By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 85 of 86

• CVE-2026-46874LOW 3.2

  Oracle VM VirtualBox version 7.2.8 contains a privilege escalation vulnerability affecting the Core component. An attacker with high-level privileges and local access to the system running VirtualBox can read sensitive data that VirtualBox manages or processes. While the vulnerability itself resides in VirtualBox, successful exploitation could expose information relevant to other systems or virtual machines it hosts, expanding the security footprint beyond VirtualBox alone. The vulnerability requires the attacker to already have administrative or high-privilege access to the infrastructure, which significantly limits the practical attack surface in most environments.

• CVE-2026-46977LOW 3.2

  A vulnerability in Oracle VM VirtualBox's VMSVGA device component could allow a high-privileged user already logged into the host system to read a limited subset of sensitive data stored within VirtualBox. Version 7.2.8 is affected. The issue is classified as low-severity because successful exploitation requires administrative-level access to the infrastructure where VirtualBox runs, and the data exposure is partial rather than complete. The scope impacts extend beyond VirtualBox itself, meaning the unauthorized read could potentially affect other systems or data managed through the hypervisor.

• CVE-2026-49356LOW 3.2

  Babel, a widely used JavaScript compiler, contains a vulnerability that allows attackers to read arbitrary source map files from systems running the compiler. If an attacker can control the JavaScript code being compiled and see the compiler's output, they can craft malicious code containing a sourceMappingURL comment that tricks Babel into exposing source map files they know the path to. This is a low-severity issue because it requires multiple preconditions: the attacker must have input control, output visibility, and knowledge of the exact file path of the target source map.

• CVE-2024-42206LOW 3.1

  HCL iReflection contains third-party components that are vulnerable and outdated, creating a potential integrity risk within the web application. An authenticated user with low privileges could potentially exploit this condition, though the attack surface is constrained by difficult environmental conditions and limited authentication requirements.

• CVE-2025-52608LOW 3.1

  HCL iControl contains a cookie security misconfiguration that leaves session identifiers and authentication tokens vulnerable to interception and cross-site request forgery attacks. The vulnerability stems from the absence of the Secure and SameSite cookie attributes, combined with an overly permissive cookie path set to root. While the immediate risk is moderate, this configuration flaw can enable attackers to hijack user sessions or trick authenticated users into performing unintended actions.

• CVE-2025-52611LOW 3.1

  HCL iControl v4.0.0 contains a vulnerability where the application crashes and exposes internal error messages, including stack traces, when certain code paths are triggered. The underlying cause is a programming error where the application attempts to access a property (the 'dashboard key') from an object that hasn't been properly initialized or is missing entirely. While an attacker would need valid login credentials to trigger this issue, the exposure of stack trace information could help them understand the application's internal structure and identify further attack vectors.

• CVE-2025-62340LOW 3.1

  HCL iControl contains a session management weakness where user sessions are not automatically terminated after periods of inactivity. This means that if a user walks away from an authenticated session without logging out, an attacker with physical or network access could potentially interact with the application under that user's privileges. The vulnerability requires an attacker to have some level of access and be able to reach the application, limiting the immediate threat, but it does increase risk in shared or public-facing deployments.

• CVE-2026-10011LOW 3.1

  A flaw in Chrome's Skia graphics library could allow an attacker who has already compromised Chrome's renderer process to extract sensitive data from websites you visit. The attacker would need to serve you a specially crafted web page to perform the attack. While the underlying issue received a High severity rating from Chromium, the overall exploitability is limited because it requires both renderer compromise and user interaction, making it a low-risk vulnerability in practical terms.

• CVE-2026-10565LOW 3.1

  A race condition vulnerability has been discovered in Open5GS versions up to 2.7.6 that affects the NGAP Handover security mode processing function. The flaw allows an authenticated attacker to trigger a timing-dependent race condition that results in a denial-of-service condition. While a public exploit exists, successful exploitation requires specific conditions and careful timing, making real-world attacks difficult to execute reliably.

• CVE-2026-10654LOW 3.1

  A race condition in Zephyr's Bluetooth RFCOMM stack can cause a session to become permanently stuck when a local disconnect and an incoming peer disconnect happen at the same time. When this occurs, the session slot doesn't get released properly, preventing future Bluetooth connections with that peer. While the timing required to trigger this is difficult to achieve naturally, repeated occurrences could exhaust available RFCOMM session capacity and deny Bluetooth service to users. The vulnerability only affects availability; no data is leaked or corrupted.

• CVE-2026-10705LOW 3.1

  Dask, a Python library for parallel computing and distributed data processing, contains a resource exhaustion vulnerability in its HyperLogLog (approximate distinct count) functionality. An authenticated remote attacker can trigger excessive resource consumption through the nunique_approx function, potentially degrading system availability. The flaw requires significant attack complexity and specific preconditions, making real-world exploitation difficult despite being theoretically possible.

• CVE-2026-11240LOW 3.1

  CVE-2026-11240 is a low-severity input validation flaw in Google Chrome's Loader component that allows a remote attacker to bypass the browser's site isolation security feature, but only if they have already compromised the renderer process. Site isolation is Chrome's defense mechanism that runs each website in a separate process to prevent one compromised site from accessing data from another. An attacker would need to deliver a specially crafted HTML page to exploit this, making it a post-compromise risk rather than a direct remote code execution vector. The vulnerability affects Chrome versions prior to 149.0.7827.53.

