Medium-severity CVEs (page 15)
Page 15 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-69094 | Medium | 4.3 | 2026-08-03 | Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save_temporary mode of mylist_function.php that allows authenticated us… |
CVE-2026-69093 | Medium | 4.6 | 2026-08-03 | Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration… |
CVE-2026-69092 | Medium | 6.5 | 2026-08-03 | Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the… |
CVE-2026-69090 | Medium | 4.9 | 2026-08-03 | Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deacti… |
CVE-2026-69087 | Medium | 6.5 | 2026-08-03 | The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates use… |
CVE-2026-68585 | Medium | 5.8 | 2026-08-03 | SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including… |
CVE-2026-56609 | Medium | 4.8 | 2026-08-03 | HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and… |
CVE-2026-68742 | Medium | 5.5 | 2026-08-03 | A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body… |
CVE-2026-63563 | Medium | 6.5 | 2026-08-03 | Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configu… |
CVE-2026-62416 | Medium | 5.3 | 2026-08-03 | Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication and accept files un… |
CVE-2026-60011 | Medium | 5.3 | 2026-08-03 | Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product. |
CVE-2026-28147 | Medium | 5.4 | 2026-08-03 | Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Conf… |
CVE-2026-18593 | Medium | 5.6 | 2026-08-03 | A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the c… |
CVE-2026-18592 | Medium | 4.7 | 2026-08-03 | A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/Em… |
CVE-2026-18590 | Medium | 6.3 | 2026-08-03 | A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password H… |
CVE-2026-12259 | Medium | 5.3 | 2026-08-03 | In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforc… |
CVE-2026-9593 | Medium | 6.7 | 2026-08-03 | A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted fi… |
CVE-2026-16565 | Medium | 4.3 | 2026-08-03 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute RE… |
CVE-2026-16564 | Medium | 4.3 | 2026-08-03 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint that perfo… |
CVE-2026-16563 | Medium | 6.5 | 2026-08-03 | The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST AP… |
CVE-2026-16297 | Medium | 4.1 | 2026-08-03 | The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrat… |
CVE-2026-16289 | Medium | 4.3 | 2026-08-03 | The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authent… |
CVE-2026-16057 | Medium | 6.5 | 2026-08-03 | The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only… |
CVE-2026-15931 | Medium | 6.1 | 2026-08-03 | The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor es… |
CVE-2026-15383 | Medium | 6.1 | 2026-08-03 | The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated… |
CVE-2026-15260 | Medium | 4.3 | 2026-08-03 | The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subs… |
CVE-2026-15254 | Medium | 6.5 | 2026-08-03 | The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and… |
CVE-2026-13340 | Medium | 6.1 | 2026-08-03 | The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and se… |
CVE-2025-15673 | Medium | 4.9 | 2026-08-03 | The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowin… |
CVE-2026-6695 | Medium | 5.5 | 2026-08-03 | A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This… |
CVE-2026-6694 | Medium | 5.5 | 2026-08-03 | A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containi… |
CVE-2026-18585 | Medium | 4.3 | 2026-08-03 | A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected… |
CVE-2026-18584 | Medium | 5.4 | 2026-08-03 | A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /… |
CVE-2026-18583 | Medium | 5.3 | 2026-08-03 | A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mms… |
CVE-2026-20498 | Medium | 6.0 | 2026-08-03 | In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2026-20497 | Medium | 6.0 | 2026-08-03 | In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2026-20496 | Medium | 4.4 | 2026-08-03 | In geniezone, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has al… |
CVE-2026-20494 | Medium | 5.5 | 2026-08-03 | In wifi, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already… |
CVE-2026-20493 | Medium | 4.4 | 2026-08-03 | In wifi, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obt… |
CVE-2026-20492 | Medium | 5.5 | 2026-08-03 | In Audio HAL, there is a possible system becoming unresponsive due to a race condition. This could lead to local denial of service with User execution privileg… |
CVE-2026-20491 | Medium | 5.5 | 2026-08-03 | In med, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with User execution privileges nee… |
CVE-2026-20490 | Medium | 4.4 | 2026-08-03 | In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obta… |
CVE-2026-20489 | Medium | 4.4 | 2026-08-03 | In display, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure if a malicious actor has alr… |
CVE-2026-20488 | Medium | 4.4 | 2026-08-03 | In display, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has… |
CVE-2026-20486 | Medium | 6.7 | 2026-08-03 | In imgsensor, there is a possible application crash due to incorrect error handling. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2026-20485 | Medium | 6.0 | 2026-08-03 | In HFRP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alrea… |
CVE-2026-20484 | Medium | 4.4 | 2026-08-03 | In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has… |
CVE-2026-20482 | Medium | 6.5 | 2026-08-03 | In wlan STA FW, there is a possible system becoming unresponsive due to logging. This could lead to remote (proximal/adjacent) denial of service with no additi… |
CVE-2026-20481 | Medium | 6.0 | 2026-08-03 | In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2026-20480 | Medium | 5.5 | 2026-08-03 | In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges… |
