Medium-severity CVEs (page 28)
Page 28 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-88995 | Medium | 5.3 | 2026-09-13 | The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allo… |
CVE-2026-88912 | Medium | 4.2 | 2026-09-13 | The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and… |
CVE-2026-88764 | Medium | 5.4 | 2026-09-13 | The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level con… |
CVE-2026-80072 | Medium | 4.7 | 2026-09-13 | The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unaut… |
CVE-2026-77773 | Medium | 5.3 | 2026-09-13 | The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its pu… |
CVE-2026-90679 | Medium | 4.3 | 2026-09-13 | Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeo… |
CVE-2026-90494 | Medium | 5.3 | 2026-09-13 | A flaw has been found in restify node-restify up to 12.0.0. This affects the function serveStatic in the library /lib/plugins/static.js. This manipulation caus… |
CVE-2026-90492 | Medium | 6.3 | 2026-09-13 | A security vulnerability has been detected in webgjc web_robot 2.4.0/2.5.0/2.8.0. The affected element is the function controller_listen/controller_recover of… |
CVE-2026-90491 | Medium | 6.3 | 2026-09-13 | A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component El… |
CVE-2026-90490 | Medium | 6.3 | 2026-09-13 | A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Performing a manipulat… |
CVE-2026-90488 | Medium | 6.3 | 2026-09-13 | A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/co… |
CVE-2026-90487 | Medium | 4.3 | 2026-09-12 | A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/… |
CVE-2026-90486 | Medium | 6.3 | 2026-09-12 | A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown function… |
CVE-2026-90485 | Medium | 5.5 | 2026-09-12 | A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub_11838 of the file IURegistryFilter.sys of the component IOCTL… |
CVE-2026-90557 | Medium | 6.1 | 2026-09-12 | Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_unit() when processing savegame files with invalid unit acti… |
CVE-2026-90555 | Medium | 6.5 | 2026-09-12 | vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks… |
CVE-2026-90554 | Medium | 6.2 | 2026-09-12 | vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In na… |
CVE-2026-90552 | Medium | 4.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/cale… |
CVE-2026-90551 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the video_from_program API endpoint, allowing unaut… |
CVE-2026-90550 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before… |
CVE-2026-90549 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthe… |
CVE-2026-90548 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing una… |
CVE-2026-90547 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark plugin getBookmarks.json.php endpoint, a… |
CVE-2026-90546 | Medium | 4.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the like.json.php endpoint, allowing logged-i… |
CVE-2026-90545 | Medium | 4.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php endpoint, allowing… |
CVE-2026-90544 | Medium | 4.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint befor… |
CVE-2026-90543 | Medium | 5.3 | 2026-09-12 | WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in pl… |
CVE-2026-90542 | Medium | 5.4 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders… |
CVE-2026-90541 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing una… |
CVE-2026-90540 | Medium | 4.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding v… |
CVE-2026-90539 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php en… |
CVE-2026-90538 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in playlistsFromUser.json.php that allows un… |
CVE-2026-90536 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoint, allowing unauthenticated attackers t… |
CVE-2026-90534 | Medium | 6.5 | 2026-09-12 | Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounte… |
CVE-2026-90533 | Medium | 6.5 | 2026-09-12 | Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrie… |
CVE-2026-10148 | Medium | 6.4 | 2026-09-12 | The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions u… |
CVE-2026-90474 | Medium | 6.8 | 2026-09-12 | MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by… |
CVE-2026-90473 | Medium | 5.3 | 2026-09-12 | msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element count… |
CVE-2026-90472 | Medium | 5.3 | 2026-09-12 | msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nest… |
CVE-2026-85198 | Medium | 6.5 | 2026-09-12 | The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versio… |
CVE-2026-77161 | Medium | 6.5 | 2026-09-12 | The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and includi… |
CVE-2026-17585 | Medium | 5.3 | 2026-09-12 | The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up… |
CVE-2026-11355 | Medium | 5.3 | 2026-09-12 | The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJA… |
CVE-2026-87919 | Medium | 4.9 | 2026-09-12 | The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the… |
CVE-2026-87918 | Medium | 5.3 | 2026-09-12 | The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI prov… |
CVE-2026-87916 | Medium | 5.3 | 2026-09-12 | The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenti… |
CVE-2026-87894 | Medium | 5.3 | 2026-09-12 | The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation detai… |
CVE-2026-87892 | Medium | 5.3 | 2026-09-12 | The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing w… |
CVE-2026-87891 | Medium | 6.5 | 2026-09-12 | The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing un… |
