Medium-severity CVEs (page 19)
Page 19 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-92114 | Medium | 5.3 | 2026-09-15 | A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functio… |
CVE-2026-82567 | Medium | 6.3 | 2026-09-15 | The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is access… |
CVE-2026-76873 | Medium | 5.2 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list display components han… |
CVE-2026-76872 | Medium | 5.4 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_stati… |
CVE-2026-76871 | Medium | 6.5 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_conf… |
CVE-2026-76868 | Medium | 4.9 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in route_policy_add.cgi caused by a missing exit_port parameter. Attackers… |
CVE-2026-76867 | Medium | 5.4 | 2026-09-15 | Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including rout… |
CVE-2026-76865 | Medium | 4.9 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filter_conn_del_cgi.c and gre_prio_set_cgi… |
CVE-2026-76864 | Medium | 4.8 | 2026-09-15 | NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and… |
CVE-2026-76863 | Medium | 4.3 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the mod_qos_bandwidth plan.json handling within filter_conns_du… |
CVE-2026-76859 | Medium | 6.5 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the user_pass_show.cgi component. Low-privilege attackers can e… |
CVE-2026-76858 | Medium | 4.8 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddns_wan_list_show.cgi caused by unsafe eval() handling of DDNS data… |
CVE-2026-76857 | Medium | 6.5 | 2026-09-15 | Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddns_wan_list_show.cgi endpoint and related DDNSse… |
CVE-2026-76855 | Medium | 6.5 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7_web_auth_log_dump_cgi.c, audi… |
CVE-2026-76854 | Medium | 6.5 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7_web_auth_user_show.cgi related to captive-portal credential… |
CVE-2026-73444 | Medium | 4.7 | 2026-09-15 | On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the… |
CVE-2026-92237 | Medium | 6.5 | 2026-09-15 | Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authentic… |
CVE-2026-92234 | Medium | 5.4 | 2026-09-15 | QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page… |
CVE-2026-91746 | Medium | 4.3 | 2026-09-15 | Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromiu… |
CVE-2026-91744 | Medium | 5.3 | 2026-09-15 | Race condition in PlatformIntegration in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and… |
CVE-2026-91742 | Medium | 4.8 | 2026-09-15 | Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system acc… |
CVE-2026-91740 | Medium | 4.3 | 2026-09-15 | Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-91739 | Medium | 4.2 | 2026-09-15 | Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to sp… |
CVE-2026-91726 | Medium | 4.7 | 2026-09-15 | Out of bounds read in WebGL in Google Chrome on on Android prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HT… |
CVE-2026-91725 | Medium | 5.3 | 2026-09-15 | Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromiu… |
CVE-2026-91720 | Medium | 4.7 | 2026-09-15 | Uninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (… |
CVE-2026-91717 | Medium | 5.1 | 2026-09-15 | Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-instal… |
CVE-2026-91714 | Medium | 5.3 | 2026-09-15 | Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak sensitive information v… |
CVE-2026-91713 | Medium | 4.2 | 2026-09-15 | Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI element… |
CVE-2026-81927 | Medium | 5.4 | 2026-09-15 | Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject fi… |
CVE-2026-81926 | Medium | 6.1 | 2026-09-15 | Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The pane… |
CVE-2026-68953 | Medium | 6.5 | 2026-09-15 | The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, includi… |
CVE-2026-66372 | Medium | 6.8 | 2026-09-15 | The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space. |
CVE-2026-19655 | Medium | 6.5 | 2026-09-15 | On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or… |
CVE-2026-18426 | Medium | 6.5 | 2026-09-15 | Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solel… |
CVE-2026-89027 | Medium | 6.5 | 2026-09-15 | miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthen… |
CVE-2026-88922 | Medium | 6.7 | 2026-09-15 | The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a craft… |
CVE-2026-88743 | Medium | 6.1 | 2026-09-15 | Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags. |
CVE-2026-88742 | Medium | 5.4 | 2026-09-15 | Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field. |
CVE-2026-87285 | Medium | 6.0 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87283 | Medium | 6.0 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87282 | Medium | 6.0 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87280 | Medium | 4.2 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87279 | Medium | 6.1 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87278 | Medium | 6.1 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87275 | Medium | 4.6 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87274 | Medium | 4.4 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Difficult to… |
CVE-2026-87267 | Medium | 5.3 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Difficult to… |
CVE-2026-87253 | Medium | 6.1 | 2026-09-15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client). The supported version that is affected is 9.3.6. Easily exploit… |
CVE-2026-87252 | Medium | 6.8 | 2026-09-15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Diffic… |
CVE-2026-87248 | Medium | 6.7 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87169 | Medium | 6.1 | 2026-09-15 | Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Wage Determination Online). Support… |
