Medium-severity CVEs (page 17)
Page 17 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20350 | Medium | 4.7 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to inject arbitrary… |
CVE-2026-20309 | Medium | 6.1 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a refl… |
CVE-2026-20290 | Medium | 5.8 | 2026-09-16 | A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenti… |
CVE-2026-20287 | Medium | 6.5 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connec… |
CVE-2026-20286 | Medium | 4.3 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco Identify Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of… |
CVE-2026-20285 | Medium | 4.3 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an… |
CVE-2026-20283 | Medium | 6.5 | 2026-09-16 | A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operat… |
CVE-2026-20282 | Medium | 4.9 | 2026-09-16 | A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the underlying operating system of an affected device. … |
CVE-2026-20248 | Medium | 6.8 | 2026-09-16 | A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense… |
CVE-2026-20235 | Medium | 4.9 | 2026-09-16 | A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view sensitive information on an affected d… |
CVE-2026-20121 | Medium | 5.3 | 2026-09-16 | A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software a… |
CVE-2026-20120 | Medium | 5.8 | 2026-09-16 | A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software a… |
CVE-2026-20072 | Medium | 4.9 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from network u… |
CVE-2025-56566 | Medium | 4.6 | 2026-09-16 | MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker with physical acce… |
CVE-2026-92526 | Medium | 6.3 | 2026-09-16 | A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/leave/index.php. Executing a manipulati… |
CVE-2026-92475 | Medium | 5.3 | 2026-09-16 | A weakness has been identified in GPAC 26.08-DEV. This impacts the function wait_for_header_and_parse of the file src/utils/downloader.c. This manipulation of… |
CVE-2026-87116 | Medium | 6.5 | 2026-09-16 | Tanium addressed a server-side request forgery vulnerability in Threat Response. |
CVE-2026-87113 | Medium | 6.3 | 2026-09-16 | Tanium addressed an improper access controls vulnerability in Threat Response. |
CVE-2026-87076 | Medium | 6.5 | 2026-09-16 | Tanium addressed an information disclosure vulnerability in Discover. |
CVE-2026-82561 | Medium | 6.5 | 2026-09-16 | Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering… |
CVE-2026-81866 | Medium | 4.3 | 2026-09-16 | Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets… |
CVE-2026-62949 | Medium | 6.5 | 2026-09-16 | AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prio… |
CVE-2026-92417 | Medium | 6.5 | 2026-09-16 | A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogs_pfcp_parse_volume_measurement in the library lib/pfcp/types.c of the component… |
CVE-2026-81176 | Medium | 5.3 | 2026-09-16 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does… |
CVE-2026-75025 | Medium | 4.7 | 2026-09-16 | Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing loca… |
CVE-2026-73462 | Medium | 6.5 | 2026-09-16 | On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjace… |
CVE-2026-73457 | Medium | 5.3 | 2026-09-16 | Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials… |
CVE-2026-73443 | Medium | 4.7 | 2026-09-16 | On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on wh… |
CVE-2026-63225 | Medium | 4.4 | 2026-09-16 | Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths unde… |
CVE-2026-92605 | Medium | 6.5 | 2026-09-16 | IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers wi… |
CVE-2026-92416 | Medium | 4.3 | 2026-09-16 | A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smf_n4_handle_session_report_request of the file src/smf/n4-handl… |
CVE-2026-92413 | Medium | 4.3 | 2026-09-16 | A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the fi… |
CVE-2026-88593 | Medium | 6.1 | 2026-09-16 | kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent re… |
CVE-2026-84397 | Medium | 5.4 | 2026-09-16 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-69147 | Medium | 6.5 | 2026-09-16 | vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.v… |
CVE-2026-18120 | Medium | 5.9 | 2026-09-16 | Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries() permissio… |
CVE-2026-92603 | Medium | 6.5 | 2026-09-16 | ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete o… |
CVE-2026-92601 | Medium | 6.5 | 2026-09-16 | Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by… |
CVE-2026-92600 | Medium | 6.5 | 2026-09-16 | Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermiss… |
CVE-2026-92402 | Medium | 6.3 | 2026-09-16 | A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the function index of the file UserCo… |
CVE-2026-87028 | Medium | 6.5 | 2026-09-16 | Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the request… |
CVE-2026-86358 | Medium | 6.5 | 2026-09-16 | Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with adjacent netw… |
CVE-2026-85732 | Medium | 4.7 | 2026-09-16 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-… |
CVE-2026-85386 | Medium | 6.1 | 2026-09-16 | Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated b… |
CVE-2026-84993 | Medium | 6.5 | 2026-09-16 | MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 and 7.1.7, the shared SQL layer validate… |
CVE-2026-59944 | Medium | 6.1 | 2026-09-16 | Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the… |
CVE-2026-57173 | Medium | 6.5 | 2026-09-16 | vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v1/chat/completions calls AudioMediaIO.l… |
CVE-2026-92615 | Medium | 6.6 | 2026-09-16 | A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include Insecu… |
