Medium-severity CVEs (page 26)
Page 26 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27355 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. |
CVE-2026-25466 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions. |
CVE-2026-25427 | Medium | 5.4 | 2026-07-23 | Subscriber Broken Access Control in eRoom <= 1.7.1 versions. |
CVE-2026-25424 | Medium | 4.3 | 2026-07-23 | Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions. |
CVE-2026-24639 | Medium | 4.4 | 2026-07-23 | Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions. |
CVE-2026-24628 | Medium | 5.9 | 2026-07-23 | Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions. |
CVE-2026-24537 | Medium | 4.3 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions. |
CVE-2025-68081 | Medium | 5.9 | 2026-07-23 | Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions. |
CVE-2026-65756 | Medium | 6.1 | 2026-07-23 | Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript. |
CVE-2026-65713 | Medium | 6.5 | 2026-07-23 | Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories. |
CVE-2026-65712 | Medium | 6.2 | 2026-07-23 | Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory… |
CVE-2026-64875 | Medium | 6.5 | 2026-07-23 | Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cau… |
CVE-2026-64872 | Medium | 6.5 | 2026-07-23 | Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory. |
CVE-2026-64871 | Medium | 5.4 | 2026-07-23 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistent… |
CVE-2026-16078 | Medium | 6.5 | 2026-07-23 | The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 vi… |
CVE-2026-15906 | Medium | 6.5 | 2026-07-23 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions u… |
CVE-2026-15827 | Medium | 5.3 | 2026-07-23 | The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/g… |
CVE-2026-15794 | Medium | 6.4 | 2026-07-23 | The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to… |
CVE-2026-15786 | Medium | 4.4 | 2026-07-23 | The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all… |
CVE-2026-15761 | Medium | 6.5 | 2026-07-23 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up t… |
CVE-2026-15647 | Medium | 4.4 | 2026-07-23 | The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field in all versions up to, and… |
CVE-2026-15646 | Medium | 6.4 | 2026-07-23 | The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and includi… |
CVE-2026-15448 | Medium | 6.5 | 2026-07-23 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versio… |
CVE-2026-15404 | Medium | 6.4 | 2026-07-23 | The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insuffici… |
CVE-2026-15394 | Medium | 6.4 | 2026-07-23 | The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asm_code' Snippet… |
CVE-2026-15348 | Medium | 6.3 | 2026-07-23 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 v… |
CVE-2026-14481 | Medium | 6.4 | 2026-07-23 | The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2026-13119 | Medium | 6.5 | 2026-07-23 | The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtec_rec… |
CVE-2026-13009 | Medium | 6.5 | 2026-07-23 | The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and includi… |
CVE-2026-9729 | Medium | 6.4 | 2026-07-23 | The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushr_notification_title' and 'webpushr_notificat… |
CVE-2026-9635 | Medium | 6.4 | 2026-07-23 | The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode in versions… |
CVE-2026-9577 | Medium | 4.8 | 2026-07-23 | The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page… |
CVE-2026-9066 | Medium | 6.1 | 2026-07-23 | The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the… |
CVE-2026-63226 | Medium | 5.8 | 2026-07-23 | Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitra… |
CVE-2026-6390 | Medium | 6.8 | 2026-07-23 | A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specia… |
CVE-2026-7120 | Medium | 5.3 | 2026-07-23 | @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Vers… |
CVE-2026-21723 | Medium | 5.3 | 2026-07-23 | The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing t… |
CVE-2026-16653 | Medium | 5.3 | 2026-07-23 | A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/http.c of the compo… |
CVE-2026-16631 | Medium | 5.3 | 2026-07-23 | A vulnerability was detected in publint up to 0.1.4. This impacts the function child_process.exec of the file src/node/pack.js of the component package-manager… |
CVE-2026-38763 | Medium | 5.5 | 2026-07-22 | An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to cause a denial of service via the function sub_13828 |
CVE-2026-16630 | Medium | 5.3 | 2026-07-22 | A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function child_process.exec of the file pack… |
CVE-2026-16629 | Medium | 5.3 | 2026-07-22 | A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileA… |
CVE-2026-16628 | Medium | 5.3 | 2026-07-22 | A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function child_process.exec of the component JIT Plugin Entry Handle… |
CVE-2026-64795 | Medium | 5.4 | 2026-07-22 | Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title ove… |
CVE-2026-64794 | Medium | 6.5 | 2026-07-22 | Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allow… |
CVE-2026-63281 | Medium | 4.8 | 2026-07-22 | Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in admin… |
CVE-2025-50325 | Medium | 5.4 | 2026-07-22 | BandiZip v.7.37 is affected by a Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mecha… |