CVE-2026-83491 | Medium | 6.8 | 2026-09-15 | Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-… |
CVE-2026-83488 | Medium | 5.4 | 2026-09-15 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security). Supported versions that are affected are 4.0.0-4… |
CVE-2026-83480 | Medium | 5.3 | 2026-09-15 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). Supported versions that are affected are 4.0.0-4.5.4. Easily exploita… |
CVE-2026-83460 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vu… |
CVE-2026-83459 | Medium | 5.3 | 2026-09-15 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-media-multipart). Supported versions that are affected are 3.0.0-3.2.20… |
CVE-2026-83458 | Medium | 5.3 | 2026-09-15 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: JSON). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable v… |
CVE-2026-83443 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Assets product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.1… |
CVE-2026-83441 | Medium | 6.8 | 2026-09-15 | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-1… |
CVE-2026-83433 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Depot Repair Diagnostics). Supported versions that are affected are 12… |
CVE-2026-83431 | Medium | 5.4 | 2026-09-15 | Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). Supported versions that are affected are 12.2.3-12.2.15… |
CVE-2026-83419 | Medium | 5.4 | 2026-09-15 | Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP). Supported vers… |
CVE-2026-83416 | Medium | 4.3 | 2026-09-15 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0… |
CVE-2026-83354 | Medium | 6.3 | 2026-09-15 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 15.1.1.0.0. Difficult… |
CVE-2026-83347 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vuln… |
CVE-2026-83346 | Medium | 5.4 | 2026-09-15 | Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware (component: Framework). Supported versions that are affected are 12… |
CVE-2026-83279 | Medium | 5.5 | 2026-09-15 | Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. E… |
CVE-2026-83278 | Medium | 6.8 | 2026-09-15 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-integrations-neo4j). Supported versions that are affected are 3.0.0-3.2.2… |
CVE-2026-83274 | Medium | 5.5 | 2026-09-15 | Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. E… |
CVE-2026-83251 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83250 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83200 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Process Manufacturing Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that ar… |
CVE-2026-83198 | Medium | 5.4 | 2026-09-15 | Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3… |
CVE-2026-83175 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-1… |
CVE-2026-83140 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3… |
CVE-2026-83109 | Medium | 5.3 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83097 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83077 | Medium | 6.4 | 2026-09-15 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22… |
CVE-2026-83076 | Medium | 6.8 | 2026-09-15 | Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-81925 | Medium | 6.1 | 2026-09-15 | Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scr… |
CVE-2026-76796 | Medium | 4.0 | 2026-09-15 | The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowi… |
CVE-2026-76707 | Medium | 4.3 | 2026-09-15 | A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to view some system memory contents. Successful… |
CVE-2026-76706 | Medium | 5.3 | 2026-09-15 | A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive inform… |
CVE-2026-76705 | Medium | 5.5 | 2026-09-15 | A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated… |
CVE-2026-76704 | Medium | 5.5 | 2026-09-15 | A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary… |
CVE-2026-76703 | Medium | 5.5 | 2026-09-15 | A buffer overflow vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways that could allow an authenticated at… |
CVE-2026-76702 | Medium | 5.8 | 2026-09-15 | A vulnerability in the operating system of HPE Networking EdgeConnect SD-WAN Gateways could allow an authenticated local attacker to cause a denial-of-service… |
CVE-2026-76701 | Medium | 5.9 | 2026-09-15 | A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to access sensitive informatio… |
CVE-2026-76700 | Medium | 5.9 | 2026-09-15 | Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service. Successful exploitat… |
CVE-2026-76699 | Medium | 6.4 | 2026-09-15 | A buffer overflow vulnerability exists in a system service within the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allo… |
CVE-2026-76698 | Medium | 6.5 | 2026-09-15 | A command injection vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways. An authenticated remote attacker… |
CVE-2026-76697 | Medium | 6.5 | 2026-09-15 | A vulnerability in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways could allow a remote attacker authenticated with low privil… |
CVE-2026-76696 | Medium | 6.5 | 2026-09-15 | A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to conduct a denial of service attack. Successfu… |
CVE-2026-76695 | Medium | 6.5 | 2026-09-15 | Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remo… |
CVE-2026-76694 | Medium | 6.6 | 2026-09-15 | A privilege escalation vulnerability exists in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an… |
CVE-2026-73965 | Medium | 6.8 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway). Supported versions that are affected are 17.0-26.7. Diffic… |
CVE-2026-70755 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download). Supported versions that are aff… |
CVE-2026-69215 | Medium | 6.8 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC… |
CVE-2026-69206 | Medium | 5.9 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonc… |