CVE-2026-87797 | Medium | 4.3 | 2026-09-12 | The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through… |
CVE-2026-86790 | Medium | 6.8 | 2026-09-12 | The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, w… |
CVE-2026-84024 | Medium | 4.3 | 2026-09-12 | The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configu… |
CVE-2026-84023 | Medium | 6.5 | 2026-09-12 | The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify… |
CVE-2026-83532 | Medium | 6.8 | 2026-09-12 | The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowin… |
CVE-2026-82847 | Medium | 6.8 | 2026-09-12 | The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing… |
CVE-2026-78152 | Medium | 5.3 | 2026-09-12 | The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages… |
CVE-2026-77753 | Medium | 5.5 | 2026-09-12 | The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke… |
CVE-2026-77689 | Medium | 5.3 | 2026-09-12 | The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as… |
CVE-2026-90467 | Medium | 4.0 | 2026-09-12 | aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT T… |
CVE-2026-89268 | Medium | 5.4 | 2026-09-12 | QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attac… |
CVE-2026-89267 | Medium | 4.3 | 2026-09-12 | starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users t… |
CVE-2026-90461 | Medium | 6.3 | 2026-09-11 | OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication. |
CVE-2026-54258 | Medium | 6.5 | 2026-09-11 | ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-pri… |
CVE-2026-54248 | Medium | 6.5 | 2026-09-11 | Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1… |
CVE-2026-50018 | Medium | 6.5 | 2026-09-11 | Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration… |
CVE-2026-48496 | Medium | 6.2 | 2026-09-11 | OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and pr… |
CVE-2026-81918 | Medium | 4.8 | 2026-09-11 | Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions… |
CVE-2026-81917 | Medium | 5.4 | 2026-09-11 | Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with… |
CVE-2026-68535 | Medium | 4.3 | 2026-09-11 | Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which… |
CVE-2026-49439 | Medium | 4.3 | 2026-09-11 | OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets`… |
CVE-2026-45057 | Medium | 4.9 | 2026-09-11 | matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the `matrix-sdk-ui` crate prior to 0.17.0 is miss… |
CVE-2026-89332 | Medium | 5.5 | 2026-09-11 | Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthentic… |
CVE-2026-81916 | Medium | 4.3 | 2026-09-11 | Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identi… |
CVE-2026-81915 | Medium | 5.3 | 2026-09-11 | Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and… |
CVE-2026-81913 | Medium | 6.1 | 2026-09-11 | Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain… |
CVE-2026-81912 | Medium | 5.7 | 2026-09-11 | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endp… |
CVE-2026-81911 | Medium | 5.4 | 2026-09-11 | Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template endpoint authorizes the request onl… |
CVE-2026-79035 | Medium | 6.1 | 2026-09-11 | A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers to execute arbitrary… |
CVE-2026-77490 | Medium | 6.1 | 2026-09-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf… |
CVE-2026-68526 | Medium | 4.3 | 2026-09-11 | Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.ph… |
CVE-2026-49463 | Medium | 6.5 | 2026-09-11 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizatio… |
CVE-2026-49462 | Medium | 5.3 | 2026-09-11 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizatio… |
CVE-2026-89329 | Medium | 6.2 | 2026-09-11 | A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid commands… |
CVE-2026-81910 | Medium | 6.5 | 2026-09-11 | Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. Values submitted through… |
CVE-2026-62140 | Medium | 5.3 | 2026-09-11 | Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions. |
CVE-2026-62139 | Medium | 4.3 | 2026-09-11 | Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions. |
CVE-2026-62138 | Medium | 6.5 | 2026-09-11 | Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions. |
CVE-2026-62137 | Medium | 5.3 | 2026-09-11 | Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions. |
CVE-2026-62136 | Medium | 5.3 | 2026-09-11 | Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions. |
CVE-2026-62135 | Medium | 5.3 | 2026-09-11 | Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions. |
CVE-2026-62134 | Medium | 4.3 | 2026-09-11 | Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions. |
CVE-2026-62133 | Medium | 5.4 | 2026-09-11 | Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions. |
CVE-2026-62132 | Medium | 5.3 | 2026-09-11 | Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions. |
CVE-2026-62114 | Medium | 5.3 | 2026-09-11 | Unauthenticated Broken Access Control in Passster <= 4.3.13 versions. |
CVE-2026-62113 | Medium | 4.3 | 2026-09-11 | Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions. |
CVE-2026-62111 | Medium | 6.5 | 2026-09-11 | Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions. |
CVE-2026-62110 | Medium | 6.5 | 2026-09-11 | Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions. |
CVE-2026-62088 | Medium | 5.3 | 2026-09-11 | Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress… |
CVE-2026-27378 | Medium | 5.3 | 2026-09-11 | Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions. |
CVE-2025-69904 | Medium | 4.9 | 2026-09-11 | Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path inp… |