Medium-severity CVEs (page 14)
Page 14 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-61794 | Medium | 6.8 | 2026-09-18 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validat… |
CVE-2026-93737 | Medium | 6.5 | 2026-09-18 | Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule… |
CVE-2026-93736 | Medium | 4.3 | 2026-09-18 | Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe rating… |
CVE-2026-93689 | Medium | 5.5 | 2026-09-18 | WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler that fails to validate the vo… |
CVE-2026-93532 | Medium | 6.3 | 2026-09-18 | A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function ap… |
CVE-2026-93531 | Medium | 4.3 | 2026-09-18 | A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects unknown code. This… |
CVE-2026-86689 | Medium | 5.9 | 2026-09-18 | Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that… |
CVE-2026-84451 | Medium | 6.5 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_un… |
CVE-2026-84450 | Medium | 4.3 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or heig… |
CVE-2026-84448 | Medium | 4.0 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/… |
CVE-2026-81946 | Medium | 4.4 | 2026-09-18 | PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptogra… |
CVE-2026-81945 | Medium | 6.6 | 2026-09-18 | PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in th… |
CVE-2026-81943 | Medium | 6.7 | 2026-09-18 | PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the e… |
CVE-2026-81305 | Medium | 6.8 | 2026-09-18 | CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An attacker with physical… |
CVE-2026-77960 | Medium | 5.3 | 2026-09-18 | Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that… |
CVE-2026-75883 | Medium | 6.8 | 2026-09-18 | The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buf… |
CVE-2026-65970 | Medium | 5.3 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, a crafted… |
CVE-2026-65969 | Medium | 5.5 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0… |
CVE-2026-63635 | Medium | 5.5 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0… |
CVE-2026-63420 | Medium | 5.5 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0… |
CVE-2026-59956 | Medium | 6.1 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0… |
CVE-2026-59181 | Medium | 6.1 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0… |
CVE-2026-59156 | Medium | 6.5 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0… |
CVE-2026-54147 | Medium | 6.5 | 2026-09-18 | http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ign… |
CVE-2026-1037 | Medium | 6.1 | 2026-09-18 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability a… |
CVE-2026-1031 | Medium | 6.1 | 2026-09-18 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability a… |
CVE-2026-1030 | Medium | 4.3 | 2026-09-18 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive informat… |
CVE-2026-1029 | Medium | 5.4 | 2026-09-18 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability a… |
CVE-2026-1025 | Medium | 6.1 | 2026-09-18 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability a… |
CVE-2026-11537 | Medium | 4.3 | 2026-09-18 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer serv… |
CVE-2026-10841 | Medium | 4.2 | 2026-09-18 | IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling. |
CVE-2025-36421 | Medium | 5.9 | 2026-09-18 | IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive informati… |
CVE-2025-36178 | Medium | 5.4 | 2026-09-18 | IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation… |
CVE-2025-36147 | Medium | 6.1 | 2026-09-18 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.16 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2025-36076 | Medium | 4.3 | 2026-09-18 | IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated use… |
CVE-2025-36045 | Medium | 4.3 | 2026-09-18 | IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction f… |
CVE-2025-33147 | Medium | 5.9 | 2026-09-18 | IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information cause… |
CVE-2025-33141 | Medium | 6.5 | 2026-09-18 | IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permis… |
CVE-2026-93685 | Medium | 5.4 | 2026-09-18 | A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in th… |
CVE-2026-93660 | Medium | 6.5 | 2026-09-18 | SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify ot… |
CVE-2026-93653 | Medium | 5.5 | 2026-09-18 | A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutpu… |
CVE-2026-93573 | Medium | 6.5 | 2026-09-18 | A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Tra… |
CVE-2026-93566 | Medium | 6.5 | 2026-09-18 | A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-s… |
CVE-2026-93506 | Medium | 6.3 | 2026-09-18 | A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Uplo… |
CVE-2026-85511 | Medium | 4.2 | 2026-09-18 | A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter… |
CVE-2026-77928 | Medium | 6.5 | 2026-09-18 | ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitti… |
CVE-2026-77927 | Medium | 6.5 | 2026-09-18 | ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by sub… |
CVE-2026-25684 | Medium | 4.4 | 2026-09-18 | A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare… |
CVE-2026-16515 | Medium | 4.7 | 2026-09-18 | net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules (do not answer an ICMPv6 error with… |
CVE-2026-16514 | Medium | 4.3 | 2026-09-18 | gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock… |
CVE-2026-10832 | Medium | 5.9 | 2026-09-18 | A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a special… |
