By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 86 of 86

• CVE-2026-11481LOW 2.5

  A weakness in the grepai project (versions up to 0.35.0) allows a local user with login privileges to manipulate how the Postgres Embedding Cache stores and retrieves content hashes, potentially causing the system to use weak cryptographic hashing. The vulnerability requires significant technical knowledge to exploit and poses limited immediate risk, but should be addressed through the pending patch once merged.

• CVE-2026-14702LOW 2.5

  CVE-2026-14702 is a low-severity flaw in the markdownify-mcp library (versions up to 1.1.0) that weakens the randomness used to generate temporary file names. An attacker with local access to a system running this library could potentially predict or manipulate temporary file names, though doing so requires significant technical skill and knowledge of the affected code. The vulnerability does not enable remote exploitation and has minimal direct impact on system confidentiality or availability.

• CVE-2026-15168LOW 2.5

  Wireshark's BLF (Binary Logging Format) file parser in recent versions contains a flaw that could leak sensitive information when a user opens a specially crafted BLF file. An attacker would need to trick a user into opening a malicious file locally—this is not a remote attack and requires user interaction. The risk is limited to potential disclosure of small amounts of data; the vulnerability does not enable system compromise, privilege escalation, or denial of service.

• CVE-2026-41514LOW 2.5

  OP-TEE, a security processor for Arm-based systems, has a weakness in how it decrypts RSA-encrypted data when using Hisilicon hardware acceleration. The flaw allows an attacker who can send specially crafted encrypted messages to gradually extract the original plaintext—similar to attacks on poorly implemented encryption padding schemes. This requires approximately 1000–2000 attempts and local system access, making it a low-risk issue in most deployments. The vulnerability exists only when a specific optional hardware driver is enabled, and it is disabled by default.

• CVE-2026-41515LOW 2.5

  OP-TEE, a security technology that runs on Arm processors, contains a flaw in how it decrypts certain encrypted messages. The vulnerability allows an attacker with local access to recover the contents of RSA-OAEP encrypted data by sending many specially crafted messages and observing how the system responds. The flaw stems from a timing-sensitive implementation detail that inadvertently leaks information about decryption failures. While the recovery process requires thousands of attempts, the theoretical risk is real for systems processing sensitive encrypted material. The issue affects OP-TEE versions 3.9.0 through 4.10.x; patched version 4.11.0 is available.

• CVE-2026-41516LOW 2.5

  OP-TEE, a security layer that runs trusted code on Arm processors, contains a flaw in how it decrypts RSA-encrypted messages when using Hisilicon hardware accelerators. The vulnerability allows an attacker with local access to recover the original encrypted data through timing analysis—observing slight differences in how long decryption takes depending on the input. This is a well-known class of attack against RSA encryption implementations that fail to run in constant time. The issue affects OP-TEE versions 4.5.0 through 4.10.x and is resolved in version 4.11.0.

• CVE-2026-54326LOW 2.5

  Pi is a lightweight terminal-based code editor that lets developers export their work sessions as static HTML files for documentation or sharing. Between versions 0.74.0 and 0.78.0, the application failed to properly validate link and image URLs in these exports, allowing potentially harmful URLs to slip through. An attacker could craft a malicious Markdown file that, when exported to HTML, would contain dangerous links—such as those beginning with 'javascript:' or other browser-executable schemes. The flaw exploited a bypass technique: sneaking C0 control characters (invisible, non-printing characters) into the URL scheme to fool the security filter. Browsers automatically clean up these hidden characters before acting on URLs, meaning the malicious intent survives. This is a low-severity issue because it requires local access to the Pi application and user interaction to trigger. It was patched in version 0.78.1.

• CVE-2026-10112LOW 2.4

  CVE-2026-10112 is a stored or reflected cross-site scripting (XSS) vulnerability in the Dashboard Page component of STUDENT-MANAGEMENT-SYSTEM version 1.0. An attacker with high privileges can inject malicious scripts through the Name parameter, which are then executed in the browsers of users who view the affected page. The vulnerability requires user interaction and has a low CVSS score of 2.4, but exploitation has already been disclosed publicly.

