Medium-severity CVEs (page 16)
Page 16 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-67311 | Medium | 6.8 | 2026-08-01 | Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against th… |
CVE-2026-67310 | Medium | 5.4 | 2026-08-01 | OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResou… |
CVE-2026-67307 | Medium | 6.3 | 2026-08-01 | Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override the cluster_name and cluster_node fields in inventory-sync Start FlatBuffer messages, wh… |
CVE-2026-67306 | Medium | 5.4 | 2026-08-01 | FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and… |
CVE-2026-67303 | Medium | 4.3 | 2026-08-01 | FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) in serial_process_irp_device_control() in channels/ser… |
CVE-2026-67302 | Medium | 4.3 | 2026-08-01 | FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_st… |
CVE-2026-67295 | Medium | 6.3 | 2026-08-01 | FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside th… |
CVE-2026-67294 | Medium | 5.9 | 2026-08-01 | FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_u… |
CVE-2026-67293 | Medium | 4.2 | 2026-08-01 | FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hos… |
CVE-2026-67292 | Medium | 6.5 | 2026-08-01 | FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Po… |
CVE-2026-2411 | Medium | 6.5 | 2026-08-01 | Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BT_GATT_PE… |
CVE-2026-10773 | Medium | 5.4 | 2026-08-01 | The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char * name table after a faulty bounds… |
CVE-2026-6453 | Medium | 6.5 | 2026-08-01 | The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitiza… |
CVE-2026-18435 | Medium | 6.4 | 2026-08-01 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' Block Attribu… |
CVE-2026-18344 | Medium | 6.1 | 2026-08-01 | The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding… |
CVE-2026-18062 | Medium | 6.4 | 2026-08-01 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image… |
CVE-2026-18059 | Medium | 5.3 | 2026-08-01 | The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ… |
CVE-2026-17605 | Medium | 6.6 | 2026-08-01 | The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includ… |
CVE-2026-17580 | Medium | 6.5 | 2026-08-01 | The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPre… |
CVE-2026-17571 | Medium | 6.1 | 2026-08-01 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting… |
CVE-2026-17555 | Medium | 4.9 | 2026-08-01 | The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the export_data parameter in versions up to, and including, 0.9.131. Thi… |
CVE-2026-16685 | Medium | 6.4 | 2026-08-01 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3… |
CVE-2026-16684 | Medium | 6.4 | 2026-08-01 | The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to, and incl… |
CVE-2026-16614 | Medium | 4.9 | 2026-08-01 | The GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all… |
CVE-2026-16091 | Medium | 6.4 | 2026-08-01 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2026-16090 | Medium | 6.4 | 2026-08-01 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2026-16087 | Medium | 6.5 | 2026-08-01 | The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Parameter in… |
CVE-2026-15951 | Medium | 4.9 | 2026-08-01 | The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insu… |
CVE-2026-15950 | Medium | 6.4 | 2026-08-01 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2026-15662 | Medium | 6.4 | 2026-08-01 | The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bg_color' paramete… |
CVE-2026-15649 | Medium | 6.4 | 2026-08-01 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to… |
CVE-2026-15645 | Medium | 6.4 | 2026-08-01 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions… |
CVE-2026-15644 | Medium | 6.4 | 2026-08-01 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all version… |
CVE-2026-15601 | Medium | 4.9 | 2026-08-01 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and incl… |
CVE-2026-15018 | Medium | 5.3 | 2026-08-01 | The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to… |
CVE-2026-13458 | Medium | 6.4 | 2026-08-01 | The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and in… |
CVE-2026-11995 | Medium | 5.3 | 2026-08-01 | The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass i… |
CVE-2026-10782 | Medium | 4.3 | 2026-08-01 | The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not… |
CVE-2025-14073 | Medium | 5.3 | 2026-08-01 | The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versio… |
CVE-2026-2916 | Medium | 4.3 | 2026-08-01 | The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scr… |
CVE-2025-14469 | Medium | 4.3 | 2026-08-01 | The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce valid… |
CVE-2026-15932 | Medium | 5.3 | 2026-08-01 | The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attack… |
CVE-2026-15262 | Medium | 5.4 | 2026-08-01 | The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin lis… |
CVE-2026-15234 | Medium | 5.4 | 2026-08-01 | The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering… |
CVE-2026-14840 | Medium | 5.3 | 2026-08-01 | The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when en… |
CVE-2026-14822 | Medium | 5.3 | 2026-08-01 | The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, all… |
CVE-2026-14561 | Medium | 6.5 | 2026-08-01 | The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid ve… |
CVE-2026-14315 | Medium | 6.5 | 2026-08-01 | The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticat… |
CVE-2026-14292 | Medium | 5.4 | 2026-08-01 | The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowin… |
