, potentially slowing or stalling applications that parse untrusted regex inputs. The severity is low because exploitation requires local execution and user-level permissions, but the published exploit code means the attack method is already in the wild.

• CVE-2026-11792LOW 3.3

  A memory corruption flaw exists in 389 Directory Server's audit logging feature. When audit logging is enabled and certain password storage conditions are met, the server can write more data than a buffer can hold, corrupting memory and producing garbled audit logs. The vulnerability requires non-standard configuration or a compromised replication partner to trigger, which limits real-world exposure.

• CVE-2026-12823LOW 3.3

  A permissions misconfiguration vulnerability has been discovered in Browserbase Skills (versions up to 20260526) affecting the Autobrowse Trace Artifact Handler component. The flaw results in incorrect default access controls that could allow a local user to read sensitive information. This is a low-severity issue requiring local system access to exploit, and while proof-of-concept code has been publicly released, the practical risk remains limited due to its local-only attack vector and information-disclosure nature.

• CVE-2026-13523LOW 3.3

  GPAC versions up to 26.02.0 contain a flaw in how the ISOBMFF (ISO Base Media File Format) parser handles compressed data during file processing. An attacker with local access to a system running GPAC can craft a malicious media file that triggers excessive data decompression, potentially causing the application to become unavailable or consume excessive system resources. The vulnerability requires direct access to the affected system and local execution context, which significantly limits its real-world attack surface.

• CVE-2026-13573LOW 3.3

  A stack-based buffer overflow vulnerability has been reported in LLVM's StringMap insertion function within the ValueSymbolTable module. The issue affects LLVM versions up to 22.1.6 and requires local access to exploit. Notably, the LLVM project has stated this behavior falls outside their documented security scope and is not considered a security vulnerability by the maintainers. Exploit code has been publicly disclosed, though verification of the vulnerability's actual exploitability remains uncertain.

• CVE-2026-13574LOW 3.3

  CVE-2026-13574 affects LLVM versions up to 22.1.6 and involves a heap-based buffer overflow in the bitcode file handler component. A local attacker with user-level privileges could trigger a denial of service condition by manipulating the GCRelocateInst::getBasePtr function. Notably, the LLVM project has disputed the security classification of this issue, stating that the reported behavior falls outside its documented security scope. Despite public disclosure, exploitation requires local access and does not compromise confidentiality or integrity.

• CVE-2026-13942LOW 3.3

  A vulnerability in Google Chrome's video capture implementation on ChromeOS allows a local attacker to create fake UI elements through a specially crafted web page. The attacker must already have local access to the device and the user must interact with the malicious page, but the attack only affects the visual presentation of the interface—it cannot steal data or crash the system.

• CVE-2026-13955LOW 3.3

  Google Chrome on Android contains a UI spoofing vulnerability in its CustomTabs feature that could allow a local attacker to deceive users by manipulating the app's visual appearance. The vulnerability stems from insufficient validation when processing untrusted input from malicious files. An attacker would need local access to the device and user interaction (such as opening a file) to exploit it. The attack surface is limited because it requires both proximity and user action, and the impact is restricted to visual deception rather than data theft or system compromise.

• CVE-2026-14650LOW 3.3

  A denial-of-service vulnerability has been identified in connorskees grass, a Sass compiler, affecting versions up to 0.13.4. The flaw exists in the UTF-8 character handling component and can be triggered through a local attack to cause the compiler to hang or consume excessive resources. While an exploit has been published, the practical impact is limited because the vulnerability requires local code execution and aligns with inherent design characteristics of Sass compilation where exponential behavior is expected and acceptable.

• CVE-2026-14651LOW 3.3

  A denial of service vulnerability exists in the grass Sass compiler (versions up to 0.13.4) affecting the selector extension functionality. An attacker with local access can craft malicious Sass input that causes excessive compilation time, potentially consuming system resources. The vendor has clarified that the vulnerability description conflates expected algorithmic behavior with an actual flaw—the @extend mechanism is inherently exponential by design, and DoS conditions via recursive constructs are a known characteristic of Sass compilers rather than a security defect.

• CVE-2026-14683LOW 3.3

  HdrHistogram, a popular latency histogram library, contains a vulnerability in how it processes compressed binary data. An attacker with local access could supply specially crafted compressed data that causes the application to allocate excessive memory, potentially leading to a denial of service. The vulnerability exists in versions up to 2.2.2 and requires local system access to exploit. The security community remains divided on whether this truly constitutes a security boundary crossing, given the prerequisites involved.