• CVE-2026-11244LOW 3.1

  CVE-2026-11244 is a low-severity flaw in Google Chrome's WebAuthentication feature that allows inadequate validation of user-supplied input. An attacker with prior access to Chrome's renderer process—the component responsible for displaying web pages—could craft a malicious HTML page to circumvent the browser's same-origin policy, a fundamental security boundary that prevents scripts from one website accessing data from another. This is not a direct remote code execution and requires both renderer process compromise and user interaction to succeed.

• CVE-2026-11247LOW 3.1

  A flaw in Google Chrome's CustomTabs feature on Android allows an attacker to leak data across website boundaries through a specially crafted webpage. The vulnerability requires user interaction and is difficult to exploit, affecting Android devices running Chrome versions before 149.0.7827.53. While the risk is low, it represents a potential privacy leak in a widely used mobile browser component.

• CVE-2026-11251LOW 3.1

  A flaw in Chrome's password manager allows a sophisticated attacker to read stored password information if they can first compromise Chrome's renderer process through a malicious web page. The vulnerability requires multiple conditions to exploit: the attacker must already control the rendering engine, the user must interact with the page, and the attack surface is limited to sensitive credential disclosure. Chrome versions before 149.0.7827.53 are affected. This is not a zero-click issue and does not allow code execution or system-level access.

• CVE-2026-11464LOW 3.1

  JeecgBoot versions up to 3.9.2 contain a vulnerability in the User List Endpoint that allows authenticated users to disclose sensitive information by manipulating a salt parameter. An attacker with valid credentials can exploit this flaw to access restricted data, though doing so requires specific conditions and technical knowledge. A fix is planned for a future release.

• CVE-2026-11465LOW 3.1

  A logic flaw exists in songquanpeng one-api versions up to 0.6.11-preview.7 that affects the redemption code top-up functionality. An authenticated attacker with specific knowledge of the system could bypass or manipulate the business logic governing how redemption codes are processed, potentially allowing unauthorized credit issuance or redemption manipulation. The attack is complex to execute and requires an active user account, making widespread exploitation unlikely in typical deployments.

• CVE-2026-11502LOW 3.1

  JeecgBoot versions up to 3.9.2 contain an open redirect vulnerability in the third-party login flow. When users are directed to log in via OAuth providers like DingTalk or WeChat, an attacker can manipulate the state parameter to redirect victims to a malicious website after authentication. The attack requires social engineering—tricking a user into clicking a specially crafted login link—and only affects deployments that have enabled third-party login functionality.

• CVE-2026-11675LOW 3.1

  Google Chrome contained a memory reading vulnerability in its Skia graphics library that could allow an attacker to steal sensitive data from other websites. The attacker would first need to compromise Chrome's renderer process—the sandboxed component that handles web page rendering—and then trick a user into visiting a specially crafted webpage. If successful, the flaw could leak cross-origin data, meaning information from a different website than the one the user thought they were visiting. This vulnerability affects Chrome versions prior to 149.0.7827.103 across Windows, macOS, and Linux systems.

• CVE-2026-11684LOW 3.1

  A policy enforcement gap in Google Chrome's Network component allowed attackers who had already compromised Chrome's utility process to steal cross-origin data by serving a specially crafted HTML page. This is a post-compromise attack where the attacker has already gained some level of access to the browser process itself, then exploits this weakness to read data that should be isolated between different websites.

• CVE-2026-11686LOW 3.1

  A flaw in Google Chrome's Dawn graphics library on macOS allows an attacker who has already compromised the browser's renderer process to trick the system into leaking data from other websites. The vulnerability requires the attacker to already have control over the renderer and the user to interact with a malicious webpage, making it a limited but real risk in scenarios where renderer escapes are already being exploited.

• CVE-2026-11691LOW 3.1

  Google Chrome contained a flaw in its New Tab Page that could allow attackers who had already compromised Chrome's renderer process to steal data from websites across different origins. The vulnerability required an attacker to have already broken into the renderer—the sandboxed component that runs web content—and then trick a user into visiting a malicious HTML page. While the Chromium security team rated this High severity internally, the calculated CVSS score is Low (3.1) because the attack requires both prior renderer compromise and user interaction.

• CVE-2026-11880LOW 3.1

  Fluent Forms, a popular WordPress plugin for building forms and managing subscriptions, contains an authorization flaw in versions before 6.2.1. The plugin fails to verify that a logged-in user actually owns a subscription before processing cancellation requests. This means a low-privilege account holder could cancel subscriptions belonging to other users, potentially disrupting their services or causing account manipulation. The vulnerability requires an authenticated attacker—someone with a valid WordPress user account—making it a lower-risk issue than unauthenticated attacks.

• CVE-2026-12017LOW 3.1

  Google Chrome versions before 149.0.7827.115 contain a flaw in how browser extensions are implemented that could allow an attacker who has already compromised Chrome's rendering engine to escape site isolation—the security boundary that prevents malicious websites from accessing data belonging to other websites. The attacker would need to trick a user into viewing a specially crafted webpage, but the core vulnerability requires prior control of the renderer process, which significantly limits real-world attack scope.

• CVE-2026-12032LOW 3.1

  Google Chrome on Android versions prior to 149.0.7827.115 contain a flaw in how the browser handles password-related features that could allow an attacker to bypass site isolation protections. Site isolation is a critical Chrome security feature that prevents malicious websites from accessing data from other sites. To exploit this issue, an attacker would first need to compromise Chrome's rendering engine through another vulnerability, then use a specially crafted webpage to break site isolation. While this requires multiple attack prerequisites, the underlying flaw affects password handling and could expose cross-site data to compromised processes.

