Medium-severity CVEs (page 13)
Page 13 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-71246 | Medium | 4.3 | 2026-08-05 | Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchServ… |
CVE-2026-71244 | Medium | 6.5 | 2026-08-05 | Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, account_type… |
CVE-2026-71240 | Medium | 4.3 | 2026-08-05 | DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to… |
CVE-2026-14574 | Medium | 6.5 | 2026-08-05 | In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values witho… |
CVE-2026-14304 | Medium | 5.5 | 2026-08-05 | In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versi… |
CVE-2026-15452 | Medium | 4.7 | 2026-08-05 | The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query Strin… |
CVE-2026-7726 | Medium | 6.5 | 2026-08-05 | The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync… |
CVE-2026-7441 | Medium | 6.4 | 2026-08-05 | The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `posttype` attribute of the `SimpleYearlyArchive` shortcode… |
CVE-2026-7105 | Medium | 4.3 | 2026-08-05 | The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` functi… |
CVE-2026-71212 | Medium | 4.4 | 2026-08-05 | xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or sca… |
CVE-2026-71210 | Medium | 5.3 | 2026-08-05 | Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules… |
CVE-2026-71208 | Medium | 6.5 | 2026-08-05 | KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection conf… |
CVE-2026-71205 | Medium | 6.5 | 2026-08-05 | changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-at… |
CVE-2026-71204 | Medium | 6.2 | 2026-08-05 | changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .u… |
CVE-2026-71203 | Medium | 5.3 | 2026-08-05 | changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource regi… |
CVE-2026-6972 | Medium | 6.4 | 2026-08-05 | The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `chart_size` attribute of the `skillwrapper` shortcode in all versi… |
CVE-2026-5651 | Medium | 4.9 | 2026-08-05 | The Askeet plugin for WordPress is vulnerable to SQL Injection via the 'sql_query' parameter in multiple AJAX actions (askeet_execute_sql_query, askeet_export_… |
CVE-2026-5116 | Medium | 4.4 | 2026-08-05 | The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This… |
CVE-2026-5108 | Medium | 4.4 | 2026-08-05 | The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `superpwa_settings[offline_message_txt]` setting in al… |
CVE-2026-55998 | Medium | 5.3 | 2026-08-05 | The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that ha… |
CVE-2026-55996 | Medium | 4.3 | 2026-08-05 | A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters a… |
CVE-2026-55747 | Medium | 6.8 | 2026-08-05 | The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.join(workdir, p) wrapper with no canonicalization o… |
CVE-2026-17532 | Medium | 6.1 | 2026-08-05 | The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter in versions up to, and i… |
CVE-2026-17505 | Medium | 6.1 | 2026-08-05 | The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to… |
CVE-2026-15281 | Medium | 6.5 | 2026-08-05 | The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wp_ajax_save-attachment-compat AJAX acti… |
CVE-2026-11977 | Medium | 6.5 | 2026-08-05 | The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpma_met… |
CVE-2026-11969 | Medium | 4.9 | 2026-08-05 | The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via 'curselrevs[]' Parameter in all versions up to, and including… |
CVE-2026-11920 | Medium | 4.9 | 2026-08-05 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in… |
CVE-2026-11454 | Medium | 6.5 | 2026-08-05 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and i… |
CVE-2026-71201 | Medium | 5.0 | 2026-08-05 | In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another… |
CVE-2026-68080 | Medium | 6.5 | 2026-08-05 | It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-68078 | Medium | 6.5 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-68077 | Medium | 6.5 | 2026-08-05 | An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial… |
CVE-2026-68075 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Broke… |
CVE-2026-67591 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proto… |
CVE-2026-67555 | Medium | 6.5 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-67554 | Medium | 6.5 | 2026-08-05 | An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial… |
CVE-2026-67553 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proto… |
CVE-2026-66277 | Medium | 6.5 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-66276 | Medium | 6.5 | 2026-08-05 | An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial… |
CVE-2026-66275 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proto… |
CVE-2026-49004 | Medium | 6.5 | 2026-08-05 | The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a speci… |
CVE-2026-17515 | Medium | 4.3 | 2026-08-05 | The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX ac… |
CVE-2026-16981 | Medium | 5.3 | 2026-08-05 | The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership chec… |
CVE-2026-16968 | Medium | 6.5 | 2026-08-05 | The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with… |
CVE-2026-16942 | Medium | 5.4 | 2026-08-05 | The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed… |
CVE-2026-16613 | Medium | 4.3 | 2026-08-05 | The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no… |
CVE-2026-16583 | Medium | 6.1 | 2026-08-05 | The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files w… |
CVE-2026-8790 | Medium | 6.1 | 2026-08-05 | The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget in all version… |
CVE-2026-7753 | Medium | 6.5 | 2026-08-05 | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the `cost-calculat… |
