Medium-severity CVEs (page 3)
Page 3 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-96895 | Medium | 6.8 | 2026-09-27 | The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when ren… |
CVE-2026-92995 | Medium | 5.3 | 2026-09-27 | The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to do… |
CVE-2026-92436 | Medium | 5.3 | 2026-09-27 | The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-suppli… |
CVE-2026-89006 | Medium | 6.8 | 2026-09-27 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with th… |
CVE-2026-89003 | Medium | 4.1 | 2026-09-27 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the respons… |
CVE-2026-89001 | Medium | 4.9 | 2026-09-27 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribu… |
CVE-2026-89000 | Medium | 4.1 | 2026-09-27 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL befor… |
CVE-2026-86841 | Medium | 4.7 | 2026-09-27 | The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly r… |
CVE-2026-85002 | Medium | 6.8 | 2026-09-27 | The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow user… |
CVE-2026-84069 | Medium | 5.3 | 2026-09-27 | The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it t… |
CVE-2026-82841 | Medium | 5.3 | 2026-09-27 | The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does… |
CVE-2026-100863 | Medium | 5.0 | 2026-09-27 | Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/services/ssrf_guard.py in 0.0.91. First, th… |
CVE-2026-100862 | Medium | 4.9 | 2026-09-27 | heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook… |
CVE-2026-100861 | Medium | 5.0 | 2026-09-27 | heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF pr… |
CVE-2026-100860 | Medium | 5.5 | 2026-09-27 | heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backend/app/services/node_execution/nodes/red… |
CVE-2026-100859 | Medium | 6.5 | 2026-09-27 | Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credentia… |
CVE-2026-100858 | Medium | 6.8 | 2026-09-27 | heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP requests to… |
CVE-2026-100855 | Medium | 6.5 | 2026-09-27 | AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows authenticate… |
CVE-2026-100854 | Medium | 6.3 | 2026-09-27 | AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence… |
CVE-2026-100853 | Medium | 5.9 | 2026-09-27 | In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download m… |
CVE-2026-100836 | Medium | 4.3 | 2026-09-27 | Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decod… |
CVE-2026-100834 | Medium | 5.9 | 2026-09-27 | http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter… |
CVE-2026-100745 | Medium | 6.3 | 2026-09-27 | A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the component Wireles… |
CVE-2026-100725 | Medium | 6.5 | 2026-09-27 | http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilte… |
CVE-2026-100724 | Medium | 5.4 | 2026-09-27 | http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in revers… |
CVE-2026-100722 | Medium | 6.8 | 2026-09-27 | vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromi… |
CVE-2025-71422 | Medium | 5.7 | 2026-09-27 | Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host… |
CVE-2026-94408 | Medium | 4.9 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94400 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94399 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94398 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94397 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94396 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-82300 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). |
CVE-2026-82294 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). |
CVE-2026-78582 | Medium | 6.5 | 2026-09-26 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC… |
CVE-2026-72662 | Medium | 6.3 | 2026-09-26 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Func… |
CVE-2026-100719 | Medium | 6.5 | 2026-09-26 | Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. A… |
CVE-2026-100712 | Medium | 6.5 | 2026-09-26 | froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g… |
CVE-2026-100710 | Medium | 4.9 | 2026-09-26 | Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of Sub… |
CVE-2026-100702 | Medium | 5.9 | 2026-09-26 | Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhausti… |
CVE-2026-100701 | Medium | 5.9 | 2026-09-26 | Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-speci… |
CVE-2026-100699 | Medium | 5.3 | 2026-09-26 | Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part… |
CVE-2026-100698 | Medium | 5.8 | 2026-09-26 | Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture grou… |
CVE-2026-100696 | Medium | 5.8 | 2026-09-26 | Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/driver… |
CVE-2026-100695 | Medium | 6.1 | 2026-09-26 | Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper esc… |
CVE-2026-100694 | Medium | 6.1 | 2026-09-26 | Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw H… |
CVE-2026-100691 | Medium | 5.4 | 2026-09-26 | Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option befor… |
CVE-2026-100689 | Medium | 5.9 | 2026-09-26 | GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-… |
CVE-2026-100688 | Medium | 6.5 | 2026-09-26 | Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows… |
CVE-2026-100687 | Medium | 5.5 | 2026-09-26 | Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocke… |
CVE-2026-100681 | Medium | 5.4 | 2026-09-26 | Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoin… |
CVE-2026-100678 | Medium | 6.5 | 2026-09-26 | stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with… |