• CVE-2026-14684LOW 3.3

  HdrHistogram, a Java library used for recording and analyzing latency distributions, contains a flaw in how it decodes serialized histogram data from byte buffers. When processing the numberOfSignificantValueDigits parameter during deserialization, the library can allocate excessive memory without proper bounds checking. This is a local-only vulnerability—an attacker must already have access to run code on the affected system. While proof-of-concept code has been published, the security community disputes whether this crosses a meaningful security boundary, since the preconditions for exploitation are restrictive.

• CVE-2026-14685LOW 3.3

  HdrHistogram, a latency histogram library, contains a vulnerability in its AbstractHistogram component where the recordValueWithCount method improperly handles the Count argument, leading to state corruption. The flaw is local-only, requires authenticated user privileges, and has been publicly disclosed. Importantly, the security community disputes whether this crosses meaningful security boundaries, given the prerequisites needed for exploitation.

• CVE-2026-14686LOW 3.3

  HdrHistogram, a Java library for recording and analyzing latency distributions, contains a flaw in its range-checking logic for the DoubleHistogram component. When recording values, the library performs an incorrect comparison that could allow a local user to bypass validation checks. The vulnerability requires local system access and has limited security impact, as it does not enable data exfiltration or system unavailability—only the integrity of recorded histogram data could be affected. The security community has disputed whether this truly crosses a meaningful security boundary, and exploit details are now public.

• CVE-2026-14699LOW 3.3

  CVE-2026-14699 is a local symlink-following vulnerability in markdownify-mcp, a Markdown conversion tool. An attacker with local access and low-level privileges can manipulate file paths to cause the application to follow symbolic links, potentially reading files outside the intended directory. The risk is contained because exploitation requires direct local access and low-privilege user status.

• CVE-2026-14758LOW 3.3

  A bug in radare2 (an open-source reverse-engineering framework) allows a local user with basic privileges to trigger an integer overflow when the hexpairs parser processes specially crafted input in the opcode analysis command. This causes the application to crash. An attacker would need direct access to a system running radare2 and the ability to execute commands locally.

• CVE-2026-14759LOW 3.3

  A heap-based buffer overflow vulnerability exists in radare2, a popular reverse-engineering framework, affecting versions up to 6.1.6. The flaw is in the Java class file parser's line number table handler and can be triggered through a specially crafted Java binary. An attacker with local system access can exploit this to crash the application or potentially execute code. Public exploit code is available, elevating operational risk for users who process untrusted Java artifacts.

• CVE-2026-14760LOW 3.3

  A use-after-free vulnerability has been discovered in radare2, a popular reverse-engineering framework. The flaw exists in the regprofile handler component and can be triggered by local attackers with low privileges, leading to an application crash or potential memory corruption. While a patch has been released, the vulnerability is not currently listed as exploited in the wild by known ransomware groups or government-backed actors.

• CVE-2026-14761LOW 3.3

  A flaw in radare2's string handling functions (r_str_ndup and r_str_append) allows an attacker with local access to cause the application to crash by triggering an integer overflow. The vulnerability affects radare2 up to version 6.1.6. While an exploit has been publicly disclosed, the impact is limited to denial of service—no data theft or privilege escalation is possible from this flaw alone.

• CVE-2026-14786LOW 3.3

  A flaw in radare2, a popular reverse engineering framework, allows an authenticated local attacker to trigger an integer overflow through the string handling function. While the vulnerability requires local access and legitimate user privileges, the public release of exploit code means the risk of opportunistic abuse increases. The impact is denial of service—the affected process can crash—but not data theft or privilege escalation.

• CVE-2026-14787LOW 3.3

  Radare2, a popular open-source reverse-engineering framework, contains an integer overflow vulnerability in its print command handler that can be triggered by a local user. The flaw affects versions up to 6.1.6 and can cause the application to crash or become unstable. While a public exploit exists, the attack requires local system access and does not enable privilege escalation or data theft. The vendor has released a patch that should be applied to restore stability.

