Medium-severity CVEs (page 21)
Page 21 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66400 | Medium | 4.8 | 2026-07-29 | Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to p… |
CVE-2026-18174 | Medium | 5.3 | 2026-07-29 | @fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated en… |
CVE-2026-16751 | Medium | 6.5 | 2026-07-29 | Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a vict… |
CVE-2026-65946 | Medium | 6.1 | 2026-07-29 | Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0 |
CVE-2026-65891 | Medium | 6.5 | 2026-07-29 | Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.20.2… |
CVE-2026-8791 | Medium | 6.4 | 2026-07-29 | The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and incl… |
CVE-2026-7436 | Medium | 6.4 | 2026-07-29 | The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller`… |
CVE-2026-6089 | Medium | 4.9 | 2026-07-29 | The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky_s_media' parameter in imported JSON files in all versions up to, a… |
CVE-2026-5060 | Medium | 6.5 | 2026-07-29 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2026-4604 | Medium | 5.3 | 2026-07-29 | The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `kr_mr_store_s… |
CVE-2026-65100 | Medium | 4.8 | 2026-07-29 | Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder o… |
CVE-2026-58185 | Medium | 5.9 | 2026-07-29 | The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14… |
CVE-2026-58183 | Medium | 5.9 | 2026-07-29 | The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8… |
CVE-2026-58160 | Medium | 6.5 | 2026-07-29 | Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9… |
CVE-2026-58158 | Medium | 5.9 | 2026-07-29 | Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 throug… |
CVE-2026-18207 | Medium | 6.5 | 2026-07-29 | A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique i… |
CVE-2026-18201 | Medium | 5.5 | 2026-07-29 | Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permis… |
CVE-2026-9720 | Medium | 4.3 | 2026-07-29 | The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is du… |
CVE-2026-65325 | Medium | 4.8 | 2026-07-29 | Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affect… |
CVE-2026-58156 | Medium | 4.9 | 2026-07-29 | Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 t… |
CVE-2026-58152 | Medium | 5.9 | 2026-07-29 | Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through… |
CVE-2026-11973 | Medium | 4.9 | 2026-07-29 | The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8… |
CVE-2026-35226 | Medium | 6.5 | 2026-07-29 | An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFIN… |
CVE-2026-33930 | Medium | 5.9 | 2026-07-29 | Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overfl… |
CVE-2026-18192 | Medium | 6.5 | 2026-07-29 | VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to downl… |
CVE-2026-63242 | Medium | 4.3 | 2026-07-29 | A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint… |
CVE-2026-63240 | Medium | 4.3 | 2026-07-29 | An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without … |
CVE-2026-63239 | Medium | 5.4 | 2026-07-29 | A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive d… |
CVE-2026-63238 | Medium | 6.5 | 2026-07-29 | An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supply… |
CVE-2026-63237 | Medium | 4.8 | 2026-07-29 | A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time pas… |
CVE-2026-14224 | Medium | 5.4 | 2026-07-29 | The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current u… |
CVE-2026-13692 | Medium | 5.3 | 2026-07-29 | The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthent… |
CVE-2026-13605 | Medium | 6.8 | 2026-07-29 | The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM… |
CVE-2026-11351 | Medium | 5.3 | 2026-07-29 | The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated user… |
CVE-2026-5626 | Medium | 4.3 | 2026-07-29 | The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_data() function in all… |
CVE-2026-15344 | Medium | 4.9 | 2026-07-29 | The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002… |
CVE-2026-17166 | Medium | 4.3 | 2026-07-29 | The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass… |
CVE-2026-17162 | Medium | 6.4 | 2026-07-29 | The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attri… |
CVE-2026-17161 | Medium | 6.4 | 2026-07-29 | The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block At… |
CVE-2026-15735 | Medium | 6.4 | 2026-07-29 | The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta in all versions up to, and i… |
CVE-2026-12939 | Medium | 6.4 | 2026-07-29 | The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the post_thumbnail (and newsletters_post_thu… |
CVE-2026-12938 | Medium | 6.4 | 2026-07-29 | The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the [newsletters_post] shortcode in versio… |
CVE-2026-66064 | Medium | 5.3 | 2026-07-28 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using… |
CVE-2026-66063 | Medium | 6.5 | 2026-07-28 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part… |
CVE-2026-59921 | Medium | 5.7 | 2026-07-28 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multi… |
CVE-2026-59943 | Medium | 5.3 | 2026-07-28 | Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can u… |
CVE-2026-56722 | Medium | 5.3 | 2026-07-28 | Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a tar… |
CVE-2026-49447 | Medium | 5.3 | 2026-07-28 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cos… |
CVE-2026-16581 | Medium | 5.3 | 2026-07-28 | In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized act… |