CVE-2026-100677 | Medium | 5.3 | 2026-09-26 | stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthentica… |
CVE-2026-100675 | Medium | 6.5 | 2026-09-26 | stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated us… |
CVE-2026-100674 | Medium | 4.3 | 2026-09-26 | stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submittin… |
CVE-2026-100668 | Medium | 6.5 | 2026-09-26 | Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is on the sandbox allowlist but is regist… |
CVE-2026-100667 | Medium | 5.3 | 2026-09-26 | grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by t… |
CVE-2026-100659 | Medium | 6.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority ps… |
CVE-2026-100654 | Medium | 6.5 | 2026-09-26 | vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates o… |
CVE-2026-100653 | Medium | 6.5 | 2026-09-26 | vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision… |
CVE-2026-100652 | Medium | 5.9 | 2026-09-26 | vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token… |
CVE-2026-100651 | Medium | 6.5 | 2026-09-26 | vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a… |
CVE-2026-100650 | Medium | 6.5 | 2026-09-26 | vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB c… |
CVE-2026-100648 | Medium | 5.3 | 2026-09-26 | vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file si… |
CVE-2026-100647 | Medium | 5.3 | 2026-09-26 | vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, wh… |
CVE-2026-100640 | Medium | 4.7 | 2026-09-26 | SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by… |
CVE-2026-100635 | Medium | 5.9 | 2026-09-26 | SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attribu… |
CVE-2026-100634 | Medium | 4.7 | 2026-09-26 | SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process (app/electron/ma… |
CVE-2026-100633 | Medium | 6.5 | 2026-09-26 | SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard (util.IsForbiddenAbsPat… |
CVE-2026-100632 | Medium | 6.5 | 2026-09-26 | Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields cla… |
CVE-2026-100630 | Medium | 5.4 | 2026-09-26 | AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attack… |
CVE-2026-100629 | Medium | 5.5 | 2026-09-26 | Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that th… |
CVE-2026-100628 | Medium | 4.3 | 2026-09-26 | capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, reques… |
CVE-2026-100626 | Medium | 4.3 | 2026-09-26 | capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage… |
CVE-2026-100624 | Medium | 5.4 | 2026-09-26 | Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request i… |
CVE-2026-100621 | Medium | 4.3 | 2026-09-26 | Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication… |
CVE-2026-100616 | Medium | 5.5 | 2026-09-26 | capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table… |
CVE-2026-100613 | Medium | 5.3 | 2026-09-26 | capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of p… |
CVE-2026-100611 | Medium | 6.5 | 2026-09-26 | Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly created API keys. When a… |
CVE-2026-100609 | Medium | 6.8 | 2026-09-26 | Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOn… |
CVE-2026-100604 | Medium | 5.4 | 2026-09-26 | ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerU… |
CVE-2026-100603 | Medium | 5.4 | 2026-09-26 | ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a… |
CVE-2026-100602 | Medium | 6.5 | 2026-09-26 | ClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the publi… |
CVE-2026-100601 | Medium | 5.3 | 2026-09-26 | ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview… |
CVE-2026-100600 | Medium | 5.3 | 2026-09-26 | ClawHub (the openclaw/clawhub application/backend) does not bind anonymous HTTP API requests to a trusted caller identity, so all direct anonymous API requests… |
CVE-2026-100313 | Medium | 4.3 | 2026-09-26 | A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of t… |
CVE-2026-100312 | Medium | 6.3 | 2026-09-26 | A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unkno… |
CVE-2026-96533 | Medium | 5.8 | 2026-09-26 | The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a publi… |
CVE-2026-96531 | Medium | 6.8 | 2026-09-26 | The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper e… |
CVE-2026-92411 | Medium | 6.8 | 2026-09-26 | The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it o… |
CVE-2026-89237 | Medium | 6.8 | 2026-09-26 | The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated… |
CVE-2026-84097 | Medium | 6.5 | 2026-09-26 | The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, bef… |
CVE-2026-19708 | Medium | 5.9 | 2026-09-26 | The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes t… |
CVE-2026-11871 | Medium | 5.3 | 2026-09-26 | The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team me… |
CVE-2026-15273 | Medium | 6.4 | 2026-09-26 | The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI in all version 4.0.0 due to insufficient input sanitization… |
CVE-2026-100595 | Medium | 6.5 | 2026-09-26 | OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the diagnostics export command that allows non-owner channel senders to acce… |
CVE-2026-100594 | Medium | 6.5 | 2026-09-26 | OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and… |
CVE-2026-100593 | Medium | 5.4 | 2026-09-26 | OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the documented owner-only requirement for persistent `/activation` policy changes in group c… |
CVE-2026-100592 | Medium | 6.3 | 2026-09-26 | OpenClaw is an agent gateway distributed via npm. In versions >= 2026.4.10 and < 2026.7.1, persistent memory dreaming mutations omit owner permission checks. A… |