• CVE-2026-12458LOW 3.1

  Google Chrome versions before 149.0.7827.155 contain a flaw in how the browser handles password-related features that could allow an attacker to extract sensitive data from websites the user has visited. The vulnerability requires an attacker to trick a user into performing specific interactions—such as clicking or gesturing—on a malicious webpage. When exploited, it may leak information that should remain isolated between different websites, but only within the user's current browsing session. The severity is considered low because it demands active user participation and the exposed data scope is limited.

• CVE-2026-12566LOW 3.1

  CVE-2026-12566 is a vulnerability in bbot's docker_pull module where an attacker positioned between bbot and a Docker registry can intercept and modify the authentication redirect instructions sent by the registry. By tampering with the WWW-Authenticate response header, an attacker could trick bbot into sending authentication tokens to a malicious server under their control instead of the legitimate Docker registry, resulting in credential theft.

• CVE-2026-13483LOW 3.1

  A weakness has been identified in arc53 DocsGPT versions up to 0.18.0 that allows an authenticated attacker to tamper with stored credentials without the system detecting the manipulation. The flaw exists in the credential encryption component and requires moderate technical effort to exploit. While a proof-of-concept has been publicly disclosed, successful attacks depend on the attacker already having login access to the application. The development team has submitted a patch, though it has not yet been formally released.

• CVE-2026-13489LOW 3.1

  A synchronization flaw has been discovered in xiaozhi-esp32 versions up to 2.2.6, affecting the MCP Response Handler component. An authenticated attacker with network access could exploit this weakness to cause minor integrity issues, though the attack requires non-trivial technical skill and is not currently a widespread threat. The vulnerability carries a low CVSS score of 3.1 and is not yet tracked as actively exploited in the wild.

• CVE-2026-13493LOW 3.1

  A vulnerability has been identified in AIDC-AI ComfyUI-Copilot versions up to 2.0.28 that allows an authenticated attacker to improperly manipulate resource identifiers through the Workflow Checkpoint Restore Handler. The flaw resides in the conversation API backend and requires specific conditions to exploit, but an exploit has already been publicly disclosed. This is a low-severity issue affecting only authenticated users with legitimate access to the application.

• CVE-2026-13511LOW 3.1

  VoltAgent versions up to 2.1.17 contain an authorization bypass vulnerability in the Memory REST API. An authenticated attacker can manipulate the conversationId parameter to access memory records they should not have permission to view. The vulnerability requires an existing login and is difficult to exploit in practice, but proof-of-concept code has been released publicly. A patch is under review by the maintainers.

• CVE-2026-13939LOW 3.1

  A flaw in Google Chrome's WebShare feature on Android devices could allow an attacker who has already compromised the browser's rendering engine to trick users into thinking they are interacting with legitimate interface elements when they are actually seeing forged content. The vulnerability requires the attacker to have significant pre-existing access to the browser process and relies on user interaction, making it a limited-impact issue in practice.

• CVE-2026-13944LOW 3.1

  Google Chrome on macOS contains a flaw in how it handles data transfers that could allow an attacker to trick users into exposing information across website boundaries. The vulnerability requires the attacker to convince the user to perform specific interactions with a malicious webpage. This is a low-severity issue affecting Chrome versions before 150.0.7871.47 on Mac systems.

• CVE-2026-13945LOW 3.1

  This vulnerability affects Google Chrome on Linux systems and involves insufficient controls over how browser extensions are validated. An attacker could create a malicious extension that, once installed by a user, could perform UI spoofing—essentially creating fake interface elements that trick users into thinking they're interacting with legitimate Chrome features. The vulnerability requires user action (installing the extension) to be exploited, making it a social engineering vector rather than a direct technical flaw. Google has addressed this issue in Chrome version 150.0.7871.47 and later.

• CVE-2026-13948LOW 3.1

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how it enforces policies on browser extensions. An attacker could convince a user to install a malicious extension, then use that extension to create fake or spoofed user interface elements—making it appear as though the user is interacting with legitimate Chrome features when they are actually engaging with attacker-controlled content. This is a social engineering attack that relies on initial user action to install the extension.

• CVE-2026-13963LOW 3.1

  A vulnerability in Google Chrome's developer tools allows an attacker to trick users into revealing sensitive information from other websites through a specially crafted web page. The attack requires the user to perform specific interactions with Chrome's UI, such as clicking or dragging elements in a particular way. While the risk is considered low due to these interaction requirements and the limited scope of data exposure, organizations should still apply the patch to eliminate the attack surface.

• CVE-2026-13982LOW 3.1

  Google Chrome's password manager UI can be spoofed by attackers who have already compromised the browser's rendering engine. An attacker who gains control of the renderer process—the component responsible for displaying web content—can craft a malicious HTML page that mimics legitimate Chrome password UI elements, potentially deceiving users into revealing credentials or performing unintended actions. This requires prior compromise of the renderer, which is a significant prerequisite but still represents a real escalation risk once initial access is achieved.

• CVE-2026-14617LOW 3.1

  A case-sensitivity handling flaw exists in NousResearch's hermes-agent streaming reasoning component (versions up to 2026.4.30). The vulnerability allows a low-impact information disclosure when filtering streaming data, but requires both authentication and specific conditions to exploit. The vendor has elected not to patch this issue, determining the maintenance burden outweighs the security benefit given the limited attack surface and high complexity required to trigger it.

• CVE-2026-14621LOW 3.1

  A logic flaw in FederatedAI FATE's OSX Broker component can cause session data to be routed to the wrong recipient when certain queue parameters are manipulated. An authenticated attacker can exploit improper validation of the rollSiteSessionId, dstRole, and dstPartyId arguments to leak sensitive data between federated learning sessions. The vulnerability is difficult to exploit in practice and requires authenticated access, keeping real-world risk relatively contained.

