Medium-severity CVEs (page 2)
Page 2 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93539 | Medium | 5.4 | 2026-09-28 | A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests… |
CVE-2026-80359 | Medium | 6.8 | 2026-09-28 | Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerabili… |
CVE-2026-80358 | Medium | 5.1 | 2026-09-28 | Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerabili… |
CVE-2026-70413 | Medium | 5.6 | 2026-09-28 | Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability. A low privileged attacker with local access c… |
CVE-2026-93537 | Medium | 6.5 | 2026-09-28 | A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or… |
CVE-2026-87798 | Medium | 5.8 | 2026-09-28 | Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8… |
CVE-2026-86335 | Medium | 6.3 | 2026-09-28 | Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images fr… |
CVE-2026-86334 | Medium | 4.2 | 2026-09-28 | Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allow… |
CVE-2026-15953 | Medium | 5.0 | 2026-09-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and control IED manager (PCM600). This issue af… |
CVE-2026-15952 | Medium | 6.4 | 2026-09-28 | Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600). This issue affects Protection and cont… |
CVE-2026-101071 | Medium | 6.3 | 2026-09-28 | A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/uplo… |
CVE-2026-101070 | Medium | 5.3 | 2026-09-28 | A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is the function files of the file packages/api/src/controllers… |
CVE-2026-82326 | Medium | 4.1 | 2026-09-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Enocta Educational Technologies Inc. Enocta Platform allo… |
CVE-2026-59563 | Medium | 4.6 | 2026-09-28 | Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP clien… |
CVE-2026-101069 | Medium | 6.5 | 2026-09-28 | A weakness has been identified in dbgate up to 7.3.1. Affected is the function exportModelSql of the file packages/api/src/controllers/databaseConnections.js o… |
CVE-2026-101068 | Medium | 6.5 | 2026-09-28 | A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packages/api/src/utility/zipJsonLinesData.js… |
CVE-2026-101055 | Medium | 5.3 | 2026-09-28 | A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability is the function GET_STATUS of the component TCP Service. T… |
CVE-2026-87752 | Medium | 6.1 | 2026-09-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies Tourism Industry and Tr… |
CVE-2026-19444 | Medium | 6.5 | 2026-09-28 | A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl ru… |
CVE-2026-101054 | Medium | 5.3 | 2026-09-28 | A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function get_file of the file /tmp/wpa_supplicant.conf of the component TCP Se… |
CVE-2026-101040 | Medium | 6.5 | 2026-09-28 | A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF up to 20260813. This affects an unknown part of the component HTT… |
CVE-2026-101036 | Medium | 5.3 | 2026-09-28 | A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createPars… |
CVE-2026-101035 | Medium | 5.3 | 2026-09-28 | A flaw has been found in aligungr UERANSIM up to 3.3.0. This affects the function DecodePlainMmMessage in the library src/lib/nas/encode.cpp of the component n… |
CVE-2026-101018 | Medium | 4.7 | 2026-09-28 | A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function group_all_edit of the file dayrui/App/Member/Controllers/Admin/… |
CVE-2026-94287 | Medium | 5.5 | 2026-09-28 | A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and mem… |
CVE-2026-94285 | Medium | 5.1 | 2026-09-28 | An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients. |
CVE-2026-94284 | Medium | 5.5 | 2026-09-28 | An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attac… |
CVE-2026-94283 | Medium | 6.5 | 2026-09-28 | An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash att… |
CVE-2026-94282 | Medium | 5.6 | 2026-09-28 | An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X clien… |
CVE-2026-86507 | Medium | 6.1 | 2026-09-28 | Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in th… |
CVE-2026-82969 | Medium | 5.4 | 2026-09-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and… |
CVE-2026-82915 | Medium | 6.5 | 2026-09-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workf… |
CVE-2026-101017 | Medium | 6.5 | 2026-09-28 | A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. This vulnerability affects the function strcasecmp in the library libopendmarc/opend… |
CVE-2026-101016 | Medium | 6.5 | 2026-09-28 | A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_policy_parse_dmarc in the library libopendm… |
CVE-2026-91206 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross… |
CVE-2026-91204 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comm… |
CVE-2026-82546 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store… |
CVE-2026-82387 | Medium | 5.4 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with media-upload rights to store act… |
CVE-2026-82385 | Medium | 6.5 | 2026-09-28 | Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, inc… |
CVE-2026-82382 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross… |
CVE-2026-82381 | Medium | 5.4 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to… |
CVE-2026-101011 | Medium | 4.7 | 2026-09-28 | A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function get_domain_status of the file /www/server/panel/mod/project/domain… |
CVE-2026-101010 | Medium | 4.7 | 2026-09-28 | A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The man… |
CVE-2026-93000 | Medium | 6.8 | 2026-09-28 | The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled… |
CVE-2026-92996 | Medium | 5.3 | 2026-09-28 | The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order own… |
CVE-2026-89411 | Medium | 5.3 | 2026-09-28 | The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauth… |
CVE-2026-89303 | Medium | 6.4 | 2026-09-28 | The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticate… |
CVE-2026-89300 | Medium | 5.3 | 2026-09-28 | The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbi… |
CVE-2026-88828 | Medium | 5.4 | 2026-09-28 | The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder… |
CVE-2026-86838 | Medium | 5.3 | 2026-09-28 | The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowin… |
