Medium-severity CVEs (page 17)
Page 17 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14928 | Medium | 6.5 | 2026-07-31 | The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated sea… |
CVE-2026-14922 | Medium | 6.1 | 2026-07-31 | WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encod… |
CVE-2026-14921 | Medium | 6.1 | 2026-07-31 | The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(), |
CVE-2026-14847 | Medium | 4.3 | 2026-07-31 | The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowi… |
CVE-2026-14845 | Medium | 6.1 | 2026-07-31 | The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outp… |
CVE-2026-14843 | Medium | 5.3 | 2026-07-31 | The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthentica… |
CVE-2026-14834 | Medium | 6.5 | 2026-07-31 | The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the sit… |
CVE-2026-14833 | Medium | 6.8 | 2026-07-31 | The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox captio… |
CVE-2026-14554 | Medium | 6.5 | 2026-07-31 | The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with ad… |
CVE-2026-14317 | Medium | 5.3 | 2026-07-31 | The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part f… |
CVE-2026-12697 | Medium | 5.4 | 2026-07-31 | The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowi… |
CVE-2026-12376 | Medium | 4.3 | 2026-07-31 | The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber… |
CVE-2026-63220 | Medium | 4.8 | 2026-07-31 | CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End-Https header… |
CVE-2026-62323 | Medium | 6.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token… |
CVE-2026-55499 | Medium | 4.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the ow… |
CVE-2026-55497 | Medium | 6.5 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but… |
CVE-2026-55496 | Medium | 4.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predic… |
CVE-2026-55495 | Medium | 4.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a… |
CVE-2026-43833 | Medium | 5.3 | 2026-07-31 | Full details and mitigation steps are currently restricted and will be published at a later date. |
CVE-2026-14540 | Medium | 6.1 | 2026-07-31 | A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. Wh… |
CVE-2026-66720 | Medium | 6.5 | 2026-07-30 | The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages… |
CVE-2026-66369 | Medium | 6.5 | 2026-07-30 | The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus… |
CVE-2026-66364 | Medium | 6.5 | 2026-07-30 | The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When… |
CVE-2026-66349 | Medium | 6.5 | 2026-07-30 | The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER… |
CVE-2026-65421 | Medium | 6.5 | 2026-07-30 | The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read… |
CVE-2026-63550 | Medium | 6.5 | 2026-07-30 | The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded eleme… |
CVE-2026-63362 | Medium | 5.9 | 2026-07-30 | An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted U… |
CVE-2026-63033 | Medium | 6.5 | 2026-07-30 | A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one b… |
CVE-2026-61893 | Medium | 6.5 | 2026-07-30 | A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of… |
CVE-2026-56758 | Medium | 6.5 | 2026-07-30 | The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, a… |
CVE-2026-10031 | Medium | 4.2 | 2026-07-30 | SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbol… |
CVE-2026-68563 | Medium | 5.5 | 2026-07-30 | A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is… |
CVE-2026-68562 | Medium | 6.2 | 2026-07-30 | A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When… |
CVE-2026-64816 | Medium | 6.5 | 2026-07-30 | RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lut… |
CVE-2026-62845 | Medium | 4.7 | 2026-07-30 | Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolati… |
CVE-2026-5846 | Medium | 5.7 | 2026-07-30 | The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and en… |
CVE-2026-68501 | Medium | 6.5 | 2026-07-30 | Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank… |
CVE-2026-68499 | Medium | 6.2 | 2026-07-30 | re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 patter… |
CVE-2026-61526 | Medium | 6.1 | 2026-07-30 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the er… |
CVE-2025-65342 | Medium | 6.1 | 2026-07-30 | code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field. |
CVE-2025-65341 | Medium | 6.1 | 2026-07-30 | Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php. |
CVE-2026-67550 | Medium | 5.7 | 2026-07-30 | re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject b… |
CVE-2026-67530 | Medium | 6.4 | 2026-07-30 | WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/automations/engine.ts and its validatio… |
CVE-2026-67529 | Medium | 4.3 | 2026-07-30 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workP… |
CVE-2026-67528 | Medium | 4.3 | 2026-07-30 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resolved CustomOption records by global nume… |
CVE-2026-65835 | Medium | 6.6 | 2026-07-30 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItem… |
CVE-2026-65834 | Medium | 6.8 | 2026-07-30 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and Capsule… |
CVE-2026-10569 | Medium | 4.3 | 2026-07-30 | IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8… |
CVE-2025-51684 | Medium | 6.1 | 2026-07-30 | CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before… |
CVE-2026-15974 | Medium | 6.5 | 2026-07-30 | SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to interna… |
