Medium-severity CVEs (page 14)
Page 14 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18775 | Medium | 6.3 | 2026-08-04 | A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browser_snapshot of the file tools/browser_to… |
CVE-2026-18774 | Medium | 6.3 | 2026-08-04 | A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file agent/image_gen_provider.py of the compon… |
CVE-2026-15920 | Medium | 6.1 | 2026-08-04 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickab… |
CVE-2026-15830 | Medium | 5.3 | 2026-08-04 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-o… |
CVE-2026-15337 | Medium | 5.3 | 2026-08-04 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-s… |
CVE-2026-24078 | Medium | 6.5 | 2026-08-04 | Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling. |
CVE-2026-24077 | Medium | 6.5 | 2026-08-04 | Information Disclosure when processing wireless network channel switch information with improperly formatted length fields. |
CVE-2026-24076 | Medium | 6.7 | 2026-08-04 | Memory Corruption when processing registry values with incorrect types using a direct query method. |
CVE-2026-18773 | Medium | 6.3 | 2026-08-04 | A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function _check_slash_access of the file gateway/run.py… |
CVE-2026-67618 | Medium | 6.5 | 2026-08-04 | marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious ba… |
CVE-2026-67199 | Medium | 6.5 | 2026-08-04 | Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted e… |
CVE-2026-67196 | Medium | 5.4 | 2026-08-04 | Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by w… |
CVE-2026-18766 | Medium | 6.3 | 2026-08-04 | A flaw has been found in chetans9 core-php-admin-panel up to 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f. This issue affects some unknown processing of the file /… |
CVE-2026-70368 | Medium | 6.5 | 2026-08-04 | A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attac… |
CVE-2026-70367 | Medium | 5.4 | 2026-08-04 | A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to… |
CVE-2026-63248 | Medium | 6.5 | 2026-08-04 | In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics o… |
CVE-2026-18809 | Medium | 6.5 | 2026-08-04 | Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3. |
CVE-2026-18772 | Medium | 6.5 | 2026-08-04 | Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion. |
CVE-2026-14465 | Medium | 6.5 | 2026-08-04 | Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs (a… |
CVE-2026-14219 | Medium | 5.4 | 2026-08-04 | URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Ph… |
CVE-2026-14202 | Medium | 5.3 | 2026-08-04 | Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. … |
CVE-2026-14194 | Medium | 6.5 | 2026-08-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digita… |
CVE-2026-14192 | Medium | 5.4 | 2026-08-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST… |
CVE-2026-16548 | Medium | 6.5 | 2026-08-04 | The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type… |
CVE-2026-16547 | Medium | 5.9 | 2026-08-04 | The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check… |
CVE-2026-16546 | Medium | 4.3 | 2026-08-04 | The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the… |
CVE-2026-16536 | Medium | 5.3 | 2026-08-04 | The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, a… |
CVE-2026-16296 | Medium | 4.7 | 2026-08-04 | The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI… |
CVE-2026-16295 | Medium | 4.3 | 2026-08-04 | The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user s… |
CVE-2026-16293 | Medium | 6.8 | 2026-08-04 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could all… |
CVE-2026-16069 | Medium | 6.8 | 2026-08-04 | The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before s… |
CVE-2026-16056 | Medium | 4.3 | 2026-08-04 | The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down… |
CVE-2026-16035 | Medium | 4.3 | 2026-08-04 | The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the… |
CVE-2026-15233 | Medium | 4.8 | 2026-08-04 | The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing s… |
CVE-2026-14939 | Medium | 6.8 | 2026-08-04 | The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with… |
CVE-2026-14872 | Medium | 6.8 | 2026-08-04 | The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a… |
CVE-2026-14848 | Medium | 5.4 | 2026-08-04 | The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout… |
CVE-2026-14824 | Medium | 4.8 | 2026-08-04 | The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribu… |
CVE-2026-14816 | Medium | 6.5 | 2026-08-04 | The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-co… |
CVE-2026-12698 | Medium | 4.3 | 2026-08-04 | The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a su… |
CVE-2026-10526 | Medium | 5.8 | 2026-08-04 | The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowi… |
CVE-2026-18723 | Medium | 6.3 | 2026-08-04 | A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-sta… |
CVE-2026-18722 | Medium | 6.3 | 2026-08-04 | A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw… |
CVE-2026-18721 | Medium | 4.3 | 2026-08-04 | A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SS… |
CVE-2026-8508 | Medium | 6.5 | 2026-08-04 | An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacke… |
CVE-2026-18720 | Medium | 5.3 | 2026-08-04 | A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the compone… |
CVE-2026-17614 | Medium | 4.4 | 2026-08-04 | A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in wildfly-… |
CVE-2026-18719 | Medium | 6.3 | 2026-08-04 | A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the file sar2html.py of the component Search. Performing a manipulation… |
CVE-2026-58045 | Medium | 6.2 | 2026-08-04 | A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process t… |