• CVE-2026-10514LOW 2.4

  A cross-site scripting (XSS) vulnerability exists in CordysCRM versions up to 1.6.2. The flaw is located in a request parameter handling component and allows attackers with administrative privileges to inject malicious scripts that execute in users' browsers. While public exploit code is available, the attack requires both high-level credentials and user interaction (such as clicking a malicious link), significantly limiting real-world risk. Upgrading to version 1.7.0 resolves the issue.

• CVE-2026-10529LOW 2.4

  A cross-site scripting (XSS) vulnerability has been discovered in westboy CicadasCMS affecting the Task Scheduling Management Module. The flaw exists in the ScheduleJobController component and can be triggered by an authenticated user with elevated privileges through a specially crafted request. While the vulnerability requires administrative or high-privilege access to exploit, the presence of user interaction (rendering) combined with public availability of exploit details elevates attention. The CMS uses a rolling release model, making definitive version tracking difficult, though the affected commit hash has been identified.

• CVE-2026-11338LOW 2.4

  A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester Ship Ferry Ticket Reservation System version 1.0. An authenticated administrative user with high privileges can inject malicious JavaScript into the Username parameter on the user management page, which executes in the browsers of other users who view the manipulated content. The vulnerability requires user interaction and administrative access to trigger, limiting its immediate exposure but potentially enabling unauthorized account manipulation or credential theft within administrative workflows.

• CVE-2026-11434LOW 2.4

  FluentCMS version 0.0.5 contains a cross-site scripting (XSS) vulnerability in its Blocks Plugin, specifically within the /admin/blocks file. An authenticated administrator with high privileges can inject malicious scripts that execute in the browsers of other users viewing the affected page. The vulnerability requires user interaction (such as clicking a link) to trigger. Public exploit code is available, though the low CVSS score reflects the requirement for high-privilege authentication and user interaction to succeed.

• CVE-2026-11468LOW 2.4

  A cross-site scripting (XSS) vulnerability exists in SourceCodester Hospitals Patient Records Management System version 1.0. An authenticated administrator with high privileges can inject malicious scripts through the room_types page by manipulating the room parameter. When another user visits the affected page, the injected script executes in their browser, potentially allowing session hijacking, credential theft, or malware distribution. The vulnerability requires both administrative access to initiate the attack and user interaction (clicking a link or visiting a crafted URL) for the payload to execute. While the CVSS score is low, the healthcare context and potential for patient data exposure warrant careful attention.

• CVE-2026-11491LOW 2.4

  CodeAstro Human Resource Management System version 1.0 contains a stored cross-site scripting (XSS) vulnerability in its Notice Board Management feature. An attacker with high privileges can inject malicious JavaScript into the Notice Title field, which is then executed in the browsers of other users viewing that notice. The vulnerability requires user interaction (a victim must view the affected notice) and has already been disclosed publicly with exploit code available.

• CVE-2026-12202LOW 2.4

  A stored or reflected cross-site scripting (XSS) vulnerability exists in Intelliants Subrion CMS versions up to 4.0.3. The flaw resides in the Blocks Endpoint component, where improper handling of CSS class name parameters allows an attacker to inject malicious scripts. Because the vulnerability requires administrative privileges to exploit and user interaction is needed for the attack to succeed, the overall risk is low. However, the public disclosure of this issue means threat actors now have detailed information about how to craft attacks.

• CVE-2026-13514LOW 2.4

  Chess Play and Learn App for Android (versions up to 4.9.42) contains a security flaw in how it handles backup files specified in its AndroidManifest.xml configuration. An attacker with physical access to a device can potentially expose sensitive backup data that should remain protected. While the flaw is real and a proof-of-concept has been publicly disclosed, exploitation requires direct hands-on access to the device itself, which significantly limits the attack surface in most enterprise and personal use scenarios.