CVE-2026-14227 | Medium | 4.9 | 2026-07-30 | An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could… |
CVE-2026-11904 | Medium | 5.3 | 2026-07-30 | IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-10700 | Medium | 6.5 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user fi… |
CVE-2026-10695 | Medium | 6.2 | 2026-07-30 | IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced federated queries. |
CVE-2025-36374 | Medium | 5.5 | 2026-07-30 | IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerabili… |
CVE-2025-0152 | Medium | 6.1 | 2026-07-30 | IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting… |
CVE-2024-40683 | Medium | 6.3 | 2026-07-30 | IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3… |
CVE-2026-66414 | Medium | 6.1 | 2026-07-30 | Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitra… |
CVE-2026-54522 | Medium | 5.4 | 2026-07-30 | MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c lea… |
CVE-2026-67596 | Medium | 6.2 | 2026-07-30 | CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secre… |
CVE-2026-58216 | Medium | 5.3 | 2026-07-30 | An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-enc… |
CVE-2026-48910 | Medium | 6.5 | 2026-07-30 | A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the… |
CVE-2026-44617 | Medium | 6.5 | 2026-07-30 | LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RF… |
CVE-2026-44616 | Medium | 6.5 | 2026-07-30 | LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an… |
CVE-2026-44613 | Medium | 6.1 | 2026-07-30 | Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted te… |
CVE-2026-23985 | Medium | 6.5 | 2026-07-30 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_pa… |
CVE-2026-23981 | Medium | 4.3 | 2026-07-30 | An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do… |
CVE-2026-15657 | Medium | 6.5 | 2026-07-30 | A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body. |
CVE-2026-67347 | Medium | 6.8 | 2026-07-30 | Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts u… |
CVE-2026-41187 | Medium | 6.5 | 2026-07-30 | Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNet… |
CVE-2026-11383 | Medium | 5.4 | 2026-07-30 | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console. |
CVE-2025-36431 | Medium | 5.4 | 2026-07-30 | IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.0_1 is vulnerable to cross-site scripting. This vulne… |
CVE-2025-36298 | Medium | 5.4 | 2026-07-30 | IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling Fil… |
CVE-2026-58218 | Medium | 5.3 | 2026-07-30 | A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A rem… |
CVE-2026-54364 | Medium | 6.5 | 2026-07-30 | CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embe… |
CVE-2026-7260 | Medium | 5.5 | 2026-07-30 | Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* bef… |
CVE-2026-5582 | Medium | 4.3 | 2026-07-30 | The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verifi… |
CVE-2026-18382 | Medium | 6.8 | 2026-07-30 | A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary… |
CVE-2026-18369 | Medium | 5.8 | 2026-07-30 | A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects… |
CVE-2026-18362 | Medium | 5.9 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks. |
CVE-2026-16971 | Medium | 5.9 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks. |
CVE-2026-16970 | Medium | 4.2 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be mi… |
CVE-2026-44105 | Medium | 6.6 | 2026-07-30 | The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to auth… |
CVE-2026-44103 | Medium | 5.3 | 2026-07-30 | An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates with… |
CVE-2026-44102 | Medium | 5.3 | 2026-07-30 | An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file… |
CVE-2026-64635 | Medium | 5.3 | 2026-07-30 | Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control th… |
CVE-2026-59328 | Medium | 4.2 | 2026-07-30 | Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untru… |
CVE-2026-59327 | Medium | 4.4 | 2026-07-30 | Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain string attribute on the "Spring Boot DevTools… |
CVE-2026-58040 | Medium | 6.3 | 2026-07-30 | An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-202… |
CVE-2026-56850 | Medium | 4.1 | 2026-07-30 | A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requ… |
CVE-2026-16531 | Medium | 5.3 | 2026-07-30 | An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary… |
CVE-2026-16530 | Medium | 6.5 | 2026-07-30 | A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sendi… |
CVE-2026-15382 | Medium | 6.5 | 2026-07-30 | The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploa… |
CVE-2026-15257 | Medium | 5.3 | 2026-07-30 | The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allo… |
CVE-2026-15255 | Medium | 5.3 | 2026-07-30 | The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being… |
CVE-2026-15252 | Medium | 5.4 | 2026-07-30 | The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user… |
CVE-2026-15250 | Medium | 5.3 | 2026-07-30 | The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its public book… |
CVE-2026-15235 | Medium | 4.3 | 2026-07-30 | The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its… |
CVE-2026-15153 | Medium | 6.8 | 2026-07-30 | The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query… |
CVE-2026-14923 | Medium | 6.5 | 2026-07-30 | The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates pos… |