Medium-severity CVEs (page 10)
Page 10 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85709 | Medium | 5.3 | 2026-09-22 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers… |
CVE-2026-84301 | Medium | 6.3 | 2026-09-22 | FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/servic… |
CVE-2026-83602 | Medium | 6.5 | 2026-09-22 | Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK… |
CVE-2026-83601 | Medium | 6.5 | 2026-09-22 | Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded pas… |
CVE-2026-83600 | Medium | 6.5 | 2026-09-22 | Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes… |
CVE-2026-76805 | Medium | 5.3 | 2026-09-22 | Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate subst… |
CVE-2026-76804 | Medium | 5.5 | 2026-09-22 | Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capa… |
CVE-2026-76803 | Medium | 5.3 | 2026-09-22 | Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-fil… |
CVE-2026-76802 | Medium | 4.7 | 2026-09-22 | Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-… |
CVE-2026-56682 | Medium | 5.3 | 2026-09-22 | 9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper… |
CVE-2026-90462 | Medium | 5.4 | 2026-09-22 | A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the… |
CVE-2026-86805 | Medium | 6.3 | 2026-09-22 | A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local att… |
CVE-2026-81886 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable… |
CVE-2026-81885 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable becaus… |
CVE-2026-81880 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerabl… |
CVE-2026-81879 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF pa… |
CVE-2026-81878 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable be… |
CVE-2026-79913 | Medium | 6.5 | 2026-09-22 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.g… |
CVE-2026-79312 | Medium | 6.8 | 2026-09-22 | webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session fro… |
CVE-2026-75517 | Medium | 6.5 | 2026-09-22 | Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, up… |
CVE-2026-95501 | Medium | 4.3 | 2026-09-22 | A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the file cms/weasel.ph… |
CVE-2026-94570 | Medium | 5.9 | 2026-09-22 | SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthentica… |
CVE-2026-93344 | Medium | 6.5 | 2026-09-22 | MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authent… |
CVE-2026-79315 | Medium | 4.7 | 2026-09-22 | A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding… |
CVE-2026-65129 | Medium | 6.7 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this… |
CVE-2026-65127 | Medium | 4.1 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information due to uncleared deb… |
CVE-2026-65126 | Medium | 5.0 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful e… |
CVE-2026-65125 | Medium | 6.6 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit… |
CVE-2026-65124 | Medium | 5.9 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability… |
CVE-2026-65117 | Medium | 5.0 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful exploit of this vu… |
CVE-2026-65115 | Medium | 6.5 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled resource consumption. A successful exploit of this… |
CVE-2026-65112 | Medium | 6.5 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause uncontrolled resource consumption. A successful exploit of th… |
CVE-2026-95666 | Medium | 4.3 | 2026-09-22 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bul… |
CVE-2026-95396 | Medium | 4.3 | 2026-09-22 | A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file HospitalContr… |
CVE-2026-93343 | Medium | 6.5 | 2026-09-22 | MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_vendors_ajax AJAX action that allows authe… |
CVE-2026-93342 | Medium | 5.4 | 2026-09-22 | MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authen… |
CVE-2026-93341 | Medium | 4.3 | 2026-09-22 | MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that allows authenticate… |
CVE-2026-95273 | Medium | 4.3 | 2026-09-22 | A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_content of the file changedetectionio/flask_app.py… |
CVE-2026-95623 | Medium | 5.6 | 2026-09-22 | The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server r… |
CVE-2026-25262 | Medium | 6.9 | 2026-09-22 | Memory corruption while processing a crafted ELF file in the Primary Bootloader. |
CVE-2026-15095 | Medium | 4.9 | 2026-09-22 | The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all… |
CVE-2026-9004 | Medium | 4.3 | 2026-09-22 | The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4… |
CVE-2026-95503 | Medium | 6.8 | 2026-09-22 | A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication… |
CVE-2026-91092 | Medium | 4.3 | 2026-09-22 | The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly… |
CVE-2026-7622 | Medium | 4.3 | 2026-09-22 | The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and no… |
CVE-2026-74765 | Medium | 6.5 | 2026-09-22 | Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. The XS backend… |
CVE-2026-4123 | Medium | 4.3 | 2026-09-22 | The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missi… |
CVE-2026-1645 | Medium | 4.4 | 2026-09-22 | The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the 'locale_url' setting in all versions u… |
CVE-2026-18439 | Medium | 4.3 | 2026-09-22 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4… |
CVE-2026-18345 | Medium | 4.3 | 2026-09-22 | The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() functi… |
CVE-2026-16778 | Medium | 6.4 | 2026-09-22 | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortco… |
