Medium-severity CVEs (page 12)
Page 12 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-94032 | Medium | 6.3 | 2026-09-20 | A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of… |
CVE-2026-94031 | Medium | 6.3 | 2026-09-20 | A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function child_process.exec of the… |
CVE-2026-94028 | Medium | 4.3 | 2026-09-20 | A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the file mealie/routes/households/controll… |
CVE-2026-94113 | Medium | 6.5 | 2026-09-20 | Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to… |
CVE-2026-94112 | Medium | 6.8 | 2026-09-20 | mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Att… |
CVE-2026-94111 | Medium | 6.6 | 2026-09-20 | Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-exte… |
CVE-2026-94108 | Medium | 6.5 | 2026-09-20 | getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on… |
CVE-2026-94105 | Medium | 5.3 | 2026-09-20 | NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to… |
CVE-2026-86555 | Medium | 6.2 | 2026-09-20 | The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtai… |
CVE-2026-93971 | Medium | 5.3 | 2026-09-20 | A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. Impacted is an unknown function of the file backend/sxdevops/settings.py. This manipulation cause… |
CVE-2026-86554 | Medium | 4.3 | 2026-09-20 | SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife applicati… |
CVE-2026-93967 | Medium | 5.5 | 2026-09-20 | A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this issue is the function generate_host_task of the file backend/aiops/services.py of the… |
CVE-2026-93966 | Medium | 4.7 | 2026-09-20 | A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.exec_command of the file backen… |
CVE-2026-92422 | Medium | 6.5 | 2026-09-20 | The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes… |
CVE-2026-92410 | Medium | 4.3 | 2026-09-20 | The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to del… |
CVE-2026-87840 | Medium | 5.3 | 2026-09-20 | The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are addi… |
CVE-2026-87068 | Medium | 6.6 | 2026-09-20 | The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an im… |
CVE-2026-84223 | Medium | 6.8 | 2026-09-20 | The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access a… |
CVE-2026-81653 | Medium | 4.2 | 2026-09-20 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allow… |
CVE-2026-16542 | Medium | 4.1 | 2026-09-20 | The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV imp… |
CVE-2026-14844 | Medium | 6.8 | 2026-09-20 | The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script con… |
CVE-2026-93965 | Medium | 6.6 | 2026-09-20 | A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO… |
CVE-2026-93964 | Medium | 5.3 | 2026-09-20 | A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/… |
CVE-2026-93963 | Medium | 6.3 | 2026-09-20 | A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/department/control… |
CVE-2026-93961 | Medium | 5.3 | 2026-09-20 | A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/u… |
CVE-2026-93960 | Medium | 4.3 | 2026-09-20 | A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of th… |
CVE-2026-86552 | Medium | 5.4 | 2026-09-20 | SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authenticatio… |
CVE-2026-93957 | Medium | 4.3 | 2026-09-20 | A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php… |
CVE-2026-94057 | Medium | 4.0 | 2026-09-19 | Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejec… |
CVE-2026-93988 | Medium | 6.5 | 2026-09-19 | QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read… |
CVE-2026-93955 | Medium | 4.3 | 2026-09-19 | A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file back… |
CVE-2026-93954 | Medium | 4.3 | 2026-09-19 | A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the fi… |
CVE-2026-94001 | Medium | 6.5 | 2026-09-19 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials doe… |
CVE-2026-94000 | Medium | 6.6 | 2026-09-19 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints… |
CVE-2026-93999 | Medium | 4.2 | 2026-09-19 | A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token ref… |
CVE-2026-93984 | Medium | 5.3 | 2026-09-19 | OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue even… |
CVE-2026-93983 | Medium | 5.0 | 2026-09-19 | OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers… |
CVE-2026-93981 | Medium | 4.7 | 2026-09-19 | hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an… |
CVE-2026-9858 | Medium | 4.3 | 2026-09-19 | The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipme… |
CVE-2026-9766 | Medium | 4.3 | 2026-09-19 | The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not… |
CVE-2026-9613 | Medium | 4.3 | 2026-09-19 | The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is… |
CVE-2026-9289 | Medium | 5.3 | 2026-09-19 | The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via t… |
CVE-2026-8354 | Medium | 6.4 | 2026-09-19 | The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions up to, and including… |
CVE-2026-76579 | Medium | 4.7 | 2026-09-19 | The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due… |
CVE-2026-5410 | Medium | 6.4 | 2026-09-19 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is du… |
CVE-2026-1256 | Medium | 6.4 | 2026-09-19 | The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, an… |
CVE-2026-18346 | Medium | 5.3 | 2026-09-19 | The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verif… |
CVE-2026-9855 | Medium | 6.5 | 2026-09-19 | The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'post_ID' parameter in all versions up to, and including, 2.7.8 d… |
