Medium-severity CVEs (page 11)
Page 11 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-77522 | Medium | 4.3 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an… |
CVE-2026-77520 | Medium | 5.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's application_id fr… |
CVE-2026-77519 | Medium | 5.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only… |
CVE-2026-77518 | Medium | 5.0 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP tool_id in the same… |
CVE-2026-77517 | Medium | 5.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id i… |
CVE-2026-77516 | Medium | 5.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserR… |
CVE-2026-73551 | Medium | 5.3 | 2026-09-21 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization… |
CVE-2026-73511 | Medium | 5.3 | 2026-09-21 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the… |
CVE-2026-59816 | Medium | 4.3 | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST… |
CVE-2026-58272 | Medium | 5.3 | 2026-09-21 | Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepan… |
CVE-2026-58270 | Medium | 6.5 | 2026-09-21 | Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user… |
CVE-2026-55179 | Medium | 6.5 | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/conten… |
CVE-2026-79320 | Medium | 6.1 | 2026-09-21 | Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimen… |
CVE-2026-79319 | Medium | 5.3 | 2026-09-21 | Stencil core 4.43.5 is vulnerable to Incorrect Access Control. |
CVE-2026-79318 | Medium | 6.5 | 2026-09-21 | web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/cont… |
CVE-2026-73549 | Medium | 5.3 | 2026-09-21 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInter… |
CVE-2026-62247 | Medium | 6.5 | 2026-09-21 | Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-… |
CVE-2026-58271 | Medium | 6.8 | 2026-09-21 | Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts… |
CVE-2026-54915 | Medium | 5.4 | 2026-09-21 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.p… |
CVE-2026-50572 | Medium | 5.9 | 2026-09-21 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-auth… |
CVE-2026-48521 | Medium | 5.9 | 2026-09-21 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManager… |
CVE-2026-94494 | Medium | 5.0 | 2026-09-21 | jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info end… |
CVE-2026-94414 | Medium | 5.4 | 2026-09-21 | jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-perm… |
CVE-2026-94413 | Medium | 6.5 | 2026-09-21 | jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any u… |
CVE-2026-91166 | Medium | 5.7 | 2026-09-21 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handl… |
CVE-2026-91164 | Medium | 4.3 | 2026-09-21 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::valida… |
CVE-2026-82165 | Medium | 5.5 | 2026-09-21 | Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker… |
CVE-2026-82163 | Medium | 5.5 | 2026-09-21 | Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local ac… |
CVE-2026-63329 | Medium | 4.9 | 2026-09-21 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a… |
CVE-2026-61749 | Medium | 6.5 | 2026-09-21 | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint r… |
CVE-2026-61748 | Medium | 4.3 | 2026-09-21 | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/… |
CVE-2026-61747 | Medium | 4.3 | 2026-09-21 | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow… |
CVE-2026-61746 | Medium | 5.3 | 2026-09-21 | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPer… |
CVE-2026-61744 | Medium | 6.5 | 2026-09-21 | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a… |
CVE-2026-92382 | Medium | 4.1 | 2026-09-21 | An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer per… |
CVE-2026-69190 | Medium | 6.3 | 2026-09-21 | Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a… |
CVE-2026-61745 | Medium | 4.3 | 2026-09-21 | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py u… |
CVE-2026-61612 | Medium | 5.7 | 2026-09-21 | CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard `validateServerUrl` (added for CVE-2026-33060, extended… |
CVE-2026-48974 | Medium | 5.4 | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a c… |
CVE-2026-77561 | Medium | 5.3 | 2026-09-21 | Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 dist… |
CVE-2026-63373 | Medium | 4.2 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/Ab… |
CVE-2026-63334 | Medium | 6.8 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-s… |
CVE-2026-62987 | Medium | 5.8 | 2026-09-21 | Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses p… |
CVE-2026-62866 | Medium | 6.2 | 2026-09-21 | Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCu… |
CVE-2026-62370 | Medium | 6.5 | 2026-09-21 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2… |
CVE-2026-59168 | Medium | 6.2 | 2026-09-21 | Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decode… |
CVE-2026-58504 | Medium | 6.1 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-… |
CVE-2026-17051 | Medium | 6.0 | 2026-09-21 | The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). It read the peer-wri… |
CVE-2026-17050 | Medium | 5.7 | 2026-09-21 | The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_c… |
CVE-2026-88978 | Medium | 4.3 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pk… |
CVE-2026-77165 | Medium | 6.5 | 2026-09-21 | File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database. |
CVE-2026-63342 | Medium | 6.3 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-r… |
CVE-2026-61681 | Medium | 4.1 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler i… |
CVE-2026-36472 | Medium | 5.2 | 2026-09-21 | CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __referer value 2.0.1 allows a remote attacker to execute arbitrar… |
CVE-2026-36471 | Medium | 5.8 | 2026-09-21 | Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into i… |