• CVE-2026-14630LOW 3.1

  ForceInjection AI-fundermentals versions 2.0 and 3.0 contain a weakness in how the Memory Recall Handler component stores and retrieves conversation history. The system uses cryptographic hashing methods that fall short of current security standards, potentially allowing an authenticated attacker to bypass session ownership checks and access conversation data they should not be able to retrieve. The vulnerability requires valid user credentials and non-trivial technical effort to exploit, limiting its immediate threat to most deployments.

• CVE-2026-14742LOW 3.1

  LangGraph, a component of LangChain AI, contains a weakness in how it hashes cache keys within its Task Result Cache feature. Versions up to 1.2.4 use a weak hashing algorithm when processing cached task results, potentially allowing an authenticated attacker with network access to infer or predict cache contents. The vulnerability has low severity and requires significant technical effort to exploit, but the risk exists in environments where cache confidentiality is important and attackers have valid credentials.

• CVE-2026-14966LOW 3.1

  BBOT's unarchive module contains a symlink validation bypass in zip and 7z archives. The module is designed to reject archives containing symlinks before extraction, but it fails to detect symlinks when they are encoded with a DOS-attribute prefix before the Unix file mode—a format produced by legacy versions of p7zip. An attacker can craft such an archive and have it extracted during a scan (such as through file download operations), allowing a malicious symlink to be written to the extraction directory. The symlink itself is planted but its target is not accessed, limiting the immediate impact. The vulnerability only affects systems using legacy p7zip builds; current mainline 7-Zip is not vulnerable.

• CVE-2026-14967LOW 3.1

  A path traversal vulnerability in BBOT's GitHub workflows reconnaissance module allows an attacker to manipulate a crafted repository URL to write downloaded artifacts outside the intended output directory. The vulnerability exploits insufficient path sanitization—the module fails to resolve `..` sequences in file paths. However, the impact is constrained: writes are limited to two directory levels above the configured output folder, and the final destination is ultimately determined by the operator's own configuration settings, not attacker choice.

• CVE-2026-28378LOW 3.1

  A Grafana vulnerability allows an administrator in one organization to delete public dashboards belonging to a different organization. The issue stems from insufficient access controls on the dashboard deletion endpoint, which does not properly verify organizational boundaries. An authenticated org admin can exploit this by crafting requests with another organization's dashboard identifiers to remove their dashboards without authorization.

• CVE-2026-3176LOW 3.1

  GitLab Enterprise Edition versions 18.6 through 18.11.5, 19.0.0 through 19.0.2, and 19.1.0 contain a flaw that could allow an authenticated user with limited permissions to view project information they should not have access to. The vulnerability requires specific conditions to be triggered and is rated low-severity, but it does bypass intended authorization controls.

• CVE-2026-35193LOW 3.1

  Django's cache middleware has a flaw that can leak private user data. When Django caches web responses, it's supposed to mark cached data as private (via the `Vary` header) if a request included authentication credentials. In Django 5.2 before version 5.2.15 and 6.0 before version 6.0.6, this protection doesn't work correctly. An attacker can make an unauthenticated request to the same URL a logged-in user visited, and Django may serve the cached private response—revealing sensitive information that should have been protected. Older Django versions (5.0.x, 4.1.x, 3.2.x) haven't been formally evaluated but may have the same problem.

• CVE-2026-3553LOW 3.1

  GitLab Community Edition and Enterprise Edition contain an authorization flaw that allows authenticated users to view confidential issue details they should not have access to. The vulnerability affects versions 12.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1. An attacker must already have valid GitLab credentials to exploit it, and success depends on specific configuration or state conditions. While the exposure is limited to reading sensitive issue metadata rather than system compromise, it represents a meaningful confidentiality breach for organizations using affected versions.

• CVE-2026-40963LOW 3.1

  Apache Airflow's UI structure_data endpoint was leaking metadata about linked workflows (DAGs) to users who shouldn't see them. An authenticated user with permission to view one workflow could discover the names and dependency relationships of other workflows they weren't authorized to access. This is a read-only information disclosure—no data modification or system disruption occurs—but it can undermine team isolation in multi-tenant Airflow deployments where workflow topology is considered sensitive.

• CVE-2026-42145LOW 3.1

  Coolify, a self-hosted server and application management platform, contains a vulnerability in its database backup upload feature that allows authenticated users to upload files without proper validation. An attacker with valid credentials could upload oversized or malicious files to disrupt service availability. The flaw affects all versions before 4.0.0-beta.474 and requires user authentication, limiting the immediate threat surface but remaining a denial-of-service risk in environments where insider risk or credential compromise is a concern.

• CVE-2026-42172LOW 3.1

  Coolify is a self-hosted platform for managing servers, applications, and databases. Prior to version 4.0.0-beta.474, API tokens used by Coolify (specifically Sanctum tokens, which handle API authentication) did not automatically expire. This meant that if an attacker obtained a valid token—through a leaked credential, compromised backup, or other disclosure—that token would continue working indefinitely. An administrator would need to manually revoke the token in Coolify's settings to stop access. The vulnerability has been patched in 4.0.0-beta.474 and later.

• CVE-2026-45426LOW 3.1

  Apache Airflow's log server uses a flawed string-matching approach to authorize workers' access to task logs. Instead of checking if a worker's JWT token matches a specific Dag name exactly, the system strips characters from the left side of requested Dag names in a way that can match multiple unintended Dags. An authenticated worker with a token for 'dag_a' could read logs from 'dag_attacker', 'aaaa_target', or '_dag_secret'—any Dag whose name starts with characters found in 'dag_a'. This breaks the intended per-Dag log isolation in multi-team environments.

