Medium-severity CVEs (page 18)
Page 18 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-89030 | Medium | 4.3 | 2026-09-16 | Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2s_search_… |
CVE-2026-89029 | Medium | 4.3 | 2026-09-16 | Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX ha… |
CVE-2026-78301 | Medium | 5.8 | 2026-09-16 | A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND auth… |
CVE-2026-56719 | Medium | 6.5 | 2026-09-16 | MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the… |
CVE-2026-19941 | Medium | 5.9 | 2026-09-16 | An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream le… |
CVE-2026-19662 | Medium | 5.9 | 2026-09-16 | An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zon… |
CVE-2026-92361 | Medium | 4.3 | 2026-09-16 | A security vulnerability has been detected in ag-ui-protocol ag-ui 1.0. This affects an unknown function of the file sdks/community/go/pkg/client/sse/client.go… |
CVE-2026-92360 | Medium | 6.3 | 2026-09-16 | A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the compone… |
CVE-2026-92463 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out… |
CVE-2026-92462 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to… |
CVE-2026-92461 | Medium | 4.3 | 2026-09-16 | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office… |
CVE-2026-92460 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to acces… |
CVE-2026-92459 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office… |
CVE-2026-92458 | Medium | 4.3 | 2026-09-16 | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users… |
CVE-2026-92457 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office… |
CVE-2026-92455 | Medium | 4.3 | 2026-09-16 | yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office u… |
CVE-2026-92357 | Medium | 4.3 | 2026-09-16 | A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processo… |
CVE-2026-92356 | Medium | 4.3 | 2026-09-16 | A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component… |
CVE-2026-86107 | Medium | 5.9 | 2026-09-16 | The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This… |
CVE-2026-84501 | Medium | 5.3 | 2026-09-16 | An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request… |
CVE-2026-84439 | Medium | 5.3 | 2026-09-16 | When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sendi… |
CVE-2026-77190 | Medium | 6.5 | 2026-09-16 | On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mod… |
CVE-2026-73469 | Medium | 5.8 | 2026-09-16 | When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the int… |
CVE-2026-73468 | Medium | 6.5 | 2026-09-16 | A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast tr… |
CVE-2026-73440 | Medium | 4.2 | 2026-09-16 | On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a… |
CVE-2026-73438 | Medium | 5.3 | 2026-09-16 | On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast… |
CVE-2026-73436 | Medium | 6.5 | 2026-09-16 | On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor ma… |
CVE-2026-19640 | Medium | 4.2 | 2026-09-16 | On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization… |
CVE-2026-92081 | Medium | 5.9 | 2026-09-16 | fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is s… |
CVE-2026-86465 | Medium | 6.5 | 2026-09-16 | Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag… |
CVE-2026-85501 | Medium | 5.3 | 2026-09-16 | Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service w… |
CVE-2026-82720 | Medium | 5.9 | 2026-09-16 | NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. Duri… |
CVE-2026-80225 | Medium | 5.3 | 2026-09-16 | In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on… |
CVE-2026-78227 | Medium | 6.5 | 2026-09-16 | NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each… |
CVE-2026-77955 | Medium | 4.4 | 2026-09-16 | In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a… |
CVE-2026-73463 | Medium | 5.3 | 2026-09-16 | On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz se… |
CVE-2026-73445 | Medium | 4.9 | 2026-09-16 | On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which w… |
CVE-2026-92091 | Medium | 5.9 | 2026-09-16 | A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexit… |
CVE-2026-89207 | Medium | 6.5 | 2026-09-16 | A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17). Affected devices… |
CVE-2026-86341 | Medium | 4.4 | 2026-09-16 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain cond… |
CVE-2026-81326 | Medium | 5.5 | 2026-09-16 | QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to… |
CVE-2026-27553 | Medium | 6.5 | 2026-09-16 | A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user co… |
CVE-2026-8030 | Medium | 4.3 | 2026-09-16 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain co… |
CVE-2026-86475 | Medium | 5.3 | 2026-09-16 | The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its ow… |
CVE-2026-84906 | Medium | 5.3 | 2026-09-16 | The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment… |
CVE-2026-7514 | Medium | 4.3 | 2026-09-16 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that an authenticated… |
CVE-2026-19857 | Medium | 4.8 | 2026-09-16 | The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a s… |
CVE-2026-19619 | Medium | 4.7 | 2026-09-16 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain co… |
CVE-2026-16794 | Medium | 4.3 | 2026-09-16 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain cond… |
CVE-2026-13407 | Medium | 5.4 | 2026-09-16 | The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including the… |
CVE-2024-11222 | Medium | 6.4 | 2026-09-16 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain co… |