CVE-2026-12995 | Medium | 4.3 | 2026-09-22 | The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the edit_meta_… |
CVE-2025-1280 | Medium | 6.5 | 2026-09-22 | The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_lay… |
CVE-2025-14487 | Medium | 5.3 | 2026-09-22 | The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and inc… |
CVE-2025-14486 | Medium | 5.3 | 2026-09-22 | The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0… |
CVE-2025-14484 | Medium | 5.3 | 2026-09-22 | The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including… |
CVE-2026-93655 | Medium | 6.1 | 2026-09-22 | The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to, and includi… |
CVE-2026-88788 | Medium | 6.8 | 2026-09-22 | The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block… |
CVE-2026-85653 | Medium | 6.4 | 2026-09-22 | The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'other_attributes' Block Parameter in all versions up to, an… |
CVE-2026-94492 | Medium | 6.3 | 2026-09-22 | A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit o… |
CVE-2026-93711 | Medium | 6.5 | 2026-09-22 | Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header v… |
CVE-2026-93709 | Medium | 5.3 | 2026-09-22 | Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler… |
CVE-2026-76974 | Medium | 5.3 | 2026-09-22 | SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked b… |
CVE-2026-94490 | Medium | 4.7 | 2026-09-22 | A security flaw has been discovered in OctoPrint 1.0.0. Affected by this issue is the function executeSystemCommand of the file src/octoprint/server/api/system… |
CVE-2026-94489 | Medium | 4.3 | 2026-09-22 | A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function _validate of the file src/octoprint/server/api/files.py of th… |
CVE-2026-94625 | Medium | 5.3 | 2026-09-21 | vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders th… |
CVE-2026-94536 | Medium | 4.3 | 2026-09-21 | lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employe… |
CVE-2026-94533 | Medium | 6.5 | 2026-09-21 | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachme… |
CVE-2026-94532 | Medium | 6.5 | 2026-09-21 | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user… |
CVE-2026-93340 | Medium | 6.8 | 2026-09-21 | Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password rese… |
CVE-2026-88756 | Medium | 5.3 | 2026-09-21 | Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint (POST /u… |
CVE-2026-78806 | Medium | 5.5 | 2026-09-21 | An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive information via the… |
CVE-2026-61743 | Medium | 6.3 | 2026-09-21 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's serv… |
CVE-2026-59830 | Medium | 5.4 | 2026-09-21 | Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolati… |
CVE-2026-59815 | Medium | 4.3 | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllo… |
CVE-2026-46650 | Medium | 4.4 | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/… |
CVE-2026-17054 | Medium | 5.3 | 2026-09-21 | The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_event_task(). For cont… |
CVE-2026-15890 | Medium | 5.3 | 2026-09-21 | The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead_get_nonce() in subsys/secure_storage/s… |
CVE-2026-94588 | Medium | 4.4 | 2026-09-21 | In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-su… |
CVE-2026-93433 | Medium | 5.5 | 2026-09-21 | A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Small Computer System… |
CVE-2026-88745 | Medium | 6.1 | 2026-09-21 | EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell. |
CVE-2026-88412 | Medium | 5.3 | 2026-09-21 | An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause a Denial of Service… |
CVE-2026-88408 | Medium | 6.5 | 2026-09-21 | FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c). This vulnerability all… |
CVE-2026-88403 | Medium | 6.5 | 2026-09-21 | A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted… |
CVE-2026-79919 | Medium | 6.3 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LD_PRELOAD sandbox can invoke ctypes… |
CVE-2026-79918 | Medium | 6.3 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, the ToolExecutor LD_PRELOAD sandbox hooks execve, execvpe, and execveat to pr… |
CVE-2026-79917 | Medium | 6.5 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{chat_id}/share_chat verifies that a con… |
CVE-2026-79317 | Medium | 4.8 | 2026-09-21 | A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user obj… |
CVE-2026-77525 | Medium | 4.2 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path application_id but load record… |
CVE-2026-77522 | Medium | 4.3 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an… |
CVE-2026-77520 | Medium | 5.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's application_id fr… |
CVE-2026-77519 | Medium | 5.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only… |
CVE-2026-77518 | Medium | 5.0 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP tool_id in the same… |
CVE-2026-77517 | Medium | 5.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id i… |
CVE-2026-77516 | Medium | 5.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserR… |
CVE-2026-73551 | Medium | 5.3 | 2026-09-21 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization… |
CVE-2026-73511 | Medium | 5.3 | 2026-09-21 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the… |
CVE-2026-59816 | Medium | 4.3 | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST… |
CVE-2026-58272 | Medium | 5.3 | 2026-09-21 | Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepan… |
CVE-2026-58270 | Medium | 6.5 | 2026-09-21 | Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user… |