Medium-severity CVEs (page 26)
Page 26 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-19542 | Medium | 5.6 | 2026-09-14 | Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the sta… |
CVE-2026-90804 | Medium | 4.8 | 2026-09-14 | A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the… |
CVE-2026-90803 | Medium | 5.3 | 2026-09-14 | A security vulnerability has been detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_64_relocate_section of the file bfd/elf… |
CVE-2026-90802 | Medium | 4.4 | 2026-09-14 | A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes… |
CVE-2026-90801 | Medium | 5.3 | 2026-09-14 | A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cache_bwrite of the file bfd/cache.c of the component ld. The manipulation… |
CVE-2026-90796 | Medium | 6.3 | 2026-09-14 | A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipul… |
CVE-2026-57497 | Medium | 5.3 | 2026-09-14 | webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport caps… |
CVE-2026-55837 | Medium | 6.8 | 2026-09-14 | dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /d… |
CVE-2026-55073 | Medium | 6.2 | 2026-09-14 | WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-inf… |
CVE-2026-53496 | Medium | 5.3 | 2026-09-14 | ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEI… |
CVE-2026-15923 | Medium | 4.6 | 2026-09-14 | The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MIN(remaining, fun… |
CVE-2026-90996 | Medium | 4.0 | 2026-09-14 | A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) respo… |
CVE-2026-90995 | Medium | 5.5 | 2026-09-14 | A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder… |
CVE-2026-90994 | Medium | 4.0 | 2026-09-14 | A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client wi… |
CVE-2026-90795 | Medium | 4.3 | 2026-09-14 | A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a mani… |
CVE-2026-90794 | Medium | 6.3 | 2026-09-14 | A vulnerability was found in GPAC up to f1219cde. The affected element is the function gf_sg_script_load of the file scenegraph/vrml_tools.c of the component M… |
CVE-2026-90793 | Medium | 5.4 | 2026-09-14 | A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gf_node_get_name of the file scenegraph/base_scenegraph.c of the component MP4B… |
CVE-2026-90792 | Medium | 4.3 | 2026-09-14 | A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the component… |
CVE-2026-90463 | Medium | 4.0 | 2026-09-14 | A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests t… |
CVE-2026-55236 | Medium | 5.9 | 2026-09-14 | langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant att… |
CVE-2026-55235 | Medium | 5.9 | 2026-09-14 | langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhoo… |
CVE-2026-54529 | Medium | 5.3 | 2026-09-14 | SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortB… |
CVE-2026-53708 | Medium | 6.6 | 2026-09-14 | ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior t… |
CVE-2026-4103 | Medium | 6.4 | 2026-09-14 | Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralizatio… |
CVE-2025-24890 | Medium | 6.8 | 2026-09-14 | gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user… |
CVE-2026-90791 | Medium | 6.3 | 2026-09-14 | A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the… |
CVE-2026-90790 | Medium | 6.3 | 2026-09-14 | A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the file src/a2a/server/ta… |
CVE-2026-82437 | Medium | 4.3 | 2026-09-14 | Description The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content. For daemon logs those settings were not app… |
CVE-2026-82434 | Medium | 6.5 | 2026-09-14 | Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, bec… |
CVE-2026-82433 | Medium | 6.5 | 2026-09-14 | Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is con… |
CVE-2026-82426 | Medium | 6.5 | 2026-09-14 | Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a server-side path and opened it directly, wi… |
CVE-2026-82019 | Medium | 4.2 | 2026-09-14 | TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arb… |
CVE-2026-57128 | Medium | 4.3 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not cons… |
CVE-2026-57120 | Medium | 6.5 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, execute_code sandbox mode permits runtime assembly of blocklisted dunder names and al… |
CVE-2026-57115 | Medium | 6.5 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrape_page validates only the initial URL and lets requests.Session.get… |
CVE-2026-12985 | Medium | 6.8 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL compone… |
CVE-2026-90941 | Medium | 4.3 | 2026-09-14 | novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to e… |
CVE-2026-90940 | Medium | 5.3 | 2026-09-14 | novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to… |
CVE-2026-90939 | Medium | 6.5 | 2026-09-14 | novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticate… |
CVE-2026-90788 | Medium | 4.7 | 2026-09-14 | A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/a… |
CVE-2026-90786 | Medium | 5.3 | 2026-09-14 | A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. This impacts the function align_order_members of the file src/compiler/semantics.c of the compo… |
CVE-2026-90785 | Medium | 5.3 | 2026-09-14 | A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyze_struct of the file src/compiler/semantics.c of the component Struc… |
CVE-2026-86349 | Medium | 4.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parse… |
CVE-2026-86348 | Medium | 4.3 | 2026-09-14 | Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a po… |
CVE-2026-84179 | Medium | 6.5 | 2026-09-14 | Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in th… |
CVE-2026-82920 | Medium | 5.5 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint… |
CVE-2026-7208 | Medium | 5.3 | 2026-09-14 | Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt activ… |
CVE-2026-73191 | Medium | 6.1 | 2026-09-14 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope. When the Syncope SRA is configured for CAS authentication, the target… |
CVE-2026-90936 | Medium | 4.3 | 2026-09-14 | Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global s… |
CVE-2026-90935 | Medium | 4.3 | 2026-09-14 | Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers c… |