• CVE-2026-14788LOW 3.3

  A use-after-free vulnerability exists in Radare2, a widely-used reverse engineering and binary analysis framework. The flaw is located in the binary loading function and can be triggered by a local attacker with basic user privileges. While the vulnerability has been publicly disclosed, its low severity rating reflects limited direct impact—the primary consequence is denial of service through application crash. Organizations using Radare2 in production or security workflows should apply the available patch, particularly if the tool processes untrusted binaries.

• CVE-2026-14789LOW 3.3

  A stack-based buffer overflow vulnerability exists in radare2's Memory64ListStream Parser component, which processes memory dump files. An attacker with local access can manipulate a specially crafted input file to trigger a buffer overflow, potentially causing the application to crash. This is a localized denial-of-service issue affecting radare2 versions up to 6.1.6.

• CVE-2026-14790LOW 3.3

  A null pointer dereference vulnerability exists in GPAC 26.02.0's NHML file writing component. An attacker with local system access can trigger this flaw by manipulating input to the nhmldump_send_frame function, causing the application to crash. The vulnerability has limited scope—it only affects availability on the local machine and requires authenticated access. While an exploit has been published, the overall risk is low due to the access requirements and lack of remote exploitability.

• CVE-2026-14801LOW 3.3

  A divide-by-zero flaw exists in GPAC's TeXML file handler that can crash the application when processing specially crafted text files. The vulnerability requires local access and a user with at least limited system privileges to trigger; it causes a denial of service but does not leak data or allow code execution. The issue affects GPAC version 26.03-DEV-rev342-g80071f700-master and is remediated by applying the identified patch commit.

• CVE-2026-15115LOW 3.3

  A vulnerability in Google Chrome on Android allows a local attacker to bypass the same-origin policy—a core browser security feature that prevents websites from accessing data from other origins—through a specially crafted HTML page. The issue stems from insufficient validation of user-supplied input in the WebAppInstalls component. An attacker with local access to the device would need to trick a user into visiting a malicious webpage to exploit this. The vulnerability was patched in Chrome version 150.0.7871.115.

• CVE-2026-15184LOW 3.3

  GNU LibreDWG versions up to 0.13.4 contain a flaw in how the DWG file handler processes certain file structures. When a specially crafted DWG file is opened, the software can crash due to a null pointer dereference. An attacker with local access to a system could exploit this to cause a denial of service. The issue requires user interaction—specifically opening a malicious file—and affects only the availability of the application, not data confidentiality or integrity. Version 0.14 and later resolve this issue.

• CVE-2026-15185LOW 3.3

  GPAC version 26.03-DEV contains a flaw in how it processes subtitle index files (vobsub format) through its MP4Box tool. An attacker with local access can manipulate specific data in these files to trigger the software to read beyond allocated memory boundaries. This out-of-bounds read could crash the application or potentially leak sensitive data from memory. The vulnerability is of low severity due to its local-only nature and limited impact surface, though the public disclosure means exploit code may be available.

• CVE-2026-15194LOW 3.3

  Open5GS version 2.7.7 contains a use-after-free vulnerability in the AMF (Access and Mobility Management Function) component's context cleanup routine. An authenticated local attacker can trigger this flaw by manipulating the amf_context_final function, potentially leading to information disclosure. While the vulnerability requires local access and low privileges, public exploit code now exists, increasing practical risk despite the low CVSS rating.

• CVE-2026-15274LOW 3.3

  CVE-2026-15274 is a low-severity denial-of-service vulnerability in fbxcel, a Rust library for parsing FBX (Autodesk FBX) files. The flaw exists in the Node Header Handler component of the pull parser and can be triggered by a local attacker to crash or hang the application. The vulnerability affects fbxcel versions up to 0.9.0, and a fix is pending in the development repository but has not yet been released to the public.

• CVE-2026-15276LOW 3.3

  Symphonia, a popular audio processing library, contains a flaw in how it handles metadata that can cause the application to become unresponsive or crash. The issue is local only, meaning an attacker must already have access to the system running the software. A patch is being prepared but has not yet been officially released. The overall risk is low because of these constraints, but you should still monitor for the fix if your organization uses this library.

• CVE-2026-21027LOW 3.3

  CVE-2026-21027 is a low-severity vulnerability in Samsung's ImsSettings application that allows a local attacker with existing device access to trigger logging functions through improperly exported application components. The attack requires the attacker to already have user-level privileges on the device and does not enable data theft or system takeover—the primary risk is integrity impact through manipulation of logging behavior.

