Medium-severity CVEs (page 29)
Page 29 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-68526 | Medium | 4.3 | 2026-09-11 | Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.ph… |
CVE-2026-49463 | Medium | 6.5 | 2026-09-11 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizatio… |
CVE-2026-49462 | Medium | 5.3 | 2026-09-11 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizatio… |
CVE-2026-89329 | Medium | 6.2 | 2026-09-11 | A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid commands… |
CVE-2026-81910 | Medium | 6.5 | 2026-09-11 | Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. Values submitted through… |
CVE-2026-62140 | Medium | 5.3 | 2026-09-11 | Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions. |
CVE-2026-62139 | Medium | 4.3 | 2026-09-11 | Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions. |
CVE-2026-62138 | Medium | 6.5 | 2026-09-11 | Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions. |
CVE-2026-62137 | Medium | 5.3 | 2026-09-11 | Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions. |
CVE-2026-62136 | Medium | 5.3 | 2026-09-11 | Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions. |
CVE-2026-62135 | Medium | 5.3 | 2026-09-11 | Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions. |
CVE-2026-62134 | Medium | 4.3 | 2026-09-11 | Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions. |
CVE-2026-62133 | Medium | 5.4 | 2026-09-11 | Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions. |
CVE-2026-62132 | Medium | 5.3 | 2026-09-11 | Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions. |
CVE-2026-62114 | Medium | 5.3 | 2026-09-11 | Unauthenticated Broken Access Control in Passster <= 4.3.13 versions. |
CVE-2026-62113 | Medium | 4.3 | 2026-09-11 | Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions. |
CVE-2026-62111 | Medium | 6.5 | 2026-09-11 | Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions. |
CVE-2026-62110 | Medium | 6.5 | 2026-09-11 | Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions. |
CVE-2026-62088 | Medium | 5.3 | 2026-09-11 | Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress… |
CVE-2026-27378 | Medium | 5.3 | 2026-09-11 | Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions. |
CVE-2025-69904 | Medium | 4.9 | 2026-09-11 | Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path inp… |
CVE-2026-9160 | Medium | 4.3 | 2026-09-11 | Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection. This is… |
CVE-2026-89090 | Medium | 5.9 | 2026-09-11 | An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to te… |
CVE-2026-82535 | Medium | 6.1 | 2026-09-11 | Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payl… |
CVE-2026-7298 | Medium | 6.1 | 2026-09-11 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerc… |
CVE-2026-18495 | Medium | 6.1 | 2026-09-11 | A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted B… |
CVE-2026-18061 | Medium | 5.9 | 2026-09-11 | Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with… |
CVE-2026-8304 | Medium | 5.5 | 2026-09-11 | Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Exploiting Incorrectly Configured Access Con… |
CVE-2026-89265 | Medium | 4.3 | 2026-09-11 | MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify ann… |
CVE-2026-89264 | Medium | 4.3 | 2026-09-11 | MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attribu… |
CVE-2026-89263 | Medium | 5.3 | 2026-09-11 | MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email no… |
CVE-2026-89261 | Medium | 6.5 | 2026-09-11 | MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, r… |
CVE-2026-89012 | Medium | 6.5 | 2026-09-11 | Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers… |
CVE-2026-15439 | Medium | 6.5 | 2026-09-11 | The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (ac… |
CVE-2026-85083 | Medium | 6.8 | 2026-09-11 | The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this we… |
CVE-2026-89298 | Medium | 4.9 | 2026-09-11 | A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user w… |
CVE-2026-57843 | Medium | 5.5 | 2026-09-11 | NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual add… |
CVE-2026-89258 | Medium | 6.3 | 2026-09-11 | Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups… |
CVE-2026-89257 | Medium | 5.4 | 2026-09-11 | AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the… |
CVE-2026-89252 | Medium | 6.5 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated use… |
CVE-2026-89251 | Medium | 6.5 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.php, allowing logged-in users to submit… |
CVE-2026-89248 | Medium | 5.3 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebR… |
CVE-2026-89247 | Medium | 6.1 | 2026-09-11 | WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/AD_Server/VMAP.php, which is reach… |
CVE-2026-89246 | Medium | 5.4 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that… |
CVE-2026-89245 | Medium | 6.5 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attac… |
CVE-2026-89244 | Medium | 6.1 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php… |
CVE-2026-89241 | Medium | 6.1 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that cop… |
CVE-2026-89240 | Medium | 6.1 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword… |
CVE-2026-89239 | Medium | 6.1 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage() function… |
CVE-2026-89148 | Medium | 5.4 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a *.json.php… |