CVE-2026-13729 | Medium | 4.3 | 2026-08-01 | The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing… |
CVE-2026-13604 | Medium | 5.3 | 2026-08-01 | The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, tha… |
CVE-2026-13329 | Medium | 6.5 | 2026-08-01 | The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that process… |
CVE-2026-12966 | Medium | 5.3 | 2026-08-01 | The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenti… |
CVE-2026-12696 | Medium | 5.4 | 2026-08-01 | The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public pa… |
CVE-2025-15669 | Medium | 4.8 | 2026-08-01 | The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, al… |
CVE-2026-7623 | Medium | 6.4 | 2026-08-01 | The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrappe… |
CVE-2026-15403 | Medium | 4.9 | 2026-08-01 | The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and includin… |
CVE-2026-13362 | Medium | 6.4 | 2026-08-01 | The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_code Post Meta in all versions up to, a… |
CVE-2026-54909 | Medium | 5.3 | 2026-07-31 | pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in… |
CVE-2026-54785 | Medium | 6.2 | 2026-07-31 | gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in i… |
CVE-2026-45377 | Medium | 6.5 | 2026-07-31 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data… |
CVE-2026-45376 | Medium | 5.5 | 2026-07-31 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/us… |
CVE-2026-45330 | Medium | 4.9 | 2026-07-31 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verifica… |
CVE-2026-52371 | Medium | 6.5 | 2026-07-31 | A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supp… |
CVE-2026-52232 | Medium | 6.1 | 2026-07-31 | A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to execute arb… |
CVE-2026-45086 | Medium | 5.4 | 2026-07-31 | Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demograph… |
CVE-2026-62324 | Medium | 5.4 | 2026-07-31 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl… |
CVE-2026-18321 | Medium | 4.7 | 2026-07-31 | Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd |
CVE-2026-34497 | Medium | 5.4 | 2026-07-31 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting… |
CVE-2026-34495 | Medium | 5.4 | 2026-07-31 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. … |
CVE-2026-34490 | Medium | 5.5 | 2026-07-31 | Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compro… |
CVE-2026-54707 | Medium | 5.4 | 2026-07-31 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6… |
CVE-2026-54706 | Medium | 4.8 | 2026-07-31 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6… |
CVE-2026-67607 | Medium | 5.9 | 2026-07-31 | LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE-2024-11144) in the worker_thread_cleanup() function of ftpserv.c tha… |
CVE-2026-56569 | Medium | 4.0 | 2026-07-31 | HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web serve… |
CVE-2026-56567 | Medium | 5.1 | 2026-07-31 | HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper… |
CVE-2026-52857 | Medium | 5.5 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configurati… |
CVE-2026-17350 | Medium | 5.4 | 2026-07-31 | The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce its permission check consistently. In… |
CVE-2026-17348 | Medium | 6.5 | 2026-07-31 | In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-m… |
CVE-2026-10686 | Medium | 5.8 | 2026-07-31 | Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6_route_packet() (subsys… |
CVE-2025-62347 | Medium | 4.3 | 2026-07-31 | HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was… |
CVE-2026-67350 | Medium | 4.3 | 2026-07-31 | Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external site… |
CVE-2026-28145 | Medium | 5.3 | 2026-07-31 | Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy… |
CVE-2026-28144 | Medium | 4.3 | 2026-07-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: f… |
CVE-2026-64607 | Medium | 5.3 | 2026-07-31 | HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or un… |
CVE-2026-44615 | Medium | 6.5 | 2026-07-31 | Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or acce… |
CVE-2026-17567 | Medium | 5.3 | 2026-07-31 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Referen… |
CVE-2026-18437 | Medium | 5.3 | 2026-07-31 | The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on th… |
CVE-2026-18436 | Medium | 5.3 | 2026-07-31 | The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint… |
CVE-2026-65311 | Medium | 5.3 | 2026-07-31 | The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging le… |
CVE-2026-18218 | Medium | 4.2 | 2026-07-31 | A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific appl… |
CVE-2026-18215 | Medium | 6.8 | 2026-07-31 | Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where… |
CVE-2026-18214 | Medium | 6.8 | 2026-07-31 | Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where… |
CVE-2026-18211 | Medium | 4.2 | 2026-07-31 | A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requireme… |
CVE-2026-18208 | Medium | 6.5 | 2026-07-31 | A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solutio… |
CVE-2026-18203 | Medium | 6.5 | 2026-07-31 | A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions… |
CVE-2026-16105 | Medium | 4.9 | 2026-07-31 | A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properl… |
CVE-2026-8155 | Medium | 5.4 | 2026-07-31 | The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subs… |
CVE-2026-15209 | Medium | 6.5 | 2026-07-31 | The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can… |
CVE-2026-14931 | Medium | 6.5 | 2026-07-31 | The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check… |