• CVE-2026-21034LOW 3.3

  Samsung Auto versions prior to 3.1.2.61 (Android 15) and 3.2.0.38 (Android 16) contain a flaw that improperly exposes application components. A local attacker with user-level access can exploit this exposure to modify audio settings without user consent. The vulnerability is rated LOW severity and does not affect confidentiality or system availability, only the integrity of audio configuration.

• CVE-2026-28586LOW 3.3

  CVE-2026-28586 is a local information disclosure vulnerability in Android's AppOpsService that allows an already-authenticated user to bypass permission checks and read sensitive data they shouldn't have access to. The flaw requires the attacker to already have a local account on the device; there's no way to exploit it remotely. The exposure is classified as low-severity because the data leaked is limited and no system functions are disrupted.

• CVE-2026-34049LOW 3.3

  Coolify, an open-source server and application management tool, contains a command injection vulnerability in its MongoDB backup feature. Versions 4.0.0-beta.451 through 4.0.0-beta.470 fail to properly sanitize collection names before passing them to shell commands, allowing an authenticated attacker with backup configuration privileges to inject arbitrary commands. The vulnerability requires high-level access and uncommon circumstances to exploit, but could allow a malicious administrator or compromised high-privilege account to execute code on the Coolify host.

• CVE-2026-34149LOW 3.3

  Coolify, an open-source self-hosted platform for managing servers and databases, contains a command injection vulnerability in its backup functionality. When authenticated users with database management permissions configure backup jobs, credentials and collection names they enter are inserted directly into shell commands without proper escaping. An attacker with those permissions could craft malicious input to execute arbitrary commands on the servers Coolify manages. This affects versions prior to 4.0.0-beta.471.

• CVE-2026-41434LOW 3.3

  OP-TEE, a security-focused runtime environment for Arm processors, contains a flaw in its PKCS#11 trusted application that can be triggered by a local attacker with basic privileges. When exploited, the vulnerability causes the PKCS#11 component to enter an infinite recursive loop, crashing that trusted application. The issue affects versions 3.10.0 through 4.10.x; version 4.11.0 and later include the fix.

• CVE-2026-41579LOW 3.3

  runc, the container runtime tool used by Docker and other container platforms, contains a vulnerability in how it sets up container filesystems. A malicious container image can exploit this by making /dev a symlink, causing runc to delete or create files in unexpected locations on the host system. Docker users are protected because Docker adds a read-only layer that blocks this attack, but other container tools built on runc may remain vulnerable if they don't have similar protections. The issue affects versions before 1.3.6, 1.4.3, and 1.5.0.

• CVE-2026-42201LOW 3.3

  Coolify, a self-hosted platform for managing servers and applications, contains a command injection vulnerability in how it handles database credentials. When administrators configure database connections (Redis, KeyDB, Dragonfly, ClickHouse, PostgreSQL, MySQL), the credential values they enter are inserted directly into Docker Compose configuration files without any safety checks. An attacker with administrative access could exploit this by injecting shell metacharacters into credential fields to execute arbitrary commands on the host system. The vulnerability affects all versions prior to 4.0.0-beta.474.

• CVE-2026-45277LOW 3.3

  Nextcloud's approval workflow feature contains an information disclosure flaw that allows authenticated users to determine whether arbitrary files are connected to specific approval processes. An attacker with valid credentials can probe the system to learn if particular files have approval workflows attached, potentially revealing organizational file structures and approval dependencies that should remain confidential. The issue affects versions prior to 2.7.2 and does not require user interaction to exploit.

• CVE-2026-45278LOW 3.3

  Nextcloud's user OIDC (OpenID Connect) module contains an open redirect vulnerability that allows attackers to craft malicious login links. When users click these links to authenticate via OIDC, they are redirected to attacker-controlled websites after logging in. This affects Nextcloud versions 6.1.0 through 8.2.1. The vulnerability has a low CVSS score because it requires user interaction and does not directly compromise confidentiality or availability.

• CVE-2026-45324LOW 3.3

  Rizin, a reverse engineering framework used for binary analysis and code inspection, contains a double free vulnerability in its search functionality. This occurs when the same memory location is freed twice, potentially causing application crashes or unexpected behavior. The vulnerability requires physical access to the system and user interaction to trigger, making it a lower-risk issue in most operational environments.