CVE-2026-9832 | Medium | 5.3 | 2026-09-19 | The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and… |
CVE-2026-9615 | Medium | 4.3 | 2026-09-19 | The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_flex… |
CVE-2026-9232 | Medium | 6.5 | 2026-09-19 | The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_custome… |
CVE-2026-87917 | Medium | 6.1 | 2026-09-19 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, a… |
CVE-2026-7527 | Medium | 4.7 | 2026-09-19 | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is… |
CVE-2026-75959 | Medium | 4.9 | 2026-09-19 | The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'log_table_filter' parameter in all versions up to, and including… |
CVE-2026-6295 | Medium | 4.9 | 2026-09-19 | The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe… |
CVE-2026-5400 | Medium | 6.4 | 2026-09-19 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.1… |
CVE-2026-4792 | Medium | 5.3 | 2026-09-19 | The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and auth… |
CVE-2026-2422 | Medium | 6.4 | 2026-09-19 | The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwp_raw_shortcode' shortcode in all vers… |
CVE-2026-2278 | Medium | 4.3 | 2026-09-19 | The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vw_writer_blog_reset_all_se… |
CVE-2026-1984 | Medium | 5.3 | 2026-09-19 | The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_… |
CVE-2026-1641 | Medium | 6.5 | 2026-09-19 | The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is d… |
CVE-2026-1242 | Medium | 4.3 | 2026-09-19 | The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and includin… |
CVE-2026-15947 | Medium | 4.3 | 2026-09-19 | The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings()… |
CVE-2026-15946 | Medium | 4.3 | 2026-09-19 | The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass i… |
CVE-2026-15463 | Medium | 6.1 | 2026-09-19 | The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all… |
CVE-2026-15098 | Medium | 6.4 | 2026-09-19 | The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute (and other unsanitized at… |
CVE-2026-13770 | Medium | 6.4 | 2026-09-19 | The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-13200 | Medium | 6.5 | 2026-09-19 | The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficien… |
CVE-2026-13191 | Medium | 6.5 | 2026-09-19 | The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 2.5.3 due to insuffic… |
CVE-2026-12402 | Medium | 4.4 | 2026-09-19 | The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and inclu… |
CVE-2026-11899 | Medium | 4.3 | 2026-09-19 | The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i… |
CVE-2026-11608 | Medium | 6.1 | 2026-09-19 | The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versions up to, and includi… |
CVE-2026-92435 | Medium | 5.3 | 2026-09-19 | The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback f… |
CVE-2026-92430 | Medium | 5.3 | 2026-09-19 | The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook be… |
CVE-2026-92425 | Medium | 5.5 | 2026-09-19 | The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of it… |
CVE-2026-92421 | Medium | 4.7 | 2026-09-19 | The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the… |
CVE-2026-92099 | Medium | 6.5 | 2026-09-19 | The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persiste… |
CVE-2026-91847 | Medium | 4.8 | 2026-09-19 | The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversatio… |
CVE-2026-84750 | Medium | 6.5 | 2026-09-19 | The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, an… |
CVE-2026-19860 | Medium | 5.5 | 2026-09-19 | The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom fie… |
CVE-2026-16557 | Medium | 4.3 | 2026-09-19 | The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJA… |
CVE-2026-92967 | Medium | 6.1 | 2026-09-19 | The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is… |
CVE-2026-89334 | Medium | 6.5 | 2026-09-19 | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to… |
CVE-2026-89333 | Medium | 6.5 | 2026-09-19 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin… |
CVE-2026-89093 | Medium | 5.3 | 2026-09-19 | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all ver… |
CVE-2026-89081 | Medium | 6.1 | 2026-09-19 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all ver… |
CVE-2026-88944 | Medium | 4.3 | 2026-09-19 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. Th… |
CVE-2026-15760 | Medium | 6.5 | 2026-09-19 | The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tabl… |
CVE-2026-15660 | Medium | 4.3 | 2026-09-19 | The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check… |
CVE-2026-12042 | Medium | 4.4 | 2026-09-19 | The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 du… |
CVE-2026-77820 | Medium | 6.4 | 2026-09-19 | The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0… |
CVE-2026-93921 | Medium | 4.3 | 2026-09-19 | SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metada… |
CVE-2026-93574 | Medium | 6.5 | 2026-09-18 | A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size… |
CVE-2026-93562 | Medium | 6.5 | 2026-09-18 | A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smugg… |
CVE-2026-85272 | Medium | 4.3 | 2026-09-18 | Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive… |
CVE-2026-85271 | Medium | 6.1 | 2026-09-18 | Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_… |
CVE-2026-71855 | Medium | 5.9 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash… |
CVE-2026-63448 | Medium | 5.9 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser… |
CVE-2026-61670 | Medium | 6.5 | 2026-09-18 | microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values i… |
CVE-2026-57229 | Medium | 5.3 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME par… |