CVE-2026-36470 | Medium | 5.8 | 2026-09-21 | CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unesca… |
CVE-2026-36468 | Medium | 6.1 | 2026-09-21 | Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part… |
CVE-2026-93339 | Medium | 5.4 | 2026-09-21 | Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-lev… |
CVE-2026-82355 | Medium | 4.2 | 2026-09-21 | When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie… |
CVE-2026-75158 | Medium | 4.3 | 2026-09-21 | Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authoriz… |
CVE-2026-61630 | Medium | 4.2 | 2026-09-21 | nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reuse… |
CVE-2026-55625 | Medium | 4.9 | 2026-09-21 | GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/i… |
CVE-2026-52743 | Medium | 4.3 | 2026-09-21 | GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belong… |
CVE-2026-94387 | Medium | 5.4 | 2026-09-21 | Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered… |
CVE-2026-94382 | Medium | 4.2 | 2026-09-21 | Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authent… |
CVE-2025-71420 | Medium | 4.3 | 2026-09-21 | UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replie… |
CVE-2025-71419 | Medium | 5.4 | 2026-09-21 | UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMail… |
CVE-2026-94216 | Medium | 4.3 | 2026-09-21 | A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This vulnerability affects the function aut… |
CVE-2026-94214 | Medium | 4.3 | 2026-09-21 | A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the file /login… |
CVE-2026-91867 | Medium | 4.3 | 2026-09-21 | When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fe… |
CVE-2026-94152 | Medium | 4.3 | 2026-09-21 | A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the compone… |
CVE-2026-94151 | Medium | 5.3 | 2026-09-21 | A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the compone… |
CVE-2026-92400 | Medium | 5.3 | 2026-09-21 | The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's… |
CVE-2026-85113 | Medium | 6.5 | 2026-09-21 | The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortc… |
CVE-2026-85010 | Medium | 5.3 | 2026-09-21 | The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in th… |
CVE-2026-94149 | Medium | 4.3 | 2026-09-21 | A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of… |
CVE-2026-94148 | Medium | 5.3 | 2026-09-21 | A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the compone… |
CVE-2026-94215 | Medium | 5.5 | 2026-09-21 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request… |
CVE-2026-94213 | Medium | 4.9 | 2026-09-21 | A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy ev… |
CVE-2026-94138 | Medium | 6.6 | 2026-09-21 | A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /se… |
CVE-2026-94185 | Medium | 5.5 | 2026-09-21 | nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto th… |
CVE-2026-94103 | Medium | 4.7 | 2026-09-21 | A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of the file roocms/site_pagePHP.php of the component Frontend… |
CVE-2026-94102 | Medium | 4.3 | 2026-09-21 | A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulati… |
CVE-2026-94094 | Medium | 4.3 | 2026-09-20 | A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the comp… |
CVE-2026-94093 | Medium | 6.3 | 2026-09-20 | A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/load_replay_buffer/VecNormalize.load of… |
CVE-2026-94092 | Medium | 5.5 | 2026-09-20 | A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file utils.py. Performing a manipulation of t… |
CVE-2026-94091 | Medium | 5.5 | 2026-09-20 | A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file gensim/utils.py of the component Model Lo… |
CVE-2026-94090 | Medium | 6.3 | 2026-09-20 | A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::_parse_debug of the file manape/pe.cpp of the compo… |
CVE-2026-94051 | Medium | 6.3 | 2026-09-20 | A vulnerability was found in 0717376 cowork_bench up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d. Affected by this vulnerability is the function ControlFlowNod… |
CVE-2026-94050 | Medium | 4.3 | 2026-09-20 | A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfg_get/routerd.get_rand_key of the compone… |
CVE-2026-94049 | Medium | 4.3 | 2026-09-20 | A flaw has been found in 06ketan slideshot up to 4.4.0. This impacts the function render_slides of the file packages/cli/src/renderer.ts. This manipulation of… |
CVE-2026-94048 | Medium | 6.6 | 2026-09-20 | A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of the file app/Controllers/UserController.p… |
CVE-2026-94047 | Medium | 6.3 | 2026-09-20 | A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function importTemplate of the file src/services/temp… |
CVE-2026-94046 | Medium | 4.3 | 2026-09-20 | A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. The affected element is the function get_file_snippet of the file getFileSnippet.ts of t… |
CVE-2026-94043 | Medium | 5.3 | 2026-09-20 | A vulnerability was determined in Free5GC up to 4.2.3. This vulnerability affects unknown code of the file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handle… |
CVE-2026-94042 | Medium | 6.3 | 2026-09-20 | A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query… |
CVE-2026-94041 | Medium | 6.3 | 2026-09-20 | A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is some un… |
CVE-2026-94040 | Medium | 5.3 | 2026-09-20 | A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/(app)/apps/settings/… |
CVE-2026-94037 | Medium | 4.3 | 2026-09-20 | A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. This affects the function ControlFlowNode of the… |
CVE-2026-94035 | Medium | 4.3 | 2026-09-20 | A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the file /drug_recommender/index.php. Execu… |