• CVE-2026-45455LOW 3.3

  A flaw in Microsoft Office Excel can allow an attacker to read memory that shouldn't be accessible, potentially exposing sensitive information on a local system. The vulnerability requires user interaction—someone must open a specially crafted Excel file—but once triggered, it could leak data like file contents or system details. This is a low-severity issue with no direct impact on system availability or file integrity.

• CVE-2026-45459LOW 3.3

  Microsoft Excel has a flaw that allows someone with local access to bypass a built-in security protection mechanism. An attacker would need to trick a user into opening a specially crafted Excel file on their machine. The vulnerability exposes some information (such as file contents or formulas) but cannot be used to modify data or crash the application. This is a low-risk issue with limited real-world impact.

• CVE-2026-45466LOW 3.3

  A flaw in Microsoft Office Word allows an attacker to trigger a heap-based buffer overflow by crafting a malicious document. When a user opens the document, sensitive information stored in the application's memory could be read by the attacker. This is a local attack—the attacker cannot exploit it remotely—and it requires user interaction to open the malicious file. The confidentiality risk is limited; no system damage or data modification occurs.

• CVE-2026-45485LOW 3.3

  Microsoft Office contains a flaw that allows an attacker to read data from memory locations outside the intended bounds, potentially exposing sensitive information stored locally on a user's machine. The vulnerability requires local system access and user interaction (such as opening a malicious document), but does not allow the attacker to modify or delete data or crash the application. This is classified as a low-risk issue because it requires presence on the affected system and a user action to trigger exposure.

• CVE-2026-45613LOW 3.3

  Rizin, a reverse engineering framework used by security researchers and analysts, contains a heap buffer overflow vulnerability in its OMF (Object Module Format) file parsing code. An attacker could craft a malicious OMF binary file that, when opened by a user in Rizin, could read small amounts of sensitive data from the program's memory. This requires local access and user interaction—the user must deliberately open a malicious file.

• CVE-2026-47327LOW 3.3

  CVE-2026-47327 is a denial-of-service vulnerability in Ubuntu Linux affecting versions 6.8, 6.17, and 7.0. A NULL pointer dereference in the AppArmor notification handling code allows any unprivileged local user to crash the kernel without authentication or special permissions. The attack requires only local system access and can be triggered with a single action, causing a kernel oops that disrupts availability but does not compromise confidentiality or integrity.

• CVE-2026-47329LOW 3.3

  Ubuntu Linux versions 6.8, 6.17, and 7.0 contain a flaw in SAUCE patches that handle AppArmor security notifications. The vulnerability stems from improper validation of the name field size in these notifications. An unprivileged local user can exploit this by sending crafted AppArmor responses that bypass validation checks, potentially leading to unexpected behavior in the kernel's handling of these security-related messages. This is a local-only issue with low severity impact.

• CVE-2026-47330LOW 3.3

  CVE-2026-47330 is a local privilege escalation and cache poisoning vulnerability affecting Ubuntu Linux systems with AppArmor SAUCE patches. An unprivileged user can trigger uninitialized variable handling in AppArmor's notification code, causing incorrect caching of security policy responses. While the CVSS score is low (3.3), the issue undermines AppArmor's integrity by allowing cache corruption that could affect subsequent policy enforcement decisions.

• CVE-2026-47336LOW 3.3

  Ubuntu Linux 6.8 has a bug in its AppArmor security module that could allow an unprivileged local user to bypass or weaken network socket access controls. The issue stems from an uninitialized variable in the code that mediates AF_INET and AF_INET6 (IPv4 and IPv6) socket access. While the vulnerability requires local access and does not enable data theft or system crashes, it undermines the purpose of AppArmor's fine-grained network policy enforcement, potentially allowing a local user to perform network operations that should have been restricted.

• CVE-2026-47337LOW 3.3

  A NULL pointer dereference flaw in Ubuntu Linux kernel versions 6.8, 6.17, and 7.0 can be triggered by any unprivileged local user to crash the kernel. The vulnerability exists in socket mediation code that handles both IPv4 and IPv6 traffic. While the flaw itself does not enable data theft or system compromise, it can be exploited to cause a denial of service by forcing a kernel panic, disrupting availability for all users on the affected system.

• CVE-2026-47712LOW 3.3

  Dulwich, a Python library for working with Git repositories, has a path-traversal vulnerability in how it generates patch file names. When creating patch files from Git commits, the library previously used the commit's subject line to create the filename without properly sanitizing it. An attacker could craft a malicious commit with special characters (like slashes, backslashes, or double-dots) in the subject line to trick the library into writing patch files outside the intended directory. This could allow unauthorized file creation in unexpected locations on a system using Dulwich to process untrusted commits.

