Medium-severity CVEs (page 16)
Page 16 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73999 | Medium | 5.4 | 2026-09-17 | Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions. |
CVE-2026-71568 | Medium | 5.3 | 2026-09-17 | In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself… |
CVE-2026-66676 | Medium | 5.3 | 2026-09-17 | Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions. |
CVE-2026-66617 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions. |
CVE-2026-66608 | Medium | 6.4 | 2026-09-17 | Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions. |
CVE-2026-66579 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions. |
CVE-2026-66578 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions. |
CVE-2026-66577 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions. |
CVE-2026-66576 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions. |
CVE-2026-66575 | Medium | 5.3 | 2026-09-17 | Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions. |
CVE-2026-66574 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions. |
CVE-2026-66573 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions. |
CVE-2026-66572 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions. |
CVE-2026-92921 | Medium | 4.9 | 2026-09-17 | admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database acc… |
CVE-2026-92920 | Medium | 5.4 | 2026-09-17 | admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permi… |
CVE-2026-92904 | Medium | 4.3 | 2026-09-17 | A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocat… |
CVE-2026-92912 | Medium | 6.5 | 2026-09-17 | AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entr… |
CVE-2026-81479 | Medium | 5.8 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local acce… |
CVE-2026-81441 | Medium | 4.0 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated att… |
CVE-2026-78296 | Medium | 5.3 | 2026-09-17 | Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing. This issue affects FluentAuth: from n/… |
CVE-2026-92893 | Medium | 4.3 | 2026-09-17 | A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not en… |
CVE-2026-92894 | Medium | 4.3 | 2026-09-17 | A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying… |
CVE-2026-78427 | Medium | 4.3 | 2026-09-17 | The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar i… |
CVE-2026-87831 | Medium | 4.3 | 2026-09-17 | The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before de… |
CVE-2026-87829 | Medium | 4.3 | 2026-09-17 | The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before de… |
CVE-2026-90982 | Medium | 5.3 | 2026-09-17 | @fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such… |
CVE-2026-44940 | Medium | 5.7 | 2026-09-17 | The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them… |
CVE-2026-91019 | Medium | 4.9 | 2026-09-17 | The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing user… |
CVE-2026-91016 | Medium | 5.3 | 2026-09-17 | The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowin… |
CVE-2026-91015 | Medium | 5.3 | 2026-09-17 | The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder po… |
CVE-2026-91011 | Medium | 6.8 | 2026-09-17 | The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated use… |
CVE-2026-91010 | Medium | 4.3 | 2026-09-17 | The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message del… |
CVE-2026-91009 | Medium | 4.3 | 2026-09-17 | The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actio… |
CVE-2026-90923 | Medium | 6.5 | 2026-09-17 | The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete… |
CVE-2026-90922 | Medium | 5.3 | 2026-09-17 | The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pendin… |
CVE-2026-86824 | Medium | 4.8 | 2026-09-17 | The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unk… |
CVE-2026-86788 | Medium | 6.8 | 2026-09-17 | The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widge… |
CVE-2026-25261 | Medium | 6.7 | 2026-09-17 | Memory corruption while processing rear sensor IOCTL calls. |
CVE-2026-92839 | Medium | 4.3 | 2026-09-17 | Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin conte… |
CVE-2026-86311 | Medium | 6.4 | 2026-09-17 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in al… |
CVE-2026-89064 | Medium | 5.3 | 2026-09-17 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This i… |
CVE-2026-61589 | Medium | 6.3 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mo… |
CVE-2026-61588 | Medium | 6.5 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django `Model` in… |
CVE-2026-92598 | Medium | 6.5 | 2026-09-16 | Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punyco… |
CVE-2026-92597 | Medium | 6.5 | 2026-09-16 | Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break… |
CVE-2026-92595 | Medium | 5.9 | 2026-09-16 | Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message conte… |
CVE-2026-92591 | Medium | 5.9 | 2026-09-16 | Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — includin… |
CVE-2026-92590 | Medium | 5.4 | 2026-09-16 | Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescapin… |
CVE-2026-92589 | Medium | 4.3 | 2026-09-16 | Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control… |
CVE-2026-92588 | Medium | 4.4 | 2026-09-16 | n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push f… |
CVE-2026-92587 | Medium | 5.0 | 2026-09-16 | n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured rep… |
CVE-2026-92586 | Medium | 4.3 | 2026-09-16 | AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authen… |