• CVE-2026-45739LOW 3.1

  Strawberry GraphQL, a popular library for building GraphQL APIs, has a flaw in its bundled GraphiQL interface (versions 0.288.4 through 0.315.3) where sensitive headers entered by developers are inadvertently exposed in the browser URL. When a developer pastes an authorization token or other credential into the GraphiQL headers editor, that value becomes part of the page URL and persists in browser history, shareable links, and server access logs. This creates a credential leakage risk if someone gains access to those logs or if links are shared. The issue has been patched in version 0.315.4.

• CVE-2026-48102LOW 3.1

  7-Zip versions 9.11 through 26.00 contain a flaw in how they parse UDF (Universal Disk Format) disc images—used in .iso and .udf files. When processing certain malformed UDF file structures, the parser reads 1 to 3 bytes beyond the allocated memory buffer. This out-of-bounds read occurs during the file open operation and can reveal small amounts of memory content or cause the application to crash. The vulnerability requires user interaction (opening a crafted archive) and affects only information disclosure and stability, not file integrity or system compromise.

• CVE-2026-48587LOW 3.1

  Django's cache handling function has a flaw where whitespace in HTTP Vary headers isn't properly cleaned up before comparison. An attacker can exploit this by crafting requests that cause the application to serve cached responses intended for different users, potentially leaking sensitive information. The vulnerability affects Django 5.2 before version 5.2.15 and 6.0 before version 6.0.6, though older unsupported versions may also be vulnerable.

• CVE-2026-48588LOW 3.1

  Django's caching middleware can inadvertently store and serve responses to users who shouldn't have access to them. Specifically, when a web application uses Django's built-in cache features, the system may cache sensitive data tied to one user's session and then deliver it to another user if they send requests with different cookies. This happens because the cache doesn't properly distinguish between requests based on unrelated cookie values. An attacker would need to craft requests to trigger the cache to serve cached private data, making this a read-only exposure rather than an active attack vector.

• CVE-2026-49380LOW 3.1

  JetBrains TeamCity versions before 2026.1 contain an open redirect vulnerability in the SAML authentication plugin. An attacker could craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled website after authentication. This requires user interaction and offers limited direct impact, but could be chained with phishing or credential harvesting tactics.

• CVE-2026-53663LOW 3.1

  React Router versions 7.12.0 through 7.15.0 had incomplete cross-site request forgery (CSRF) protections in Framework Mode. The framework checked for CSRF tokens on POST requests but skipped this validation entirely for PUT, PATCH, and DELETE requests. However, the practical risk is limited because modern browsers already enforce CORS preflight checks and SameSite cookie policies that prevent most cross-origin attacks. The issue is resolved in React Router 7.15.1.

• CVE-2026-56325LOW 3.1

  Capgo versions before 12.128.2 have a flaw in how they look up application identifiers when serving preview content. Instead of checking for exact matches, the system uses pattern matching that treats underscore characters as wildcards—similar to how some database queries work. An attacker with an account on Capgo can exploit this by creating apps with slightly different names that leverage these wildcard behaviors, potentially breaking preview functionality for legitimate applications or causing confusion about which app is being accessed.

• CVE-2026-57922LOW 3.1

  JetBrains YouTrack versions before 2026.2.16593 contained a flaw that allowed authenticated users to disclose project settings through the Model Context Protocol (MCP) integration. The vulnerability requires valid login credentials and specific conditions to exploit, making it a lower-risk issue suited for standard patch cycles rather than emergency response.

• CVE-2026-58371LOW 3.1

  SeaweedFS versions before 4.30 have a reflected cross-site scripting (XSS) vulnerability in their JSON response handling. An attacker can craft a malicious web page that, when visited by a user with network access to a SeaweedFS cluster, silently extracts sensitive information like cluster topology, server locations, and file listings. The vulnerability exists because SeaweedFS echoes back user-supplied callback parameters in responses labeled as JavaScript, without proper validation or security headers to prevent browsers from executing the reflected content.

• CVE-2026-59215LOW 3.1

  Open WebUI versions before 0.10.0 contain a vulnerability that allows authenticated users to view thread conversations from other private channels or direct messages they shouldn't have access to. The flaw exists because the system doesn't properly verify that a message thread belongs to the channel being accessed—an attacker can reference a message ID from a different channel to read its context. This is a low-severity issue requiring authentication and specific conditions to exploit, but it does enable unauthorized information disclosure.

• CVE-2026-59226LOW 3.1

  Open WebUI versions 0.9.0 through 0.9.x contain a privilege and access control flaw where deactivated users can still trigger scheduled automation tasks and access AI models they should no longer have permission to use. The vulnerability stems from insufficient re-validation when executing stored automations and overly lenient model access checks. An attacker with a deactivated account could potentially continue running automations or accessing restricted models until the account is fully removed from the system.

• CVE-2026-59715LOW 3.1

  Open WebUI versions 0.6.16 through 0.9.x contain a flaw in how their real-time collaboration features handle user authentication. The Socket.IO server—which powers live document editing—was misconfigured to accept certain collaboration events (specifically document awareness updates and leave notifications) from any connection, even those without a valid user login. This allows an unauthenticated attacker to interfere with the state of shared documents, though the impact is limited to integrity (not confidentiality or availability). The vulnerability was resolved in version 0.10.0.