• CVE-2026-48156LOW 3.3

  pypdf, a popular open-source Python library for PDF handling, contains a vulnerability that allows an attacker to craft malicious PDF files that cause the library to consume excessive processing time during parsing. The issue stems from how pypdf processes cross-reference streams—a mechanism PDFs use to index internal objects—when they contain specific structural patterns. An attacker would need to trick a user or application into opening a specially crafted PDF, but once opened, the library can hang or freeze during PDF processing, resulting in a denial-of-service condition on that system.

• CVE-2026-48935LOW 3.3

  Node.js has a permission model that allows administrators to restrict file system access using flags like `--allow-fs-read` to declare read-only paths. A flaw in how this Permission API enforces those restrictions lets a local user with low privileges modify file metadata—such as permissions, timestamps, and ownership—on paths that should be read-only. This bypasses the intended security boundary and could allow an unprivileged process to alter files it should not be able to touch.

• CVE-2026-48936LOW 3.3

  Node.js 26 contains a weakness in its Permission API that allows a local attacker to start a server using a Unix domain socket even when the `--allow-net` permission flag has not been granted. This bypasses the intended access control mechanism, potentially allowing unauthorized network binding on the local system. The vulnerability requires local access and is limited in scope—it does not expose confidentiality or availability, but it does undermine the integrity of the permission model by enabling unintended network operations.

• CVE-2026-49383LOW 3.3

  CVE-2026-49383 is a low-severity vulnerability in JetBrains IntelliJ IDEA's UI Designer form parser that could allow local attackers to read sensitive information from a user's system. The vulnerability requires user interaction—specifically opening a malicious or compromised form file in the IDE—and affects versions prior to 2026.1. The exposure is limited to information disclosure; the vulnerability does not enable code execution or system modification.

• CVE-2026-49460LOW 3.3

  pypdf, a widely-used open-source Python library for PDF processing, contains a vulnerability in versions prior to 6.12.2 that allows an attacker to craft a malicious PDF file causing the library to consume excessive CPU resources and run for an unusually long time. The attack specifically targets PDFs that use compressed streams with a FlateDecode filter and PNG predictors. While this does not result in data theft or corruption, it can degrade application performance or be used in denial-of-service scenarios where PDF processing is part of a critical workflow.

• CVE-2026-49497LOW 3.3

  Ghidra, the NSA's reverse-engineering framework, contains a path traversal flaw in its debug symbol handler. When you open a malicious ELF binary, Ghidra automatically tries to load debugging information referenced in the binary's .gnu_debuglink section. An attacker can craft that section with path traversal sequences (like "../") to trick Ghidra into checking whether arbitrary files exist on your system and leaking their CRC32 checksums. This is a local attack—the attacker needs you to open a malicious file—but it can reveal information about your system's filesystem structure and contents.

• CVE-2026-56085LOW 3.3

  Dell PowerProtect Data Domain contains a vulnerability in how it initializes system resources. An attacker with local access and basic user privileges can read sensitive information from memory that should have been cleared. This is a localized information disclosure issue with limited scope—the attacker cannot modify data or crash the system.

• CVE-2026-56361LOW 3.3

  ImageMagick versions before 7.1.2-19 contain a subtle off-by-one error in how they validate morphology parameters. This flaw allows attackers to read data from a single memory location just outside the intended buffer boundary. An attacker would need to craft a malicious image or morphology parameter and have a local user open it, potentially leaking a small amount of sensitive information from memory.

• CVE-2026-56362LOW 3.3

  ImageMagick versions before 7.1.2-15 contain a heap buffer overflow vulnerability that occurs when the image processing library reads from memory it hasn't properly allocated. The flaw stems from a sequence of operations where metadata is updated before the pixel cache memory is fully initialized, creating a window where out-of-bounds reads can occur. An attacker with administrative privileges can manipulate memory or disk allocation to trigger this condition, potentially exposing sensitive data from adjacent memory regions.