CVE-2025-1350 | Medium | 5.3 | 2026-09-18 | IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical… |
CVE-2025-13882 | Medium | 5.3 | 2026-09-18 | IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner Engagement Manager Sta… |
CVE-2024-56344 | Medium | 5.9 | 2026-09-18 | IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the fail… |
CVE-2026-93602 | Medium | 4.4 | 2026-09-18 | rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against e… |
CVE-2026-93596 | Medium | 4.3 | 2026-09-18 | ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1) fails to bind the authenticated principal onto the DatabaseAsyncTransaction async worker thread… |
CVE-2026-93595 | Medium | 6.5 | 2026-09-18 | ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints. The tool executes quer… |
CVE-2026-93504 | Medium | 6.3 | 2026-09-18 | A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the component User Attribute… |
CVE-2026-93018 | Medium | 5.5 | 2026-09-18 | Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin… |
CVE-2026-79294 | Medium | 6.1 | 2026-09-18 | Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Previe… |
CVE-2026-62282 | Medium | 6.5 | 2026-09-18 | OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validat… |
CVE-2026-93492 | Medium | 5.3 | 2026-09-18 | A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE… |
CVE-2026-93578 | Medium | 5.9 | 2026-09-18 | A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OC… |
CVE-2026-93561 | Medium | 6.5 | 2026-09-18 | A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types ins… |
CVE-2026-90884 | Medium | 5.4 | 2026-09-18 | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 du… |
CVE-2026-15797 | Medium | 6.4 | 2026-09-18 | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scri… |
CVE-2026-56592 | Medium | 6.5 | 2026-09-18 | HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an u… |
CVE-2026-56590 | Medium | 6.4 | 2026-09-18 | HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthent… |
CVE-2026-4036 | Medium | 6.5 | 2026-09-18 | An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) befo… |
CVE-2026-40537 | Medium | 4.3 | 2026-09-18 | A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009… |
CVE-2026-40536 | Medium | 4.3 | 2026-09-18 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (DSM) before 7.2.1… |
CVE-2026-40535 | Medium | 6.5 | 2026-09-18 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2… |
CVE-2026-40534 | Medium | 5.4 | 2026-09-18 | An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation Manager (DSM) before… |
CVE-2026-40533 | Medium | 5.3 | 2026-09-18 | An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806… |
CVE-2026-40532 | Medium | 6.5 | 2026-09-18 | A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009… |
CVE-2026-40531 | Medium | 4.3 | 2026-09-18 | An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2… |
CVE-2026-21848 | Medium | 5.0 | 2026-09-18 | HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access… |
CVE-2026-21822 | Medium | 6.3 | 2026-09-18 | HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticat… |
CVE-2026-13635 | Medium | 5.3 | 2026-09-18 | An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4… |
CVE-2026-13623 | Medium | 4.8 | 2026-09-18 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before… |
CVE-2025-13533 | Medium | 4.4 | 2026-09-18 | The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment… |
CVE-2026-93493 | Medium | 5.9 | 2026-09-18 | A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Prot… |
CVE-2026-92622 | Medium | 6.4 | 2026-09-18 | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute in all versions up to, and i… |
CVE-2026-92554 | Medium | 6.1 | 2026-09-18 | The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String… |
CVE-2026-92249 | Medium | 6.1 | 2026-09-18 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1… |
CVE-2026-90981 | Medium | 6.1 | 2026-09-18 | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions… |
CVE-2026-85652 | Medium | 6.5 | 2026-09-18 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in… |
CVE-2026-75961 | Medium | 4.9 | 2026-09-18 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all ve… |
CVE-2026-17607 | Medium | 6.5 | 2026-09-18 | The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up… |
CVE-2026-17586 | Medium | 6.4 | 2026-09-18 | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta in all versions up… |
CVE-2026-16777 | Medium | 4.9 | 2026-09-18 | The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up… |
CVE-2026-15004 | Medium | 5.4 | 2026-09-18 | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versi… |
CVE-2026-14472 | Medium | 6.4 | 2026-09-18 | The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versions up to, and includ… |
CVE-2026-13471 | Medium | 4.3 | 2026-09-18 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up t… |
CVE-2026-12739 | Medium | 4.3 | 2026-09-18 | The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-11757 | Medium | 6.1 | 2026-09-18 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Webs… |
CVE-2026-92714 | Medium | 6.5 | 2026-09-18 | The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() functi… |
CVE-2026-92561 | Medium | 6.1 | 2026-09-18 | The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11… |
CVE-2026-91707 | Medium | 5.3 | 2026-09-18 | The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allow… |
CVE-2026-90977 | Medium | 5.3 | 2026-09-18 | The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to… |