• CVE-2026-6873LOW 3.1

  Django's signed cookie verification contains a cryptographic flaw in how it generates salts for cookie signatures. By exploiting collisions in salt derivation, an authenticated attacker can repurpose a legitimately signed cookie in an unintended context—for example, using a cookie signed for one feature to authenticate requests for a different feature. This is a low-severity issue requiring prior authentication and careful attack setup, but it undermines the integrity guarantee that signed cookies are meant to provide.

• CVE-2026-7666LOW 3.1

  Django's email system has a vulnerability that can expose email content over the network under specific conditions. When Django is configured to silently ignore mail delivery errors (`fail_silently=True`) and a secure connection attempt fails, the system may reuse a partially-initialized connection that falls back to unencrypted communication. An attacker positioned on the network path between your application and the mail server could potentially read email content in transit. This requires multiple conditions to align: configuration settings, network positioning, and a failed STARTTLS handshake.

• CVE-2026-8404LOW 3.1

  Django's cache middleware has a case-sensitivity bug in how it reads `Cache-Control` directives. When a web application uses uppercase or mixed-case values in `Cache-Control` headers (e.g., `PRIVATE` instead of `private`), the middleware fails to recognize them as valid directives. This causes responses that should not be cached to be cached anyway, potentially exposing sensitive data to unauthorized users who can trigger cache hits.

• CVE-2026-9920LOW 3.1

  Google Chrome on Android contains a vulnerability in GPU memory handling that could allow an attacker who has already compromised the browser's renderer process to access sensitive data from websites that should be isolated from each other. The vulnerability stems from uninitialized memory in the GPU code path, which under specific conditions could leak cross-origin data through a malicious webpage. This requires the renderer process to be compromised first, making it a secondary exploitation step rather than a direct entry point.

• CVE-2026-9944LOW 3.1

  CVE-2026-9944 is a memory safety issue in the ANGLE graphics library used by Google Chrome. An attacker who has already compromised Chrome's renderer process can craft a malicious webpage to leak sensitive data from other websites or origins. The vulnerability requires the renderer to be compromised first, limiting the attack surface, but the data leakage potential is real once that initial foothold exists. Chrome versions before 148.0.7778.216 are vulnerable on Windows, macOS, and Linux.

• CVE-2026-9950LOW 3.1

  A same-origin policy bypass vulnerability exists in Google Chrome on iOS versions prior to 148.0.7778.216. The flaw stems from insufficient validation of untrusted input that allows an attacker who has already compromised Chrome's renderer process to craft a malicious HTML page that circumvents browser security boundaries. This means an attacker could potentially access data or perform actions from a different website origin than the one a user is visiting, but only if the renderer process has already been compromised through another attack vector.

• CVE-2026-9959LOW 3.1

  A race condition in WebRTC functionality within Google Chrome on Windows allows an attacker to leak data across origin boundaries. The vulnerability requires user interaction (clicking on a crafted HTML page) and is difficult to exploit reliably due to timing constraints. While the underlying issue is rated High severity by Chromium, the CVSS 3.1 score of 3.1 reflects the practical barriers to exploitation and limited scope—an attacker can extract sensitive information, but cannot modify data or disrupt service.

• CVE-2026-9991LOW 3.1

  A vulnerability in Google Chrome's media handling on Windows allows an attacker who has already compromised the browser's renderer process to extract sensitive data across security boundaries. The attacker would need to host a malicious webpage and trick a user into visiting it while the renderer is already under their control. The exposure is information disclosure—no system takeover or crashes—and the barrier to exploitation is relatively high because the attacker must first achieve renderer compromise.

• CVE-2026-49358LOW 3.0

  PhpWeasyPrint, a PHP library used to generate PDFs from URLs or HTML content, contains a flaw in how it manages temporary files. Before version 2.6.0, the list of temporary files is stored in a public variable that any code in the application can modify. When the library shuts down, it deletes every file listed in that variable without checking whether those files actually belong to the temporary folder. This means an attacker with code execution could trick the library into deleting arbitrary files on the system by adding them to the list. The vulnerability requires an attacker to have already compromised the application or have another way to run PHP code in the same process.

• CVE-2024-58350LOW 2.9

  Ghidra, the reverse-engineering framework maintained by the NSA, contains a memory management flaw that can cause the application to hang or crash during shutdown. The problem stems from improperly ordered cleanup of internal components, where the program attempts to access memory that has already been freed. An attacker with local access can trigger this condition, resulting in a denial-of-service effect. This is a low-severity issue with limited real-world impact, as it requires local execution and only affects availability during the shutdown phase.

• CVE-2026-39199LOW 2.9

  snes9x version 1.63 contains a flaw that allows an attacker to cause a denial of service by supplying a maliciously crafted .ups file. The vulnerability involves writing data outside the intended memory boundaries, but exploitation requires local access and specific conditions to be met. This is a low-severity issue primarily affecting users who process untrusted patch files on systems running the vulnerable version.

• CVE-2026-39894LOW 2.9

  Cacti, an open-source performance monitoring framework, has a data integrity flaw in versions 1.2.30 and earlier. The issue stems from how the system handles decimal numbers when the server is configured with certain locales (like German) that use commas instead of periods as decimal separators. When Cacti sends metric data to RRDtool for storage, locale-dependent formatting causes the decimal separator to change from a period to a comma, which RRDtool doesn't recognize. This causes monitoring data to be misaligned or discarded entirely. The flaw requires specific server locale misconfiguration and is not remotely exploitable, but it silently corrupts your metrics—potentially masking real performance issues. The fix is available in version 1.2.31.