CVE-2026-66839 | Medium | 6.7 | 2026-08-05 | NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability (CWE-428). An authenticated attacke… |
CVE-2026-66344 | Medium | 6.7 | 2026-08-05 | NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability (CWE-427). An authenticated attack… |
CVE-2026-5062 | Medium | 4.9 | 2026-08-05 | The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via t… |
CVE-2026-18903 | Medium | 4.3 | 2026-08-05 | A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects some unknown processing of the file src/m… |
CVE-2026-15941 | Medium | 6.5 | 2026-08-05 | The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX h… |
CVE-2026-11421 | Medium | 6.5 | 2026-08-05 | The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parame… |
CVE-2026-18896 | Medium | 6.3 | 2026-08-05 | A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0. The affected element is an unknown function of the file /student/changepass.p… |
CVE-2026-18856 | Medium | 4.7 | 2026-08-05 | A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer… |
CVE-2026-45705 | Medium | 5.3 | 2026-08-05 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the mult… |
CVE-2026-18853 | Medium | 5.3 | 2026-08-05 | A security vulnerability has been detected in ZomboDroid Meme Generator App 4.6830 on Android. This issue affects the function t5.l.c of the component com.zomb… |
CVE-2026-18103 | Medium | 4.9 | 2026-08-05 | A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not… |
CVE-2026-18819 | Medium | 4.3 | 2026-08-04 | A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The ma… |
CVE-2026-18818 | Medium | 6.3 | 2026-08-04 | A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the… |
CVE-2026-70620 | Medium | 6.8 | 2026-08-04 | Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe intern… |
CVE-2026-70594 | Medium | 6.7 | 2026-08-04 | Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for s… |
CVE-2026-70593 | Medium | 6.6 | 2026-08-04 | Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the upl… |
CVE-2026-70592 | Medium | 5.5 | 2026-08-04 | Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem th… |
CVE-2026-70591 | Medium | 4.1 | 2026-08-04 | Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level use… |
CVE-2026-70590 | Medium | 4.8 | 2026-08-04 | Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghos… |
CVE-2026-70589 | Medium | 4.8 | 2026-08-04 | Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no lon… |
CVE-2026-52370 | Medium | 6.1 | 2026-08-04 | A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context… |
CVE-2026-51144 | Medium | 6.1 | 2026-08-04 | Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role… |
CVE-2026-18816 | Medium | 5.0 | 2026-08-04 | A vulnerability was identified in Baserow up to 2.3.2. Affected by this vulnerability is the function verify of the file backend/src/baserow/api/two_factor_aut… |
CVE-2026-70588 | Medium | 5.0 | 2026-08-04 | Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported conten… |
CVE-2026-70493 | Medium | 6.5 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/op… |
CVE-2026-70491 | Medium | 6.5 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, an… |
CVE-2026-70490 | Medium | 6.3 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/open_web… |
CVE-2026-70489 | Medium | 6.5 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_we… |
CVE-2026-70488 | Medium | 4.3 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write acces… |
CVE-2026-70487 | Medium | 5.3 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-sup… |
CVE-2026-54020 | Medium | 6.3 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and… |
CVE-2026-70484 | Medium | 4.3 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trust… |
CVE-2026-70481 | Medium | 5.4 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete h… |
CVE-2026-70480 | Medium | 4.1 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced co… |
CVE-2026-48154 | Medium | 5.9 | 2026-08-04 | GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains… |
CVE-2026-16792 | Medium | 6.1 | 2026-08-04 | An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent… |
CVE-2026-69704 | Medium | 6.5 | 2026-08-04 | Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to… |
CVE-2026-69702 | Medium | 6.5 | 2026-08-04 | SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplyi… |
CVE-2026-68743 | Medium | 5.5 | 2026-08-04 | A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer siz… |
CVE-2026-66300 | Medium | 5.0 | 2026-08-04 | SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaSc… |
CVE-2026-47622 | Medium | 5.3 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that contain sensitive information. A successfu… |
CVE-2026-47621 | Medium | 6.5 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful expl… |
CVE-2026-47620 | Medium | 6.5 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful expl… |
CVE-2026-47619 | Medium | 6.6 | 2026-08-04 | NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure. A successful exploit of this vulnerability… |
CVE-2026-47487 | Medium | 4.4 | 2026-08-04 | NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modifi… |
CVE-2026-48121 | Medium | 6.7 | 2026-08-04 | @langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vuln… |
CVE-2026-18785 | Medium | 5.3 | 2026-08-04 | A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UA_Client_getRemoteDataTypes of the file exam… |
CVE-2026-18784 | Medium | 5.3 | 2026-08-04 | A vulnerability was found in o6 open62541 up to 1.5.5. This issue affects the function UA_Client_readNodeClassAttribute of the file src/client/ua_client_highle… |
CVE-2026-18775 | Medium | 6.3 | 2026-08-04 | A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browser_snapshot of the file tools/browser_to… |
CVE-2026-18774 | Medium | 6.3 | 2026-08-04 | A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file agent/image_gen_provider.py of the compon… |