• CVE-2026-56363LOW 3.3

  ImageMagick versions prior to 7.1.2-22 contain a vulnerability in how they process binomial kernel values used in image filtering operations. When an attacker supplies an unusually large binomial kernel value, the application performs an integer overflow that leads to division by zero, crashing the ImageMagick process. This is a local denial-of-service condition—the attacker needs local access and user interaction to trigger the crash, but the impact is straightforward: service disruption rather than data theft or system compromise.

• CVE-2026-56366LOW 3.3

  ImageMagick versions before 7.1.2-18 have a memory leak flaw in how they process certain image metadata. When an attacker sends a specially crafted APP1JPEG image file, ImageMagick fails to properly release memory, causing it to consume increasing amounts of system resources until the application crashes or becomes unresponsive. This is a local denial-of-service issue that requires user interaction to trigger.

• CVE-2026-56370LOW 3.3

  ImageMagick versions prior to 7.1.2-19 contain a flaw in how they process connected-components image data. When a user or script provides specially crafted connected-components definitions—particularly those with invalid array indices—ImageMagick can attempt to access memory locations outside of allocated buffers. This out-of-bounds access can crash the application (denial of service) or, in certain conditions, potentially allow an attacker to execute arbitrary code. The vulnerability requires local access and user interaction to trigger, making it a lower-risk but still important issue for organizations that process untrusted image data or accept image uploads from external sources.

• CVE-2026-56374LOW 3.3

  ImageMagick versions before 7.1.2-19 have a memory safety bug in how they process FTXT image files. When an attacker crafts a specially designed FTXT file with malformed format data, ImageMagick fails to validate boundaries before reading from memory, potentially crashing the application or exposing data in memory. The vulnerability requires user interaction—someone must open or process the malicious file.

• CVE-2026-56377LOW 3.3

  ImageMagick versions before 7.1.2-24 contain a flaw in how they enforce security policies that govern file operations. An attacker with local access can exploit this weakness to create or truncate files that the security policy should have blocked, potentially allowing them to write data outside the intended sandbox boundaries in conversion services. This is a path traversal issue masked by an incomplete policy validation mechanism.

• CVE-2026-57588LOW 3.3

  A SQL injection flaw exists in Nessus that can be triggered when a privileged user imports a specially crafted scan result file. An attacker could design such a file to inject malicious SQL commands into the scan results database, potentially allowing unauthorized access to sensitive scan data. The vulnerability requires local file access and user interaction, limiting its immediate threat scope, though it could be valuable in targeted attacks against security teams.

• CVE-2026-58052LOW 3.3

  7-Zip for Windows has a flaw in how it handles specially crafted RAR5 archive files. When extracting such an archive, 7-Zip fails to properly maintain the 'Mark-of-the-Web' (MotW)—a security marker that Windows uses to warn users about potentially unsafe files downloaded from the internet. An attacker can exploit this by embedding malicious stream records in a RAR5 file that bypass 7-Zip's protection and allow the tool to extract content that appears safe to Windows, defeating SmartScreen warnings and potentially tricking users into running malware.

• CVE-2026-8662LOW 3.3

  A path traversal flaw exists in Rapid7 InsightConnect's Compression Plugin on Linux systems. An authenticated attacker can supply specially crafted filenames to the create_archive function that cause files to be written outside their intended directory. However, because the attacker cannot control the file contents—only the path—the damage is limited to corrupting legitimate files rather than injecting malicious data. Exploitation requires valid credentials, making this primarily a risk for insider threats or compromised service accounts.

• CVE-2026-46815LOW 3.2

  CVE-2026-46815 is a low-severity information disclosure flaw in Oracle VM VirtualBox 7.2.8 affecting the VMSVGA graphics device driver. A high-privilege user already logged into a system running VirtualBox can read a limited subset of VirtualBox data that should not be accessible to them. The vulnerability does not enable attackers to modify data, crash the application, or gain system-level control. Its scope extends beyond VirtualBox itself—successful exploitation could indirectly expose data relevant to other products running on or managed by the affected host.

• CVE-2026-46816LOW 3.2

  CVE-2026-46816 is a low-severity information disclosure vulnerability affecting Oracle VM VirtualBox 7.2.8. A high-privileged user already logged into the host system running VirtualBox can read a limited subset of data accessible to VirtualBox. The attack requires existing local access with administrative-level privileges and occurs through the VMSVGA device component. Because VirtualBox often runs on infrastructure managing multiple virtual machines, successful exploitation could expose sensitive data across guest systems, though the scope of readable data is restricted.