Medium-severity CVEs (page 24)
Page 24 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57531 | Medium | 5.4 | 2026-07-24 | Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute… |
CVE-2026-57530 | Medium | 5.4 | 2026-07-24 | Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows at… |
CVE-2026-65707 | Medium | 6.5 | 2026-07-24 | Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting… |
CVE-2026-64254 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR When BAR_PE… |
CVE-2026-64253 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PF_BLOCK_TS in copy_process() PF_BLOCK_TS is only set in blk_time_get_… |
CVE-2026-64252 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Prevent initial console buffer from landing in XKPHYS In 64-bit configurations… |
CVE-2026-64250 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Report dying CPU to RCU in stop_this_cpu() This is a port of MIPS commit 9f3f3… |
CVE-2026-64248 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stop_this_cpu() smp_send_stop() parks all secondary… |
CVE-2026-64241 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and reso… |
CVE-2026-64240 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: media: rc: igorplugusb: fix control request setup packet Commit eac69475b01f ("media: rc… |
CVE-2026-64238 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix deadlock on shared proxy's parent removal Commit 710abda58055 ("gpio: s… |
CVE-2026-64236 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: i2c: davinci: fix division by zero on missing clock-frequency When the 'clock-frequency'… |
CVE-2026-64234 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: tty: serial: pch_uart: add check for dma_alloc_coherent() Add a check for dma_alloc_coher… |
CVE-2026-64233 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind uvc_function_bind(… |
CVE-2026-64231 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO addre… |
CVE-2026-64230 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: regulator: tps65219: fix irq_data.rdev not being assigned Commit 64a6b577490c ("regulator… |
CVE-2026-64229 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disable broadcast TLB flush when PCID is disabled Booting with "nopcid" clears X8… |
CVE-2026-64228 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev->drv can become NUL… |
CVE-2026-64227 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: ACPI: driver: Check ACPI_COMPANION() against NULL during probe Since every platform drive… |
CVE-2026-64220 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode->secondary to NULL in fwnode_init() If a firmware node is all… |
CVE-2026-64215 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table Check the return value of… |
CVE-2026-64214 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() … |
CVE-2026-64213 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Add lock protection to lm90_alert Sashiko reports: lm90_alert() executes i… |
CVE-2026-64212 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it In iwl_mld_remove… |
CVE-2026-64211 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: srcu: Don't queue workqueue handlers to never-online CPUs While an srcu_struct structure… |
CVE-2026-8308 | Medium | 6.1 | 2026-07-24 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Polen Media Software and Information Services Website Tem… |
CVE-2026-7007 | Medium | 4.6 | 2026-07-24 | The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The valid… |
CVE-2026-66007 | Medium | 6.5 | 2026-07-24 | Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is… |
CVE-2026-66006 | Medium | 5.3 | 2026-07-24 | lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated a… |
CVE-2026-66005 | Medium | 6.3 | 2026-07-24 | Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to by… |
CVE-2026-66004 | Medium | 5.3 | 2026-07-24 | BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that allows attackers to write arbitrary files… |
CVE-2026-49326 | Medium | 6.5 | 2026-07-24 | Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possi… |
CVE-2026-17059 | Medium | 6.5 | 2026-07-24 | A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management soluti… |
CVE-2026-16802 | Medium | 6.5 | 2026-07-24 | Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file sys… |
CVE-2026-16799 | Medium | 5.0 | 2026-07-24 | Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user wi… |
CVE-2026-16798 | Medium | 6.5 | 2026-07-24 | Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated u… |
CVE-2026-17048 | Medium | 5.5 | 2026-07-24 | A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for r… |
CVE-2026-7484 | Medium | 5.3 | 2026-07-24 | External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS allows Accessing Functionality Not Properly Constrained by… |
CVE-2026-66010 | Medium | 6.1 | 2026-07-24 | DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes t… |
CVE-2026-46452 | Medium | 5.3 | 2026-07-24 | Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memor… |
CVE-2026-45812 | Medium | 6.5 | 2026-07-24 | Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report… |
CVE-2026-16743 | Medium | 5.5 | 2026-07-24 | A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege dr… |
CVE-2026-16730 | Medium | 5.5 | 2026-07-24 | A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled a… |
CVE-2026-15663 | Medium | 4.9 | 2026-07-24 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in al… |
CVE-2026-63317 | Medium | 5.6 | 2026-07-24 | Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 D… |
CVE-2026-15821 | Medium | 6.4 | 2026-07-24 | The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions… |
