Medium-severity CVEs (page 15)
Page 15 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93311 | Medium | 4.3 | 2026-09-18 | A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc o… |
CVE-2026-93310 | Medium | 5.3 | 2026-09-18 | A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocatio… |
CVE-2026-93454 | Medium | 5.4 | 2026-09-18 | Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-t… |
CVE-2026-93451 | Medium | 6.5 | 2026-09-18 | snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompre… |
CVE-2026-93309 | Medium | 4.3 | 2026-09-18 | A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a… |
CVE-2026-93308 | Medium | 4.3 | 2026-09-18 | A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing… |
CVE-2026-2585 | Medium | 6.4 | 2026-09-18 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all versions up to, and includ… |
CVE-2026-18441 | Medium | 4.3 | 2026-09-18 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all… |
CVE-2026-55946 | Medium | 6.1 | 2026-09-17 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose informatio… |
CVE-2026-93307 | Medium | 4.3 | 2026-09-17 | A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argumen… |
CVE-2026-73638 | Medium | 6.2 | 2026-09-17 | Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd. tiff_load_ifd() validates an IFD… |
CVE-2026-54648 | Medium | 6.5 | 2026-09-17 | CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PERM_READ access and d… |
CVE-2026-54645 | Medium | 4.8 | 2026-09-17 | CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_copy rich-t… |
CVE-2026-54644 | Medium | 6.1 | 2026-09-17 | CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in erro… |
CVE-2026-54643 | Medium | 5.4 | 2026-09-17 | CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_i… |
CVE-2026-54613 | Medium | 5.4 | 2026-09-17 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/… |
CVE-2026-50291 | Medium | 5.5 | 2026-09-17 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 an… |
CVE-2026-16750 | Medium | 5.3 | 2026-09-17 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks… |
CVE-2026-16582 | Medium | 5.3 | 2026-09-17 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and in… |
CVE-2026-14311 | Medium | 5.4 | 2026-09-17 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing o… |
CVE-2026-93395 | Medium | 5.3 | 2026-09-17 | A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length pre… |
CVE-2026-93387 | Medium | 4.3 | 2026-09-17 | Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-93386 | Medium | 5.4 | 2026-09-17 | UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via… |
CVE-2026-93385 | Medium | 6.5 | 2026-09-17 | Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium… |
CVE-2026-93383 | Medium | 4.3 | 2026-09-17 | Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-93379 | Medium | 4.3 | 2026-09-17 | Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium se… |
CVE-2026-93376 | Medium | 6.3 | 2026-09-17 | Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52 allowed a local attacker leveraging social engineering to read memory outside the sa… |
CVE-2026-77281 | Medium | 6.5 | 2026-09-17 | Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and… |
CVE-2026-67071 | Medium | 6.5 | 2026-09-17 | HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configure… |
CVE-2026-54918 | Medium | 5.3 | 2026-09-17 | NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOX_DT… |
CVE-2026-54907 | Medium | 5.3 | 2026-09-17 | Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and passwo… |
CVE-2026-54565 | Medium | 4.7 | 2026-09-17 | rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions… |
CVE-2026-54521 | Medium | 6.1 | 2026-09-17 | FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/… |
CVE-2026-50022 | Medium | 5.8 | 2026-09-17 | Metacat is data repository software that helps researchers preserve, share, and discover data. Prior to 3.4.2, MetacatSolrIndex.query forwards the client-contr… |
CVE-2021-3030 | Medium | 6.1 | 2026-09-17 | Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpicker_more.aspx… |
CVE-2026-92993 | Medium | 6.3 | 2026-09-17 | A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/m… |
CVE-2026-92758 | Medium | 5.5 | 2026-09-17 | If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwo… |
CVE-2026-92757 | Medium | 5.5 | 2026-09-17 | Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encrypt… |
CVE-2026-92756 | Medium | 5.5 | 2026-09-17 | Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently… |
CVE-2026-54495 | Medium | 4.3 | 2026-09-17 | The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workloa… |
CVE-2026-92992 | Medium | 6.3 | 2026-09-17 | A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai… |
CVE-2026-52852 | Medium | 6.5 | 2026-09-17 | Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic… |
CVE-2026-92927 | Medium | 5.3 | 2026-09-17 | A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /db/drug_recommendor.sql. Pe… |
CVE-2026-89038 | Medium | 6.2 | 2026-09-17 | Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to wri… |
CVE-2026-54677 | Medium | 6.5 | 2026-09-17 | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in q… |
CVE-2026-54676 | Medium | 6.5 | 2026-09-17 | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spac… |
CVE-2026-54551 | Medium | 4.3 | 2026-09-17 | WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws s… |
CVE-2026-54546 | Medium | 5.0 | 2026-09-17 | CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap e… |