CVE-2026-92585 | Medium | 4.3 | 2026-09-16 | AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in u… |
CVE-2026-92584 | Medium | 6.1 | 2026-09-16 | AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoA… |
CVE-2026-92583 | Medium | 6.5 | 2026-09-16 | AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to… |
CVE-2026-92581 | Medium | 4.3 | 2026-09-16 | In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchroni… |
CVE-2026-92579 | Medium | 5.4 | 2026-09-16 | In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin file… |
CVE-2026-89034 | Medium | 6.5 | 2026-09-16 | TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows a… |
CVE-2026-64684 | Medium | 6.8 | 2026-09-16 | RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common… |
CVE-2026-92814 | Medium | 4.2 | 2026-09-16 | changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malici… |
CVE-2026-92813 | Medium | 4.9 | 2026-09-16 | Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopbac… |
CVE-2026-92812 | Medium | 6.8 | 2026-09-16 | decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator valid… |
CVE-2026-92811 | Medium | 6.5 | 2026-09-16 | browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders t… |
CVE-2026-92810 | Medium | 4.3 | 2026-09-16 | PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retriev… |
CVE-2026-92809 | Medium | 4.3 | 2026-09-16 | PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers c… |
CVE-2026-92803 | Medium | 5.3 | 2026-09-16 | LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. Attackers can… |
CVE-2026-92802 | Medium | 4.3 | 2026-09-16 | kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking… |
CVE-2026-92800 | Medium | 6.8 | 2026-09-16 | Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can re… |
CVE-2026-92795 | Medium | 6.5 | 2026-09-16 | Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch inter… |
CVE-2026-92790 | Medium | 6.5 | 2026-09-16 | Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action… |
CVE-2026-92789 | Medium | 6.5 | 2026-09-16 | Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers wi… |
CVE-2026-92781 | Medium | 6.3 | 2026-09-16 | Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttribu… |
CVE-2026-92778 | Medium | 5.4 | 2026-09-16 | CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers… |
CVE-2026-92775 | Medium | 6.5 | 2026-09-16 | Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host… |
CVE-2026-92774 | Medium | 4.3 | 2026-09-16 | Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attacke… |
CVE-2026-92771 | Medium | 6.5 | 2026-09-16 | Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permissio… |
CVE-2026-92770 | Medium | 6.5 | 2026-09-16 | Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit… |
CVE-2026-92765 | Medium | 6.5 | 2026-09-16 | ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings… |
CVE-2026-92764 | Medium | 4.3 | 2026-09-16 | OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's m… |
CVE-2026-92760 | Medium | 6.5 | 2026-09-16 | Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics… |
CVE-2026-92759 | Medium | 6.5 | 2026-09-16 | SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password… |
CVE-2026-92754 | Medium | 4.3 | 2026-09-16 | PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented… |
CVE-2026-92750 | Medium | 6.5 | 2026-09-16 | Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configura… |
CVE-2026-92527 | Medium | 6.3 | 2026-09-16 | A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbacks_controller.rb of the component Shopify OAuth. T… |
CVE-2026-76451 | Medium | 4.9 | 2026-09-16 | A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to con… |
CVE-2026-76450 | Medium | 4.9 | 2026-09-16 | A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to con… |
CVE-2026-76449 | Medium | 4.9 | 2026-09-16 | A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to con… |
CVE-2026-76448 | Medium | 4.9 | 2026-09-16 | A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to con… |
CVE-2026-76447 | Medium | 5.3 | 2026-09-16 | A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to ca… |
CVE-2026-76446 | Medium | 4.9 | 2026-09-16 | A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific files on the underlying operating… |
CVE-2026-76444 | Medium | 5.3 | 2026-09-16 | A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration infor… |
CVE-2026-76439 | Medium | 5.3 | 2026-09-16 | A vulnerability in the endpoint posture status reporting functionality of the guest portal web application of Cisco ISE could allow an unauthenticated, remote… |
CVE-2026-76438 | Medium | 6.5 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low… |
CVE-2026-76434 | Medium | 4.9 | 2026-09-16 | A vulnerability in the certificate import functionality of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remo… |
CVE-2026-76433 | Medium | 5.3 | 2026-09-16 | A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected… |
CVE-2026-76432 | Medium | 4.9 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level pr… |
CVE-2026-76431 | Medium | 4.9 | 2026-09-16 | A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attac… |
CVE-2026-76428 | Medium | 4.9 | 2026-09-16 | A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the sess… |
CVE-2026-76427 | Medium | 4.9 | 2026-09-16 | A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an a… |
CVE-2026-76426 | Medium | 4.9 | 2026-09-16 | A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monit… |