• CVE-2026-57062LOW 2.9

  GnuPG's gpgsm tool, which handles digitally signed and encrypted messages in a standard format called CMS (Cryptographic Message Syntax), has a flaw in how it validates a specific cryptographic parameter. When using AES-GCM encryption, the tool should reject messages where a security tag is shorter than 12 bytes, but instead it incorrectly accepts messages with a 4-byte tag. This laxness in validation could allow an attacker to forge or tamper with encrypted messages in ways that might not be detected, though the practical impact is limited and requires local access.

• CVE-2026-10078LOW 2.7

  Quay's config-tool contains a flaw in how it handles GitLab OAuth setup. When administrators configure GitLab as an identity provider, sensitive credentials (client ID and secret) are passed in plaintext within the URL query string of POST requests. This is problematic because these credentials can be logged by web servers, reverse proxies, load balancers, and monitoring systems—anywhere that records HTTP request details. An attacker who gains access to these logs could extract the credentials and impersonate Quay's OAuth client to GitLab, potentially gaining unauthorized access to repositories or other GitLab resources.

• CVE-2026-10753LOW 2.7

  The Site Kit by Google WordPress plugin before version 1.176.0 contains a privilege escalation vulnerability affecting its REST API. Users with Editor-level access or those granted dashboard sharing permissions can modify plugin settings that should be restricted to administrators only. This occurs because the REST API endpoint lacks proper role-based access controls. While the technical impact is limited to unauthorized configuration changes, the vulnerability could allow lower-privileged users to alter site-wide plugin behavior without administrative approval.

• CVE-2026-11578LOW 2.7

  Fluent Forms, a popular WordPress form-building plugin, contains an authorization flaw in versions before 6.2.5. Administrators who restrict certain user accounts (called Managers) to manage only specific forms can inadvertently expose a security gap: those restricted Managers can delete submission data from forms they're not supposed to have access to. This is a low-severity issue that only affects WordPress sites using a non-default setup where form access has been deliberately restricted by role.

• CVE-2026-11781LOW 2.7

  The Adminify WordPress plugin before version 4.2.10 has a weakness in its administration search feature that fails to properly check user permissions. This allows lower-privilege users (such as Contributors) to view sensitive information they shouldn't have access to, including unpublished posts from other authors, pending comments, inventory data, and usernames. The vulnerability requires an authenticated attacker with at least Contributor-level access, limiting exposure but still posing a confidentiality risk in multi-author environments.

• CVE-2026-12102LOW 2.7

  A WordPress plugin called UsersWP has a flaw that allows editors and higher-level users to delete profile images (avatars and banners) belonging to any other user, including administrators. The vulnerability exists because the plugin doesn't properly validate which user a person is trying to modify when they submit a request to change or remove an image. While the impact is limited to image deletion and requires elevated account privileges to exploit, it could be used to deface user profiles or cause minor disruption.

• CVE-2026-12211LOW 2.7

  A path traversal vulnerability has been discovered in Intelbras iNVU 7016 FT running firmware version 3.004.00IB000.0.T (Build 2025-09-26). An attacker with high-level administrative privileges can manipulate requests to the web interface's /RPC2_Loadfile/syslog/ endpoint to access files outside their intended directory. The vulnerability requires authentication and has limited confidentiality impact, but the vendor has already released a patched version. Public exploit code is available, though practical exploitation remains constrained by privilege requirements.

• CVE-2026-12755LOW 2.7

  Devolutions Server contains a flaw in how it validates user input on Active Directory discovery endpoints used for PAM (Privileged Access Management) functions. An authenticated user with UserGroupsView permission can manipulate the DomainName parameter to trick the server into attempting authentication to a system they control, thereby capturing NTLMv2 credential hashes from the PAM provider. This is a credential exposure risk limited to authenticated users with specific permissions.

• CVE-2026-27790LOW 2.7

  CVE-2026-27790 is a low-severity vulnerability affecting Gallagher Command Centre and its T20 reader hardware. An authenticated operator with proper authorization can send crafted requests to trigger an unhandled exception that forces the T20 Readers to restart, causing temporary unavailability. Because it requires valid credentials and administrator-level access to exploit, the practical risk is contained, but the impact in access control environments where reader downtime disrupts operations should not be dismissed.

• CVE-2026-27844LOW 2.7

  A flaw in Gallagher's Command Centre diagnostic web interface allows an authenticated operator to restart the Controller 6000 or Controller 7000 by sending specially crafted requests. This causes temporary unavailability of access control functions. The vulnerability requires valid credentials and high-level operator privileges, limiting real-world exposure. Affected versions span from 9.10 and earlier through 9.50, though multiple maintenance releases have introduced patches.

• CVE-2026-44367LOW 2.7

  Klaw, a Kafka topic management and governance platform, contains a vulnerability in how it handles usernames during registration and login. The system doesn't consistently apply case sensitivity rules—treating 'Admin' and 'admin' as different or the same depending on the operation—which allows authenticated users with administrative privileges to deliberately lock out accounts or trigger denial of service conditions. This is a low-severity issue requiring administrative access to exploit, but it can impact operational availability if administrators use it maliciously or if the inconsistency is exploited in targeted attacks. The flaw was fixed in version 2.10.4.

• CVE-2026-45076LOW 2.7

  Synapse, an open-source Matrix homeserver implementation used for federated messaging, contains a flaw in how it handles room history in cross-server deployments. Malicious homeservers can craft specially formed room events that cause Synapse instances to withhold historical messages from clients requesting older conversation data. Users may see incomplete chat histories or missing messages when paginating through room archives. This is a low-severity issue because it requires a compromised or malicious federated peer and affects data availability rather than confidentiality or integrity.