CVE-2026-44235 | Medium | 6.5 | 2026-09-17 | rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during clie… |
CVE-2026-8674 | Medium | 5.3 | 2026-09-17 | Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 cha… |
CVE-2026-85720 | Medium | 5.9 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 a… |
CVE-2026-93015 | Medium | 6.3 | 2026-09-17 | BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can… |
CVE-2026-93013 | Medium | 4.3 | 2026-09-17 | RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authe… |
CVE-2026-92881 | Medium | 4.3 | 2026-09-17 | A security vulnerability has been detected in vgmstream. The affected element is the function init_vgmstream_awb_memory of the file src/meta/awb.c of the compo… |
CVE-2026-86862 | Medium | 6.5 | 2026-09-17 | pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql… |
CVE-2026-86861 | Medium | 5.9 | 2026-09-17 | pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permiss… |
CVE-2026-86000 | Medium | 5.3 | 2026-09-17 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTI… |
CVE-2026-85999 | Medium | 5.3 | 2026-09-17 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw select… |
CVE-2026-85718 | Medium | 5.9 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12… |
CVE-2026-85717 | Medium | 6.8 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and… |
CVE-2026-81868 | Medium | 6.5 | 2026-09-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security… |
CVE-2026-76781 | Medium | 5.5 | 2026-09-17 | A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog pa… |
CVE-2026-75523 | Medium | 5.9 | 2026-09-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Manag… |
CVE-2026-92880 | Medium | 6.3 | 2026-09-17 | A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcm_read_coefs_be of the file src/coding/vadpcm_decoder.c of the component… |
CVE-2026-85078 | Medium | 6.5 | 2026-09-17 | Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part aft… |
CVE-2026-81447 | Medium | 6.8 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with a… |
CVE-2026-63461 | Medium | 5.3 | 2026-09-17 | Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibilit… |
CVE-2026-92973 | Medium | 6.1 | 2026-09-17 | ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets… |
CVE-2026-92963 | Medium | 5.3 | 2026-09-17 | vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access thi… |
CVE-2026-92952 | Medium | 6.8 | 2026-09-17 | vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-san… |
CVE-2026-92949 | Medium | 4.0 | 2026-09-17 | vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze… |
CVE-2026-92945 | Medium | 4.2 | 2026-09-17 | vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored… |
CVE-2026-92936 | Medium | 5.8 | 2026-09-17 | vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the h… |
CVE-2026-92933 | Medium | 5.8 | 2026-09-17 | vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy… |
CVE-2026-92879 | Medium | 4.3 | 2026-09-17 | A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation result… |
CVE-2026-81829 | Medium | 5.3 | 2026-09-17 | A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When th… |
CVE-2026-81453 | Medium | 6.5 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vu… |
CVE-2026-81443 | Medium | 6.4 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with r… |
CVE-2026-80355 | Medium | 5.4 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with… |
CVE-2026-78528 | Medium | 5.3 | 2026-09-17 | Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions. |
CVE-2026-78294 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. |
CVE-2026-74017 | Medium | 5.3 | 2026-09-17 | Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions. |
CVE-2026-74005 | Medium | 5.4 | 2026-09-17 | Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions. |
CVE-2026-74002 | Medium | 5.3 | 2026-09-17 | Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions. |
CVE-2026-74000 | Medium | 5.3 | 2026-09-17 | Contributor Broken Access Control in Simple Membership <= 4.8.2 versions. |
CVE-2026-73999 | Medium | 5.4 | 2026-09-17 | Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions. |
CVE-2026-71568 | Medium | 5.3 | 2026-09-17 | In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself… |
CVE-2026-66676 | Medium | 5.3 | 2026-09-17 | Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions. |
CVE-2026-66617 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions. |
CVE-2026-66608 | Medium | 6.4 | 2026-09-17 | Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions. |
CVE-2026-66579 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions. |
CVE-2026-66578 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions. |
CVE-2026-66577 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions. |
CVE-2026-66576 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions. |
CVE-2026-66575 | Medium | 5.3 | 2026-09-17 | Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions. |
CVE-2026-66574 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions. |
CVE-2026-66573 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions. |
CVE-2026-66572 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions. |
CVE-2026-92921 | Medium | 4.9 | 2026-09-17 | admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database acc… |
CVE-2026-92920 | Medium | 5.4 | 2026-09-17 | admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permi… |