CVE-2026-58042 | Medium | 5.9 | 2026-08-04 | A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this co… |
CVE-2026-58041 | Medium | 5.3 | 2026-08-04 | A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statem… |
CVE-2026-66326 | Medium | 6.5 | 2026-08-04 | Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-66325 | Medium | 6.1 | 2026-08-04 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-66317 | Medium | 5.4 | 2026-08-04 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-66316 | Medium | 5.4 | 2026-08-04 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-66314 | Medium | 6.5 | 2026-08-04 | Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-66313 | Medium | 6.8 | 2026-08-04 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally. |
CVE-2026-66312 | Medium | 6.5 | 2026-08-04 | Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network. |
CVE-2026-66311 | Medium | 6.2 | 2026-08-04 | Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally. |
CVE-2026-65804 | Medium | 6.1 | 2026-08-04 | Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-67673 | Medium | 4.6 | 2026-08-03 | A stack-based buffer overflow vulnerability exists in the cmd_edl function of OreSat Firmware v1.0. The vulnerability is triggered when processing the edl fw_f… |
CVE-2026-67617 | Medium | 4.8 | 2026-08-03 | Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to i… |
CVE-2026-67616 | Medium | 4.3 | 2026-08-03 | Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-pr… |
CVE-2026-69245 | Medium | 6.5 | 2026-08-03 | Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of a cookie Domain that cookie unless SetC… |
CVE-2026-52520 | Medium | 5.4 | 2026-08-03 | Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php). A remote authenticated at… |
CVE-2026-49132 | Medium | 5.4 | 2026-08-03 | OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embed… |
CVE-2026-49131 | Medium | 5.4 | 2026-08-03 | OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inj… |
CVE-2026-48061 | Medium | 5.9 | 2026-08-03 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omit… |
CVE-2026-18738 | Medium | 4.7 | 2026-08-03 | Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas in… |
CVE-2026-18737 | Medium | 6.5 | 2026-08-03 | Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated… |
CVE-2026-18736 | Medium | 5.0 | 2026-08-03 | Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests… |
CVE-2026-18648 | Medium | 5.3 | 2026-08-03 | A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of… |
CVE-2026-18646 | Medium | 5.3 | 2026-08-03 | A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name… |
CVE-2026-18645 | Medium | 5.4 | 2026-08-03 | A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add_content of the file /system/admin/admin.php of the component Ad… |
CVE-2026-62354 | Medium | 4.3 | 2026-08-03 | Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parame… |
CVE-2026-58139 | Medium | 6.5 | 2026-08-03 | The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract pla… |
CVE-2026-18655 | Medium | 6.5 | 2026-08-03 | Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before 2.0.24 may… |
CVE-2026-18654 | Medium | 6.8 | 2026-08-03 | Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-… |
CVE-2026-18644 | Medium | 5.4 | 2026-08-03 | A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delet… |
CVE-2026-18632 | Medium | 6.3 | 2026-08-03 | A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/code_executor/… |
CVE-2026-18631 | Medium | 6.3 | 2026-08-03 | A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/jav… |
CVE-2026-38446 | Medium | 6.1 | 2026-08-03 | A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input… |
CVE-2026-38444 | Medium | 6.1 | 2026-08-03 | osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is extracted without sanitization in incl… |
CVE-2025-15631 | Medium | 5.9 | 2026-08-03 | A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficien… |
CVE-2025-15630 | Medium | 5.9 | 2026-08-03 | A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimat… |
CVE-2025-15544 | Medium | 5.9 | 2026-08-03 | A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmit… |
CVE-2026-40717 | Medium | 6.6 | 2026-08-03 | Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with… |
CVE-2025-9291 | Medium | 6.5 | 2026-08-03 | A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not ad… |
CVE-2026-69153 | Medium | 5.3 | 2026-08-03 | PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from i… |
CVE-2026-69151 | Medium | 6.1 | 2026-08-03 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19… |
CVE-2026-69149 | Medium | 6.1 | 2026-08-03 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19… |
CVE-2026-68945 | Medium | 6.1 | 2026-08-03 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19… |
CVE-2026-68930 | Medium | 6.5 | 2026-08-03 | Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opene… |
CVE-2026-67612 | Medium | 4.8 | 2026-08-03 | OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to in… |
CVE-2026-18610 | Medium | 5.3 | 2026-08-03 | A vulnerability was detected in NewType WebEIP up to 3.0. This affects an unknown part of the file /EIP_Com_FileList.aspx. The manipulation results in improper… |
CVE-2026-18604 | Medium | 5.3 | 2026-08-03 | A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogi… |
CVE-2026-18477 | Medium | 4.4 | 2026-08-03 | A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a director… |
CVE-2026-18651 | Medium | 5.4 | 2026-08-03 | A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account… |
CVE-2026-18508 | Medium | 4.4 | 2026-08-03 | A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level director… |
CVE-2026-15430 | Medium | 6.2 | 2026-08-03 | Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker t… |