CVE-2026-15739 | Medium | 6.4 | 2026-07-24 | The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up… |
CVE-2026-15346 | Medium | 6.1 | 2026-07-24 | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category_id' parameter in all versions… |
CVE-2026-16910 | Medium | 5.5 | 2026-07-24 | A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF val… |
CVE-2026-15755 | Medium | 6.4 | 2026-07-24 | The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to… |
CVE-2026-15665 | Medium | 6.4 | 2026-07-24 | The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode At… |
CVE-2026-15653 | Medium | 6.4 | 2026-07-24 | The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' p… |
CVE-2026-15648 | Medium | 6.4 | 2026-07-24 | The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and includi… |
CVE-2026-15464 | Medium | 6.4 | 2026-07-24 | The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute in all versions up to, and inclu… |
CVE-2026-15334 | Medium | 6.4 | 2026-07-24 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2026-15333 | Medium | 6.4 | 2026-07-24 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2026-12654 | Medium | 5.3 | 2026-07-24 | The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due… |
CVE-2026-12689 | Medium | 5.4 | 2026-07-24 | The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing… |
CVE-2026-12688 | Medium | 6.5 | 2026-07-24 | The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attac… |
CVE-2026-66139 | Medium | 4.8 | 2026-07-24 | OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known. |
CVE-2026-54422 | Medium | 5.5 | 2026-07-24 | In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials u… |
CVE-2026-6454 | Medium | 6.4 | 2026-07-24 | The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficien… |
CVE-2026-15420 | Medium | 4.3 | 2026-07-24 | The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and in… |
CVE-2026-15100 | Medium | 6.4 | 2026-07-24 | The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions u… |
CVE-2026-13464 | Medium | 5.3 | 2026-07-24 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, a… |
CVE-2026-11922 | Medium | 6.5 | 2026-07-24 | A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-chang… |
CVE-2026-11354 | Medium | 5.3 | 2026-07-24 | The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' param… |
CVE-2025-9205 | Medium | 6.4 | 2026-07-24 | The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sa… |
CVE-2026-49159 | Medium | 6.5 | 2026-07-24 | Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network. |
CVE-2026-50044 | Medium | 6.8 | 2026-07-23 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials vi… |
CVE-2026-44955 | Medium | 5.3 | 2026-07-23 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could all… |
CVE-2026-16767 | Medium | 6.5 | 2026-07-23 | A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Hand… |
CVE-2026-16764 | Medium | 6.3 | 2026-07-23 | A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the compone… |
CVE-2026-16763 | Medium | 5.3 | 2026-07-23 | A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the com… |
CVE-2026-50103 | Medium | 6.5 | 2026-07-23 | A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending… |
CVE-2026-39155 | Medium | 6.5 | 2026-07-23 | Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can c… |
CVE-2026-64785 | Medium | 5.3 | 2026-07-23 | SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTT… |
CVE-2026-48013 | Medium | 4.1 | 2026-07-23 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/external-link` endpoint allows authenticated admin users to mak… |
CVE-2026-48012 | Medium | 4.3 | 2026-07-23 | Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at `GET /api/oauth/sso/auth… |
CVE-2026-12353 | Medium | 5.3 | 2026-07-23 | An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint… |
CVE-2026-65010 | Medium | 6.6 | 2026-07-23 | Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrar… |
CVE-2026-65920 | Medium | 4.3 | 2026-07-23 | Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to… |
CVE-2026-65699 | Medium | 4.2 | 2026-07-23 | AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another us… |
CVE-2026-47769 | Medium | 5.3 | 2026-07-23 | APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint. Prior to commit 7f19b52280f414f57af2b79a9… |
CVE-2026-47755 | Medium | 6.5 | 2026-07-23 | ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated… |
CVE-2026-65698 | Medium | 5.3 | 2026-07-23 | Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host fil… |
CVE-2026-65697 | Medium | 6.1 | 2026-07-23 | Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to in… |
CVE-2026-65696 | Medium | 5.4 | 2026-07-23 | Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated user… |
CVE-2026-65695 | Medium | 6.8 | 2026-07-23 | Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argume… |
CVE-2026-16768 | Medium | 5.3 | 2026-07-23 | A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can oc… |
CVE-2026-48539 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated att… |
CVE-2026-48538 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers… |
CVE-2026-48537 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers… |
CVE-2026-48536 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers t… |
CVE-2026-48535 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers… |
CVE-2026-48534 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject a… |
CVE-2026-48532 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated att… |
CVE-2026-48531 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inj… |
CVE-2026-48530 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to… |
CVE-2026-11804 | Medium | 5.2 | 2026-07-23 | Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Secur… |