CVE-2026-76104 | Medium | 5.5 | 2026-09-16 | Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability in the OS. A high privileged attac… |
CVE-2026-26947 | Medium | 6.7 | 2026-09-16 | Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Improper Privilege Management vulnerability. A high priv… |
CVE-2026-19607 | Medium | 5.3 | 2026-09-16 | A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when… |
CVE-2026-92616 | Medium | 6.8 | 2026-09-16 | FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and wr… |
CVE-2026-92570 | Medium | 6.5 | 2026-09-16 | reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled rec… |
CVE-2026-92569 | Medium | 4.3 | 2026-09-16 | Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress param… |
CVE-2026-92568 | Medium | 5.4 | 2026-09-16 | MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows authenticated users to make the API se… |
CVE-2026-92567 | Medium | 6.5 | 2026-09-16 | TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated user… |
CVE-2026-92565 | Medium | 5.3 | 2026-09-16 | Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addr… |
CVE-2026-92383 | Medium | 4.3 | 2026-09-16 | A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserController::mod of the fil… |
CVE-2026-89031 | Medium | 5.4 | 2026-09-16 | Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_po… |
CVE-2026-88976 | Medium | 6.1 | 2026-09-16 | Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deseri… |
CVE-2026-84859 | Medium | 6.5 | 2026-09-16 | ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing… |
CVE-2026-77401 | Medium | 6.8 | 2026-09-16 | Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessCon… |
CVE-2026-77119 | Medium | 5.9 | 2026-09-16 | A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned ans… |
CVE-2026-75029 | Medium | 5.3 | 2026-09-16 | In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on… |
CVE-2026-61709 | Medium | 5.3 | 2026-09-16 | OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded w… |
CVE-2026-19668 | Medium | 5.3 | 2026-09-16 | A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default… |
CVE-2026-19033 | Medium | 6.5 | 2026-09-16 | For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG… |
CVE-2025-36591 | Medium | 4.4 | 2026-09-16 | Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Use of a Broken or Risky Cryptographic Algorithm vulnera… |
CVE-2026-92468 | Medium | 6.5 | 2026-09-16 | zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to… |
CVE-2026-92365 | Medium | 4.3 | 2026-09-16 | A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_st… |
CVE-2026-92364 | Medium | 6.3 | 2026-09-16 | A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/empl… |
CVE-2026-92363 | Medium | 4.3 | 2026-09-16 | A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sse_parser.cpp of the component JSON Parser. Executin… |
CVE-2026-92141 | Medium | 4.3 | 2026-09-16 | Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks. |
CVE-2026-92140 | Medium | 6.8 | 2026-09-16 | Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cro… |
CVE-2026-92139 | Medium | 6.5 | 2026-09-16 | Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bit… |
CVE-2026-92138 | Medium | 4.2 | 2026-09-16 | The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather… |
CVE-2026-92133 | Medium | 5.4 | 2026-09-16 | Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key deriv… |
CVE-2026-92132 | Medium | 5.4 | 2026-09-16 | Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity… |
CVE-2026-92131 | Medium | 4.2 | 2026-09-16 | Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative… |
CVE-2026-89030 | Medium | 4.3 | 2026-09-16 | Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2s_search_… |
CVE-2026-89029 | Medium | 4.3 | 2026-09-16 | Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX ha… |
CVE-2026-78301 | Medium | 5.8 | 2026-09-16 | A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND auth… |
CVE-2026-56719 | Medium | 6.5 | 2026-09-16 | MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the… |
CVE-2026-19941 | Medium | 5.9 | 2026-09-16 | An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream le… |
CVE-2026-19662 | Medium | 5.9 | 2026-09-16 | An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zon… |
CVE-2026-92361 | Medium | 4.3 | 2026-09-16 | A security vulnerability has been detected in ag-ui-protocol ag-ui 1.0. This affects an unknown function of the file sdks/community/go/pkg/client/sse/client.go… |
CVE-2026-92360 | Medium | 6.3 | 2026-09-16 | A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the compone… |
CVE-2026-92463 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out… |
CVE-2026-92462 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to… |
CVE-2026-92461 | Medium | 4.3 | 2026-09-16 | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office… |
CVE-2026-92460 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to acces… |
CVE-2026-92459 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office… |
CVE-2026-92458 | Medium | 4.3 | 2026-09-16 | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users… |
CVE-2026-92457 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office… |
CVE-2026-92455 | Medium | 4.3 | 2026-09-16 | yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office u… |
CVE-2026-92357 | Medium | 4.3 | 2026-09-16 | A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processo… |
CVE-2026-92356 | Medium | 4.3 | 2026-09-16 | A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component… |
CVE-2026-86107 | Medium | 5.9 | 2026-09-16 | The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This… |
CVE-2026-84501 | Medium | 5.3 | 2026-09-16 | An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request… |
CVE-2026-84439 | Medium | 5.3 | 2026-09-16 | When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sendi… |