• CVE-2026-46466LOW 2.7

  Dell PowerProtect Data Domain is vulnerable to a flaw where high-privileged attackers with remote network access can manipulate information on the system. The vulnerability stems from the software trusting data from less reliable sources than it should. This affects multiple versions across different release lines (7.7.1.0–8.7, plus specific LTS versions from 2024–2026). While the flaw requires administrator-level credentials to exploit, organizations relying on Data Domain for backup and deduplication should treat this as a data integrity risk.

• CVE-2026-49979LOW 2.7

  Appsmith versions before 1.99 contain a vulnerability in the test email functionality that allows high-privileged users to perform internal network reconnaissance. When an authenticated admin tests the email configuration, the application accepts custom SMTP server addresses without validating whether they point to internal IP ranges. An attacker with admin access can abuse this to probe internal services, discover what's running on specific ports, and gather system information through detailed error messages—all without leaving the admin panel. The vulnerability requires existing admin credentials, limiting its practical attack scope.

• CVE-2026-53480LOW 2.7

  Dell PowerProtect Data Domain—a backup and deduplication appliance used in enterprise data protection—contains a path traversal vulnerability affecting multiple release branches. An attacker with high-level administrative or service credentials who can reach the device remotely could modify files outside intended directories, potentially altering system behavior or corrupting protected data. The vulnerability is rated LOW severity due to the requirement for elevated privileges and limited immediate impact.

• CVE-2026-57961LOW 2.7

  phpMyFAQ versions before 4.1.5 contain a path traversal vulnerability that allows authenticated users with FAQ editing privileges to read files outside the intended content directory. An attacker would craft malicious image paths in HTML content stored in FAQ entries. When that content is exported to PDF, the vulnerable path-resolution logic fails to properly constrain file access, potentially exposing sensitive files on the server. This requires both authentication and FAQ editing permissions, significantly limiting the attack surface.

• CVE-2026-6352LOW 2.7

  GitLab Enterprise Edition contains an authorization flaw that allows authenticated users with auditor-level access to modify compliance violation records through GraphQL API calls. The vulnerability affects multiple version branches and requires high privilege credentials to exploit, limiting real-world impact to insider threats or compromised admin accounts.

• CVE-2026-8800LOW 2.7

  Progress MOVEit Transfer contains an authorization flaw in its Audit User module that allows high-privileged users to access information they shouldn't have permission to see. The vulnerability is limited in scope—it only exposes confidential data, does not allow modification or deletion, and requires an authenticated account with elevated privileges to exploit. Most organizations running recent versions are either already patched or face minimal risk from this issue.

• CVE-2026-9088LOW 2.7

  Keycloak contains a flaw in how it enforces user profile visibility rules for delegated administrators. An admin with permission to view group memberships and users can circumvent access controls by querying the group members endpoint, allowing them to see sensitive user attributes that should be hidden from them. This is a controlled-access issue—the attack requires administrative privileges and does not affect regular users or public-facing functionality.

• CVE-2026-45154LOW 2.6

  Nextcloud, an open-source content collaboration platform, contains a flaw affecting versions 2.6.0 through 4.2.x that allows guest users to retrieve deleted collaborative pages from the trash when the parent collective is shared in view-only mode. An attacker with guest access could circumvent intended deletion by directly accessing removed content, though the exposure is limited to information disclosure and requires prior access to the shared collective. The vulnerability has been resolved in version 4.3.0.

• CVE-2026-45155LOW 2.6

  Nextcloud Server contains a flaw in its circles feature that allows authenticated users to add unknown circles to other circles by directly referencing their IDs, potentially enabling membership tracking. While circle IDs are designed with high complexity (62^15 combinations), if an attacker obtains a valid circle ID through other means, they could exploit this missing access control. The vulnerability requires an authenticated session and user interaction to exploit, making opportunistic attacks unlikely but targeted attacks possible if circle IDs are discovered.

• CVE-2026-57234LOW 2.6

  Nokogiri, a widely-used Ruby library for parsing XML and HTML, has a flaw in its JRuby implementation that bypasses a security setting meant to prevent external network access during schema parsing. An attacker with authenticated access could craft a malicious schema file that, when parsed, fetches resources from attacker-controlled servers. This could enable Server-Side Request Forgery (SSRF) or XML External Entity (XXE) attacks, potentially leaking sensitive data or compromising internal systems. The vulnerability affects JRuby users only; the standard Ruby implementation is not impacted. The issue is resolved in version 1.19.4.

• CVE-2026-57926LOW 2.6

  JetBrains YouTrack versions before 2026.2.16593 contain a prototype pollution vulnerability in the websandbox bridge component. An authenticated user with user-interaction involvement could exploit this flaw to modify object properties, potentially leading to limited integrity compromise. The vulnerability has a low CVSS score of 2.6, reflecting its narrow attack surface and minimal impact.

• CVE-2026-9694LOW 2.6

  GitLab CE/EE contains a vulnerability in its Service Desk feature that allows an unauthenticated attacker to impersonate the GitLab Support Bot through a specially crafted email reply. The attacker can inject arbitrary content into email template processing under specific conditions. While the vulnerability requires certain setup conditions and user interaction to exploit, it could lead to content injection that misleads users interacting with the support system.

• CVE-2026-10783LOW 2.5

  A weakness in Gradio 6.14.0's audio caching function allows a local user with limited privileges to potentially access confidential information through use of a weak cryptographic hash. The attack is technically difficult to execute and requires hands-on access to the system. While a public exploit exists, real-world exploitation remains unlikely due to high complexity requirements and low impact scope.