CVE-2026-9737 | Medium | 6.5 | 2026-07-22 | During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to i… |
CVE-2026-13076 | Medium | 6.5 | 2026-07-22 | An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversi… |
CVE-2026-13075 | Medium | 6.5 | 2026-07-22 | An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregat… |
CVE-2026-13074 | Medium | 5.3 | 2026-07-22 | An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello… |
CVE-2026-13073 | Medium | 4.3 | 2026-07-22 | An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in den… |
CVE-2026-13071 | Medium | 6.5 | 2026-07-22 | An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScrip… |
CVE-2026-13070 | Medium | 5.3 | 2026-07-22 | A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS han… |
CVE-2026-13069 | Medium | 6.5 | 2026-07-22 | An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payloa… |
CVE-2026-13068 | Medium | 4.2 | 2026-07-22 | An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, di… |
CVE-2026-13067 | Medium | 6.3 | 2026-07-22 | When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATr… |
CVE-2026-13066 | Medium | 6.5 | 2026-07-22 | Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents bein… |
CVE-2026-13065 | Medium | 6.5 | 2026-07-22 | A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type… |
CVE-2026-13064 | Medium | 6.5 | 2026-07-22 | Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potential… |
CVE-2026-13063 | Medium | 4.3 | 2026-07-22 | An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggr… |
CVE-2026-13062 | Medium | 6.5 | 2026-07-22 | An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are int… |
CVE-2026-13061 | Medium | 4.3 | 2026-07-22 | An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information… |
CVE-2026-13060 | Medium | 6.5 | 2026-07-22 | An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in… |
CVE-2026-13058 | Medium | 6.5 | 2026-07-22 | An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incompl… |
CVE-2026-13057 | Medium | 5.3 | 2026-07-22 | An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $s… |
CVE-2026-13056 | Medium | 6.5 | 2026-07-22 | Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to cras… |
CVE-2026-13055 | Medium | 6.5 | 2026-07-22 | The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compou… |
CVE-2026-3482 | Medium | 5.3 | 2026-07-22 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 could allow an… |
CVE-2026-65650 | Medium | 4.3 | 2026-07-22 | Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload. |
CVE-2026-65012 | Medium | 5.3 | 2026-07-22 | InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_folder endpoint that accepts attacker-con… |
CVE-2026-65011 | Medium | 4.3 | 2026-07-22 | Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint that all… |
CVE-2026-16615 | Medium | 6.8 | 2026-07-22 | A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-ran… |
CVE-2026-64828 | Medium | 6.1 | 2026-07-22 | Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaS… |
CVE-2026-46737 | Medium | 6.7 | 2026-07-22 | Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker w… |
CVE-2026-44276 | Medium | 6.0 | 2026-07-22 | Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the REST… |
CVE-2026-10822 | Medium | 6.5 | 2026-07-22 | If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first… |
CVE-2026-10723 | Medium | 6.8 | 2026-07-22 | BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9… |
CVE-2026-56444 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeo… |
CVE-2026-56416 | Medium | 4.8 | 2026-07-22 | In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it com… |
CVE-2026-55991 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and… |
CVE-2026-55990 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscryp… |
CVE-2026-55717 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <ne… |
CVE-2026-52863 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view na… |
CVE-2026-50251 | Medium | 5.3 | 2026-07-22 | In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0… |
CVE-2026-50248 | Medium | 6.5 | 2026-07-22 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still cons… |
CVE-2026-50046 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_que… |
CVE-2026-50045 | Medium | 5.3 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send… |
CVE-2026-44621 | Medium | 5.9 | 2026-07-22 | With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be a… |
CVE-2026-16560 | Medium | 5.3 | 2026-07-22 | A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation a… |
CVE-2026-14932 | Medium | 6.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and… |
CVE-2026-14865 | Medium | 5.3 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowin… |
CVE-2026-14586 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 abo… |
CVE-2026-13192 | Medium | 6.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authentic… |
CVE-2026-13188 | Medium | 5.9 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior… |
CVE-2026-65600 | Medium | 5.3 | 2026-07-22 | Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middlew… |
CVE-2026-65599 | Medium | 6.5 | 2026-07-22 | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM p… |
CVE-2026-65597 | Medium | 5.4 | 2026-07-22 | n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution… |
CVE-2026-65594 | Medium | 6.5 | 2026-07-22 | n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the a… |
CVE-2026-65593 | Medium | 5.4 | 2026-07-22 | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authori… |