CVE-2026-14515 | Medium | 6.1 | 2026-07-28 | IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack. |
CVE-2026-57511 | Medium | 5.4 | 2026-07-28 | SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CR… |
CVE-2026-3158 | Medium | 4.3 | 2026-07-28 | IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6… |
CVE-2026-3157 | Medium | 4.3 | 2026-07-28 | IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6… |
CVE-2026-1918 | Medium | 4.9 | 2026-07-28 | IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6… |
CVE-2026-16107 | Medium | 5.9 | 2026-07-28 | IBM TS4500 CLI tool Versions: 0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to o… |
CVE-2026-11391 | Medium | 6.3 | 2026-07-28 | Tanium addressed a SQL injection vulnerability in Patch. |
CVE-2026-7362 | Medium | 4.3 | 2026-07-28 | IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 throu… |
CVE-2026-5114 | Medium | 4.9 | 2026-07-28 | The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mism… |
CVE-2026-4932 | Medium | 4.2 | 2026-07-28 | IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physical access to the Transparent Memory Encr… |
CVE-2026-4912 | Medium | 4.1 | 2026-07-28 | The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is… |
CVE-2026-47768 | Medium | 5.5 | 2026-07-28 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redi… |
CVE-2026-15304 | Medium | 6.5 | 2026-07-28 | The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in versions up to, and including, 10.2.4. This is d… |
CVE-2026-18085 | Medium | 6.9 | 2026-07-28 | An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential De… |
CVE-2026-18084 | Medium | 6.1 | 2026-07-28 | Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site Scripting (X… |
CVE-2026-8058 | Medium | 4.5 | 2026-07-28 | IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password i… |
CVE-2026-7868 | Medium | 6.5 | 2026-07-28 | IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privile… |
CVE-2026-7775 | Medium | 5.5 | 2026-07-28 | IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2… |
CVE-2026-67181 | Medium | 5.4 | 2026-07-28 | Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploitin… |
CVE-2026-66754 | Medium | 5.9 | 2026-07-28 | Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to… |
CVE-2026-66752 | Medium | 5.4 | 2026-07-28 | tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-E… |
CVE-2026-66751 | Medium | 5.4 | 2026-07-28 | Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending… |
CVE-2026-66750 | Medium | 4.3 | 2026-07-28 | Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and… |
CVE-2026-66749 | Medium | 6.5 | 2026-07-28 | Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-charac… |
CVE-2026-66746 | Medium | 5.4 | 2026-07-28 | Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding ca… |
CVE-2026-62828 | Medium | 5.4 | 2026-07-28 | Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-7521 | Medium | 5.5 | 2026-07-28 | Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deletion path which allows an admin with SAML… |
CVE-2026-61487 | Medium | 6.5 | 2026-07-28 | Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-de… |
CVE-2026-65882 | Medium | 6.1 | 2026-07-28 | Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS… |
CVE-2026-62436 | Medium | 6.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Gran… |
CVE-2026-62435 | Medium | 6.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Gran… |
CVE-2026-62434 | Medium | 5.3 | 2026-07-28 | A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory manage… |
CVE-2026-62429 | Medium | 6.5 | 2026-07-28 | Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration informa… |
CVE-2026-62425 | Medium | 5.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge… |
CVE-2026-62424 | Medium | 5.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge… |
CVE-2026-62423 | Medium | 5.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge… |
CVE-2026-42495 | Medium | 5.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge… |
CVE-2026-42494 | Medium | 6.1 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge… |
CVE-2026-18047 | Medium | 6.5 | 2026-07-28 | A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints… |
CVE-2026-18038 | Medium | 4.3 | 2026-07-28 | A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.Execute of the file goclaw/internal/http… |
CVE-2026-15393 | Medium | 6.4 | 2026-07-28 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2026-15016 | Medium | 6.4 | 2026-07-28 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via R… |
CVE-2026-16774 | Medium | 5.3 | 2026-07-28 | The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is… |
CVE-2026-16773 | Medium | 5.3 | 2026-07-28 | The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t… |
CVE-2026-15444 | Medium | 4.9 | 2026-07-28 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon_code' parameter in all version… |
CVE-2026-15411 | Medium | 5.3 | 2026-07-28 | The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorizatio… |
CVE-2026-13110 | Medium | 5.3 | 2026-07-28 | The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capab… |
CVE-2026-58246 | Medium | 4.3 | 2026-07-28 | SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated… |
CVE-2026-11598 | Medium | 5.0 | 2026-07-28 | The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all versions up to, and including, 1.4.3 du… |
CVE-2026-9680 | Medium | 5.8 | 2026-07-28 | Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP end… |
CVE-2026-8167 | Medium | 6.1 | 2026-07-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solutions News Theme V8 allows Reflected XS… |