CVE-2026-84744 | Medium | 6.5 | 2026-09-28 | The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rend… |
CVE-2026-101006 | Medium | 4.3 | 2026-09-28 | A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/get_shift_requests/get_attendance_requests of the… |
CVE-2026-101004 | Medium | 5.3 | 2026-09-28 | A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/… |
CVE-2026-101003 | Medium | 5.3 | 2026-09-28 | A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c… |
CVE-2026-100907 | Medium | 5.3 | 2026-09-28 | A flaw has been found in Eyeplus 57.0.0.0308. The impacted element is an unknown function of the file /snapshot of the component p2pcam Service. This manipulat… |
CVE-2026-100906 | Medium | 5.3 | 2026-09-28 | A vulnerability was detected in Eyeplus 57.0.0.0308. The affected element is the function GetUsers of the file /onvif/Device of the component ONVIF. The manipu… |
CVE-2026-100903 | Medium | 5.3 | 2026-09-28 | A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST… |
CVE-2026-100902 | Medium | 6.5 | 2026-09-28 | A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper… |
CVE-2026-100900 | Medium | 5.5 | 2026-09-28 | A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. Affected is the function updateJiraProjects of the file… |
CVE-2026-100899 | Medium | 6.3 | 2026-09-28 | A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. This impacts the function whereRaw of the file app/Filament/Widge… |
CVE-2026-100898 | Medium | 6.3 | 2026-09-28 | A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1. This affects the function whereRaw of the file app/Filament… |
CVE-2026-100897 | Medium | 5.5 | 2026-09-28 | A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639ec7cef620651bfd0f07ebb660529e3f. The impacted element is an unknown function of… |
CVE-2026-100895 | Medium | 5.3 | 2026-09-28 | A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1. Impacted is the function arc_parse_canon_t in the library libopenarc/a… |
CVE-2026-100894 | Medium | 6.3 | 2026-09-28 | A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown proce… |
CVE-2026-100892 | Medium | 5.3 | 2026-09-28 | A vulnerability was found in aligungr UERANSIM up to 3.3.0. This affects the function ULInformationTransfer of the file src/gnb/rrc/handler.cpp of the componen… |
CVE-2026-100890 | Medium | 5.3 | 2026-09-28 | A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library… |
CVE-2026-100887 | Medium | 6.3 | 2026-09-28 | A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted elemen… |
CVE-2026-100884 | Medium | 4.3 | 2026-09-27 | A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/… |
CVE-2026-100883 | Medium | 6.3 | 2026-09-27 | A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Exec… |
CVE-2026-96281 | Medium | 6.2 | 2026-09-27 | On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote re… |
CVE-2026-101088 | Medium | 5.3 | 2026-09-27 | Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentinel worker (service/singleton/servicesentinel.go) contains a… |
CVE-2026-101087 | Medium | 4.3 | 2026-09-27 | Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist did not cov… |
CVE-2026-101086 | Medium | 6.5 | 2026-09-27 | Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing authenticated users with nezha:service:wri… |
CVE-2026-101085 | Medium | 6.5 | 2026-09-27 | Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger… |
CVE-2026-101063 | Medium | 5.3 | 2026-09-27 | Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated at… |
CVE-2026-100879 | Medium | 4.3 | 2026-09-27 | A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of t… |
CVE-2026-100878 | Medium | 6.3 | 2026-09-27 | A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/j… |
CVE-2026-100877 | Medium | 4.3 | 2026-09-27 | A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an… |
CVE-2026-96279 | Medium | 6.5 | 2026-09-27 | A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remo… |
CVE-2026-100876 | Medium | 6.3 | 2026-09-27 | A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the fil… |
CVE-2026-100873 | Medium | 4.3 | 2026-09-27 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown func… |
CVE-2026-101061 | Medium | 4.7 | 2026-09-27 | utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes… |
CVE-2026-101058 | Medium | 6.9 | 2026-09-27 | python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback in… |
CVE-2026-101056 | Medium | 5.3 | 2026-09-27 | Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid sha… |
CVE-2026-101048 | Medium | 5.4 | 2026-09-27 | Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without req… |
CVE-2026-101047 | Medium | 5.3 | 2026-09-27 | Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended rand… |
CVE-2026-101050 | Medium | 6.5 | 2026-09-27 | Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is emp… |
CVE-2026-101049 | Medium | 6.5 | 2026-09-27 | Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attack… |
CVE-2026-101042 | Medium | 6.4 | 2026-09-27 | Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication adapters (GitHub, Go… |
CVE-2026-101033 | Medium | 4.3 | 2026-09-27 | KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumer… |
CVE-2026-100869 | Medium | 5.9 | 2026-09-27 | Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed o… |
CVE-2026-100868 | Medium | 6.3 | 2026-09-27 | Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attacke… |
CVE-2026-97319 | Medium | 6.8 | 2026-09-27 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, whic… |
CVE-2026-97227 | Medium | 5.9 | 2026-09-27 | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, rely… |
CVE-2026-96899 | Medium | 6.8 | 2026-09-27 | The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it… |
CVE-2026-96897 | Medium | 5.3 | 2026-09-27 | The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users… |
CVE-2026-96895 | Medium | 6.8 | 2026-09-27 | The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when ren… |
CVE-2026-92995 | Medium | 5.3 | 2026-09-27 | The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to do… |
CVE-2026-92436 | Medium | 5.3 | 2026-09-27 | The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-suppli… |
CVE-2026-89006 | Medium | 6.8 | 2026-09-27 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with th… |