• CVE-2026-14655LOW 2.4

  A cross-site scripting (XSS) vulnerability exists in code-projects Assessment Management version 1.0, specifically in the admin/view-users.php file. An authenticated administrator with elevated privileges can inject malicious code through the User parameter, which executes in the browsers of other users viewing the affected page. This allows an attacker to steal session tokens, redirect users, or perform actions on their behalf. Exploitation requires both high-level access and user interaction, limiting real-world attack surface.

• CVE-2026-15321LOW 2.4

  MyEMS versions up to 6.4.0 contain a stored cross-site scripting (XSS) vulnerability in the Admin Backend API. The issue exists in the svg.py file's on_post function, where user-supplied data in the 'new_values' parameter is not properly sanitized before being stored or rendered. An authenticated administrator with high privileges can inject malicious scripts that will execute in the browsers of other users who interact with the affected feature. The vulnerability has a public exploit, though the low CVSS score reflects the requirement for administrative credentials and user interaction to trigger the attack.

• CVE-2026-41986LOW 2.4

  CVE-2026-41986 is a logic bypass vulnerability affecting file system operations. An attacker with physical access to a system could exploit this flaw to disrupt availability—for example, by manipulating file system behavior to cause denial of service. The vulnerability requires direct physical interaction with the machine and carries a low severity rating. The primary concern is operational disruption rather than data theft or system compromise.

• CVE-2026-49317LOW 2.4

  The 2025 Indian Motorcycle Scout Bobber + Tech infotainment system has a logic flaw in how it initializes during boot. The system is supposed to require a PIN to unlock, but it uses a problematic shortcut: it checks whether it detects wireless messages from the motorcycle's Wireless Control Module (WCM) during startup. If those messages are absent, the system assumes no immobilizer is present and skips the PIN screen entirely, granting immediate access to the infotainment interface. An attacker with adjacent network access can silence the WCM during the boot window—using techniques like a CAN bus-off attack—to trick the system into thinking the immobilizer is not installed, thereby bypassing the PIN protection that should guard the interface.

• CVE-2026-49318LOW 2.4

  A flaw in the 2025 Indian Motorcycle Scout Bobber + Tech's infotainment system allows someone with physical proximity to the motorcycle to unlock the digital display without entering the correct PIN. The system incorrectly assumes that if it doesn't detect wireless signals from a control module during startup, no security PIN is needed. An attacker can exploit this by blocking those signals during the boot process, causing the system to skip the PIN screen entirely and display the full user interface.

• CVE-2026-8387LOW 2.4

  ClearML, an open-source ML operations platform, contains a flaw in how it extracts compressed files from remote sources. When users download datasets, models, or artifacts, the system unpacks `.zip` files without properly validating file paths. An attacker can craft a malicious archive containing specially-named files that, when extracted, write to sensitive locations on the server—such as configuration directories or cron job folders. While the CVSS score is low due to requiring high-level authentication and user interaction, the potential for abuse exists in multi-tenant or shared environments where dataset or model files pass through untrusted sources.

• CVE-2026-41124LOW 2.3

  Dell PowerProtect Data Domain contains a path traversal vulnerability that allows a high-privileged local attacker to read sensitive files on affected systems. The vulnerability affects multiple versions across four release lines (7.13.1.x, 8.3.1.x, 8.6.1.x, and 7.7.1.0 through 8.6). While the impact is limited to information disclosure and requires both elevated privileges and local access, organizations running these backup appliances should assess their exposure and plan remediation.

• CVE-2026-9610LOW 2.3

  IBM Datacap and Datacap Navigator versions 9.1.7, 9.1.8, and 9.1.9 contain a flaw where certain features or data are accessible directly via URL without proper authorization checks, even though those features are not advertised in the user interface. An attacker with local access and elevated privileges could bypass intended security boundaries to view sensitive information.