CVE-2026-20478 | Medium | 5.5 | 2026-08-03 | In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges… |
CVE-2026-20477 | Medium | 6.0 | 2026-08-03 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2026-20476 | Medium | 5.5 | 2026-08-03 | In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with User execution privileges needed… |
CVE-2026-20475 | Medium | 6.0 | 2026-08-03 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2026-20474 | Medium | 6.0 | 2026-08-03 | In display, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of privilege if a malicious actor has alre… |
CVE-2026-20473 | Medium | 6.0 | 2026-08-03 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2026-20472 | Medium | 4.4 | 2026-08-03 | In TFA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obta… |
CVE-2026-20471 | Medium | 4.6 | 2026-08-03 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service, if an attacker has physical access to… |
CVE-2026-20470 | Medium | 6.2 | 2026-08-03 | In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional… |
CVE-2026-20469 | Medium | 6.0 | 2026-08-03 | In trusted_mem, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious a… |
CVE-2026-20468 | Medium | 6.0 | 2026-08-03 | In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if a malicious actor has alre… |
CVE-2026-20467 | Medium | 6.0 | 2026-08-03 | In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2026-20466 | Medium | 6.1 | 2026-08-03 | In sec boot, there is a possible escalation of privilege due to a heap buffer overflow. This could lead to local escalation of privilege, if an attacker has ph… |
CVE-2026-20464 | Medium | 6.5 | 2026-08-03 | In hevc decoder, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege if a malicious actor has… |
CVE-2026-18582 | Medium | 5.3 | 2026-08-03 | A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function Reporting_RCBWriteAccessHandler of the fi… |
CVE-2026-68583 | Medium | 5.4 | 2026-08-02 | luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inj… |
CVE-2026-68582 | Medium | 6.5 | 2026-08-02 | Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/… |
CVE-2025-71401 | Medium | 5.9 | 2026-08-02 | better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker a… |
CVE-2026-12231 | Medium | 6.4 | 2026-08-02 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_infobox_image’ parameter in all versions up… |
CVE-2026-18573 | Medium | 6.5 | 2026-08-02 | A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a rea… |
CVE-2026-18572 | Medium | 6.5 | 2026-08-02 | Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access du… |
CVE-2026-18571 | Medium | 6.6 | 2026-08-02 | A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator… |
CVE-2026-18570 | Medium | 5.4 | 2026-08-02 | A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security… |
CVE-2026-16292 | Medium | 5.4 | 2026-08-02 | The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attack… |
CVE-2026-16291 | Medium | 4.3 | 2026-08-02 | The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authentica… |
CVE-2026-16273 | Medium | 4.6 | 2026-08-02 | The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing u… |
CVE-2026-16064 | Medium | 5.4 | 2026-08-02 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing… |
CVE-2026-16063 | Medium | 5.4 | 2026-08-02 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editin… |
CVE-2026-16062 | Medium | 6.6 | 2026-08-02 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event con… |
CVE-2026-16042 | Medium | 4.3 | 2026-08-02 | The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Sub… |
CVE-2026-15385 | Medium | 5.4 | 2026-08-02 | The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item set… |
CVE-2026-15248 | Medium | 5.5 | 2026-08-02 | The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with… |
CVE-2026-14938 | Medium | 4.3 | 2026-08-02 | The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is… |
CVE-2026-14864 | Medium | 5.4 | 2026-08-02 | The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Cont… |
CVE-2026-14841 | Medium | 6.1 | 2026-08-02 | The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an u… |
CVE-2026-14817 | Medium | 6.8 | 2026-08-02 | The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled f… |
CVE-2026-13389 | Medium | 6.5 | 2026-08-02 | The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated at… |
CVE-2026-11872 | Medium | 4.3 | 2026-08-02 | The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation… |
CVE-2025-15675 | Medium | 4.8 | 2026-08-02 | The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, a… |
CVE-2026-9335 | Medium | 6.5 | 2026-08-02 | A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The… |
CVE-2026-67355 | Medium | 5.9 | 2026-08-01 | guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as ho… |
CVE-2026-67354 | Medium | 5.9 | 2026-08-01 | guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setti… |
CVE-2026-67353 | Medium | 5.3 | 2026-08-01 | guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no siz… |
CVE-2026-67344 | Medium | 4.3 | 2026-08-01 | ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL opera… |
CVE-2026-67339 | Medium | 5.3 | 2026-08-01 | guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy… |
CVE-2026-67338 | Medium | 6.1 | 2026-08-01 | JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata… |
CVE-2026-67337 | Medium | 6.5 | 2026-08-01 | better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary cr… |
CVE-2026-67335 | Medium | 5.3 | 2026-08-01 | better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Atta… |
CVE-2026-67332 | Medium | 6.4 | 2026-08-01 | @better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelate… |
CVE-2026-67311 | Medium | 6.8 | 2026-08-01 | Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against th… |