CVE-2024-12145 | Medium | 4.3 | 2026-09-11 | The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_act… |
CVE-2026-86813 | Medium | 4.8 | 2026-09-11 | The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email head… |
CVE-2026-86809 | Medium | 5.3 | 2026-09-11 | The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to… |
CVE-2026-85116 | Medium | 6.5 | 2026-09-11 | The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, i… |
CVE-2026-82215 | Medium | 5.9 | 2026-09-11 | The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before… |
CVE-2026-82213 | Medium | 5.3 | 2026-09-11 | The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing una… |
CVE-2026-77159 | Medium | 5.5 | 2026-09-11 | A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without chec… |
CVE-2026-87859 | Medium | 5.3 | 2026-09-11 | morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, w… |
CVE-2026-87123 | Medium | 5.9 | 2026-09-11 | hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with… |
CVE-2026-87727 | Medium | 6.5 | 2026-09-11 | a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the a… |
CVE-2026-89179 | Medium | 4.3 | 2026-09-11 | WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerability. Unauthenticated attackers on the… |
CVE-2026-89175 | Medium | 5.3 | 2026-09-11 | Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can… |
CVE-2026-89173 | Medium | 5.3 | 2026-09-11 | Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enu… |
CVE-2026-6642 | Medium | 6.4 | 2026-09-11 | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up t… |
CVE-2026-6641 | Medium | 6.4 | 2026-09-11 | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to and including 3… |
CVE-2026-6640 | Medium | 6.4 | 2026-09-11 | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_link_attributes' parameter in all versions up to, an… |
CVE-2026-86815 | Medium | 5.5 | 2026-09-11 | The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-executi… |
CVE-2026-86812 | Medium | 6.5 | 2026-09-11 | The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks re… |
CVE-2026-86782 | Medium | 5.5 | 2026-09-11 | The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and ab… |
CVE-2026-86781 | Medium | 5.3 | 2026-09-11 | The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file down… |
CVE-2026-86780 | Medium | 6.8 | 2026-09-11 | The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow u… |
CVE-2026-85678 | Medium | 6.8 | 2026-09-11 | The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end… |
CVE-2026-83546 | Medium | 6.8 | 2026-09-11 | The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contribu… |
CVE-2026-83545 | Medium | 6.8 | 2026-09-11 | The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with co… |
CVE-2026-82305 | Medium | 5.3 | 2026-09-11 | The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated use… |
CVE-2026-14566 | Medium | 4.3 | 2026-09-11 | The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order ite… |
CVE-2026-14565 | Medium | 5.4 | 2026-09-11 | The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to… |
CVE-2026-14562 | Medium | 5.3 | 2026-09-11 | The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadat… |
CVE-2026-89158 | Medium | 6.5 | 2026-09-11 | PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write. |
CVE-2026-89157 | Medium | 5.7 | 2026-09-11 | PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern. |
CVE-2026-84960 | Medium | 6.1 | 2026-09-11 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including… |
CVE-2026-7438 | Medium | 6.4 | 2026-09-11 | The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_i… |
CVE-2026-78172 | Medium | 6.1 | 2026-09-11 | The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, a… |
CVE-2026-77150 | Medium | 6.1 | 2026-09-11 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all versions up to, and… |
CVE-2026-19985 | Medium | 6.1 | 2026-09-11 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'po… |
CVE-2026-18964 | Medium | 6.1 | 2026-09-11 | The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Refl… |
CVE-2026-18562 | Medium | 6.1 | 2026-09-11 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter… |
CVE-2026-12215 | Medium | 5.3 | 2026-09-11 | The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7… |
CVE-2026-11496 | Medium | 6.5 | 2026-09-11 | The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object Reference in all v… |
CVE-2026-11446 | Medium | 5.3 | 2026-09-11 | The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions… |
CVE-2026-78135 | Medium | 5.6 | 2026-09-11 | libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there c… |
CVE-2026-89145 | Medium | 4.2 | 2026-09-11 | Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependenci… |
CVE-2026-89092 | Medium | 4.2 | 2026-09-11 | The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS quer… |
CVE-2026-88914 | Medium | 4.4 | 2026-09-11 | A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an… |
CVE-2026-78129 | Medium | 5.9 | 2026-09-11 | strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption. |
CVE-2026-78126 | Medium | 5.9 | 2026-09-11 | strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin. |
CVE-2026-78123 | Medium | 5.9 | 2026-09-11 | strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin. |
CVE-2026-86087 | Medium | 4.3 | 2026-09-10 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the… |
CVE-2026-79725 | Medium | 6.5 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control. |
CVE-2026-79723 | Medium | 5.0 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled… |