• CVE-2026-12567LOW 2.2

  CVE-2026-12567 is a local privilege escalation flaw in the github_workflows module that fails to validate repository names for symlink attacks. An attacker with local access to the scan directory can create a malicious symlink at a predictable output location, tricking the module into writing workflow data wherever the attacker directs. This requires local system access and user interaction, limiting immediate blast radius but creating a path for data exfiltration or code injection in multi-user or CI/CD environments.

• CVE-2026-50266LOW 2.2

  A flaw in OpenStack Neutron versions before 28.0.1 allows project managers to perform network spoofing attacks on shared networks. The vulnerability stems from overly permissive role-based access control (RBAC) policies that allow any project manager to create or modify ports on networks they don't own, and crucially, to assign those ports special "trusted" network service identities (like DHCP servers). This bypasses normal anti-spoofing rules and security group protections, enabling attackers to spoof DHCP, MAC, or IP addresses to target other tenants sharing the same network. This is a reintroduction of a vulnerability that was supposedly fixed nearly a decade ago.

• CVE-2026-54327LOW 2.2

  Pi is a lightweight terminal-based coding tool that manages API authentication through a local configuration file. Between versions 0.74.0 and 0.78.1, a timing vulnerability could temporarily expose stored API keys and OAuth tokens with overly permissive file access before the application locked down security settings. This window is extremely brief but theoretically allows a local user with active session privileges to read credentials meant to be private. The issue has been patched in version 0.78.1.

• CVE-2026-45403LOW 2.0

  AnythingLLM versions before 1.13.0 contain a path traversal vulnerability in the agent filesystem copy tool. When copying files, the application only validates the top-level source and destination directories but fails to validate nested files or reject symbolic links. An attacker with high privileges could create or exploit a symlink nested within an allowed source directory to read files outside the intended filesystem boundaries and copy them to an allowed destination, potentially exposing sensitive data. The vulnerability requires high user privileges, complex conditions, and user interaction to exploit, making practical real-world abuse unlikely despite the core weakness.

• CVE-2026-46549LOW 2.0

  NocoDB, a spreadsheet-like database platform, contained a flaw in how it handled OAuth token permissions. When administrators issued OAuth tokens with intentionally restricted scopes—such as limiting access to specific features or databases—the system failed to actually enforce those restrictions. A user with such a restricted token could gain access to resources and perform actions far beyond what the token was meant to allow, effectively inheriting the full permissions of the underlying user account. This issue has been patched in version 2026.04.1.

• CVE-2026-47713LOW 2.0

  AnythingLLM versions before 1.13.0 contain a token persistence flaw that can leak sensitive data when administrators migrate from single-user to multi-user mode. A mobile device token issued in single-user mode may remain valid after the migration, allowing it to bypass user-scoping controls and access workspaces and chat content belonging to other users. The vulnerability requires an attacker to have had a legitimate mobile device token before the migration, then exploit it post-migration in the multi-user environment.

• CVE-2026-11786LOW 1.9

  A parsing flaw in 389 Directory Server can cause the LDIF (LDAP Data Interchange Format) parser to read past the boundary of allocated memory when it encounters attribute types ending with semicolons during database imports. The defect is detectable only under memory instrumentation tools (such as AddressSanitizer) and does not cause immediate functional failure or crashes under normal operation. This is a low-severity out-of-bounds read affecting local, high-privileged operations.

• CVE-2026-50268LOW 1.9

  Steeltoe.Configuration.Encryption versions 4.0.0 through 4.1.0 contain a configuration bug where the OAEP encryption algorithm setting does not work as intended. When administrators configure the system to use OAEP (a stronger RSA encryption variant), the software incorrectly falls back to the weaker PKCS#1 v1.5 algorithm instead. This occurs due to an incorrect transformation string passed to the BouncyCastle cryptographic library. The vulnerability requires local access and administrative privileges to exploit, making it a low-risk issue in most environments. Version 4.2.0 corrects this defect.