CVE-2026-90934 | Medium | 4.3 | 2026-09-14 | EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read… |
CVE-2026-90931 | Medium | 5.4 | 2026-09-14 | LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permi… |
CVE-2026-90930 | Medium | 6.8 | 2026-09-14 | File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing auth… |
CVE-2026-90928 | Medium | 6.5 | 2026-09-14 | File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory withou… |
CVE-2026-90927 | Medium | 6.5 | 2026-09-14 | filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buff… |
CVE-2026-90784 | Medium | 5.3 | 2026-09-14 | A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb_clear_parser of the file src/Compiler/semantics.c. The… |
CVE-2026-90716 | Medium | 5.5 | 2026-09-14 | A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c o… |
CVE-2026-90714 | Medium | 6.3 | 2026-09-14 | A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the com… |
CVE-2026-78318 | Medium | 6.1 | 2026-09-14 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope. The notification message, as optionall… |
CVE-2026-77883 | Medium | 4.9 | 2026-09-14 | Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can cr… |
CVE-2026-77147 | Medium | 6.5 | 2026-09-14 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can… |
CVE-2026-75015 | Medium | 4.9 | 2026-09-14 | Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sen… |
CVE-2026-90712 | Medium | 4.3 | 2026-09-14 | A vulnerability was identified in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file src/services/api/xaiOAuthCallback.ts of… |
CVE-2026-90709 | Medium | 4.7 | 2026-09-14 | A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the comp… |
CVE-2026-9812 | Medium | 6.5 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified r… |
CVE-2026-90891 | Medium | 5.5 | 2026-09-14 | ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authenticated local attackers can send a spe… |
CVE-2026-90890 | Medium | 5.5 | 2026-09-14 | ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. Authenticated local attackers can send… |
CVE-2026-90706 | Medium | 6.6 | 2026-09-14 | A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targe… |
CVE-2026-90705 | Medium | 6.6 | 2026-09-14 | A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Tab… |
CVE-2026-5132 | Medium | 6.5 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib… |
CVE-2026-15814 | Medium | 6.5 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding upload… |
CVE-2026-14344 | Medium | 4.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission which allows an una… |
CVE-2026-14259 | Medium | 4.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive… |
CVE-2026-13417 | Medium | 4.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block creatio… |
CVE-2026-12882 | Medium | 4.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing… |
CVE-2026-11993 | Medium | 4.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being proc… |
CVE-2026-10556 | Medium | 5.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notifica… |
CVE-2026-10542 | Medium | 5.0 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership which allows channel ma… |
CVE-2026-90704 | Medium | 6.6 | 2026-09-14 | A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulati… |
CVE-2026-68570 | Medium | 6.5 | 2026-09-14 | Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read… |
CVE-2026-90700 | Medium | 6.3 | 2026-09-14 | A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_edit1.php. Su… |
CVE-2026-90698 | Medium | 5.3 | 2026-09-14 | A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_tex… |
CVE-2026-90697 | Medium | 4.3 | 2026-09-14 | A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the… |
CVE-2026-89321 | Medium | 4.3 | 2026-09-14 | Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry becomes when opene… |
CVE-2026-88932 | Medium | 5.3 | 2026-09-14 | multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-uplo… |
CVE-2026-90688 | Medium | 6.5 | 2026-09-14 | A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler. Suc… |
CVE-2026-85125 | Medium | 5.4 | 2026-09-14 | The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. The in-app browser ma… |
CVE-2026-82796 | Medium | 5.4 | 2026-09-14 | SolarView Compact contains a cross-site scripting vulnerability in Image Management. If this vulnerability is exploited, an arbitrary OS command may be execute… |
CVE-2026-82795 | Medium | 5.4 | 2026-09-14 | SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting. If this vulnerability is exploited, an arbitrary OS… |
CVE-2026-82792 | Medium | 5.2 | 2026-09-14 | Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary… |
CVE-2026-82790 | Medium | 5.4 | 2026-09-14 | Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US. If this vulnerability is explo… |
CVE-2026-82788 | Medium | 6.1 | 2026-09-14 | Cross-site scripting vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web bro… |
CVE-2026-82786 | Medium | 6.3 | 2026-09-14 | Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. If this vulnerability is exploited, sensitive informa… |
CVE-2026-82785 | Medium | 4.3 | 2026-09-14 | Stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. Receiving a specially crafted request created and sent… |
CVE-2026-82784 | Medium | 6.5 | 2026-09-14 | Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. An attacker may execute a REST API wi… |
CVE-2026-82783 | Medium | 4.2 | 2026-09-14 | Plaintext storage of a password issue exists in CONPROSYS nano Series . If this vulnerability is exploited, an attacker with physical access to the product may… |
CVE-2026-82782 | Medium | 4.3 | 2026-09-14 | Out-of-bounds write vulnerability exists in CONPROSYS nano Series. Receiving a specially crafted request created and sent by a remote attacker may cause a deni… |
CVE-2026-82781 | Medium | 5.4 | 2026-09-14 | Cross-site scripting vulnerability exists in CONPROSYS nano Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user… |
CVE-2026-82778 | Medium | 4.3 | 2026-09-14 | An exposure of information through directory listing issue exists in CONPROSYS PAC Series. Accessing a specific URL on this product may allow a remote unauthen… |
CVE-2026-82776 | Medium | 6.1 | 2026-09-14 | Cross-site scripting vulnerability exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user'… |