CVE-2026-92358 | Medium | 6.4 | 2026-09-16 | A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is cre… |
CVE-2026-88910 | Medium | 5.3 | 2026-09-16 | The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently dele… |
CVE-2026-87959 | Medium | 5.4 | 2026-09-16 | The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with… |
CVE-2026-87907 | Medium | 5.3 | 2026-09-16 | The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category r… |
CVE-2026-87896 | Medium | 5.3 | 2026-09-16 | The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent (staff) records… |
CVE-2026-87860 | Medium | 4.3 | 2026-09-16 | The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attacke… |
CVE-2026-87854 | Medium | 5.3 | 2026-09-16 | The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing un… |
CVE-2026-87828 | Medium | 5.7 | 2026-09-16 | The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated… |
CVE-2026-86823 | Medium | 5.3 | 2026-09-16 | The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthen… |
CVE-2026-86784 | Medium | 6.8 | 2026-09-16 | The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart edit… |
CVE-2026-86449 | Medium | 5.3 | 2026-09-16 | The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST rout… |
CVE-2026-86447 | Medium | 5.3 | 2026-09-16 | The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attack… |
CVE-2026-86445 | Medium | 5.3 | 2026-09-16 | The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated a… |
CVE-2026-85641 | Medium | 4.3 | 2026-09-16 | The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on th… |
CVE-2026-85572 | Medium | 4.3 | 2026-09-16 | The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any aut… |
CVE-2026-85349 | Medium | 4.3 | 2026-09-16 | The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authe… |
CVE-2026-85131 | Medium | 6.5 | 2026-09-16 | The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, a… |
CVE-2026-84088 | Medium | 6.8 | 2026-09-16 | The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a… |
CVE-2026-82125 | Medium | 5.3 | 2026-09-16 | The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before ret… |
CVE-2026-82124 | Medium | 5.3 | 2026-09-16 | The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the… |
CVE-2026-78474 | Medium | 5.3 | 2026-09-16 | The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines… |
CVE-2026-77702 | Medium | 5.3 | 2026-09-16 | The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards… |
CVE-2026-76559 | Medium | 4.1 | 2026-09-16 | The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with… |
CVE-2026-76558 | Medium | 6.8 | 2026-09-16 | The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of o… |
CVE-2026-76557 | Medium | 6.8 | 2026-09-16 | The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statem… |
CVE-2026-76556 | Medium | 6.8 | 2026-09-16 | The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, a… |
CVE-2026-76555 | Medium | 6.8 | 2026-09-16 | The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessibl… |
CVE-2026-76553 | Medium | 6.5 | 2026-09-16 | The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directo… |
CVE-2026-5920 | Medium | 6.4 | 2026-09-16 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode_content' parameter of the bt_bb_shortcode shortcode… |
CVE-2026-18555 | Medium | 6.1 | 2026-09-16 | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn… |
CVE-2026-16588 | Medium | 6.5 | 2026-09-16 | The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.5.4 due to… |
CVE-2026-11996 | Medium | 6.4 | 2026-09-16 | The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including… |
CVE-2026-11984 | Medium | 5.3 | 2026-09-16 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a mis… |
CVE-2026-92247 | Medium | 4.7 | 2026-09-16 | A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of th… |
CVE-2026-92221 | Medium | 4.7 | 2026-09-16 | A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerability is the function… |
CVE-2026-92220 | Medium | 5.3 | 2026-09-16 | A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_finished/MoRIIOConnectorWorker.get_fini… |
CVE-2026-86109 | Medium | 6.6 | 2026-09-16 | The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the d… |
CVE-2026-73450 | Medium | 6.9 | 2026-09-16 | On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection net… |
CVE-2026-92298 | Medium | 4.8 | 2026-09-16 | EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographicall… |
CVE-2026-92217 | Medium | 6.3 | 2026-09-16 | A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/web_core/src/v0_9/processing/… |
CVE-2026-92216 | Medium | 4.3 | 2026-09-16 | A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/src/v0_9/rendering/g… |
CVE-2026-92213 | Medium | 5.5 | 2026-09-16 | A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client… |
CVE-2026-92184 | Medium | 6.3 | 2026-09-16 | A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/… |
CVE-2026-73460 | Medium | 6.1 | 2026-09-16 | On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can c… |
CVE-2025-11395 | Medium | 5.5 | 2026-09-15 | A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the priv… |
CVE-2026-92259 | Medium | 5.5 | 2026-09-15 | Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directory to cause a heap-… |
CVE-2026-92257 | Medium | 5.4 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the cal… |
CVE-2026-92256 | Medium | 6.5 | 2026-09-15 | NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json… |
CVE-2026-92255 | Medium | 5.4 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi caused by improper use of a string handling API. Att… |