• CVE-2026-56364LOW 1.9

  ImageMagick versions prior to 7.1.2-13 contain a memory leak in code that processes OpenCL device configuration files. An attacker with write access to ImageMagick's OpenCL cache directory can place a specially crafted XML file with incomplete device elements. When ImageMagick reads this file, the memory leak causes the application to consume increasing amounts of memory until it runs out, rendering the service unavailable. This requires both local file system access and knowledge of where the cache directory is located, significantly limiting real-world attack scenarios.

• CVE-2026-12065LOW 1.8

  A vulnerability in the Groww Stock, Mutual Fund, and Gold app (Android versions up to 20260805) allows attackers with physical access to a device to bypass authorization checks on custom URL schemes handled by the app's WebView component. An attacker would need to be present at the device and have some level of authentication context, making this a low-risk issue in typical operational environments. The issue affects the app's custom protocol handlers, which are entry points for inter-app communication on Android.

• CVE-2026-48617LOW 1.8

  Node.js versions 22, 24, and 26 contain a flaw in how they enforce the Permission Model security feature. Specifically, the `process.report.writeReport()` function does not properly validate file paths, allowing an authenticated local attacker with high privileges to bypass the intended security boundary. The risk is limited to integrity impact in this case, though the vulnerability could expose sensitive information under certain configurations. This is a low-severity issue that requires local access and user interaction to exploit.

• CVE-2026-12635NONE 0.0

  GitLab has patched a server-side request forgery (SSRF) vulnerability affecting multiple versions of GitLab Community and Enterprise editions. The flaw allowed authenticated users with maintainer-level permissions to bypass URL validation during mirror synchronization, potentially enabling them to make requests to internal network resources. The vulnerability required specific conditions and user interaction through the mirror sync feature, limiting its practical exposure.

• CVE-2026-44956NONE 0.0

  CVE-2026-44956 is a stored cross-site scripting (XSS) vulnerability that allows low-privileged users to inject malicious code through their Full Name field. The injected payload persists in system-generated emails, which are stored in the userlog table. When an administrator views the email content via the userlog-details.php page, the unescaped JavaScript executes in their browser, potentially compromising admin accounts or enabling unauthorized actions. The vulnerability has been patched by adding proper output sanitization to the userlog details display.

• CVE-2026-44960NONE 0.0

  A stored cross-site scripting (XSS) vulnerability exists in the audit log viewer that allows an attacker to inject malicious JavaScript through usernames. When an administrator views audit log details, any embedded script payload in a username would execute in their browser due to insufficient output sanitization. The vendor has patched this by adding proper output escaping to the audit log display.

• CVE-2026-44961NONE 0.0

  CVE-2026-44961 is a validation bypass in an XML-RPC API's user creation method that was inadvertently introduced when patching a previous vulnerability. The flaw allows attackers to craft usernames that bypass security checks, enabling account impersonation or injection of malicious scripts. Because the vulnerability has no CVSS score assigned and is not listed on CISA's Known Exploited Vulnerabilities catalog, it appears to be a localized or low-impact issue at this time, though the authentication context and data exposure potential warrant attention.

• CVE-2026-55611NONE 0.0

  AnythingLLM versions 1.11.1 through 1.14.0 contain an authorization flaw in the file embedding workflow. Authenticated managers or admins can delete parsed files belonging to other users across any workspace—including workspaces they have no membership in—by guessing or enumerating file IDs. The vulnerability exists because the delete operation bypasses ownership verification, executing even when the access control check fails. Version 1.14.1 fixes this issue.

• CVE-2026-57501NONE 0.0

  Zen is a Firefox-based browser that includes features for viewing links in a 'glance' panel or opening them in a split-view tab. Before version 1.21.5b, these context-menu actions bypass a critical security boundary by loading external links with elevated System privileges rather than the privileges of the page that contains the link. An attacker can craft a malicious web page with a specially crafted link—particularly one pointing to a local file—that, when opened through the glance or split-view menu items, executes with System-level permissions. This circumvents the browser's normal content-to-file security restriction, which prevents ordinary web pages from directly accessing the local file system.