Medium-severity CVEs (page 30)
Page 30 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-79590 | Medium | 6.5 | 2026-09-10 | A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that… |
CVE-2026-71642 | Medium | 4.0 | 2026-09-10 | An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via… |
CVE-2026-54054 | Medium | 6.5 | 2026-09-10 | Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, `POST /api/files/u… |
CVE-2026-49838 | Medium | 5.9 | 2026-09-10 | GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PAT… |
CVE-2026-49837 | Medium | 5.9 | 2026-09-10 | GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability pars… |
CVE-2026-45767 | Medium | 4.4 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a mal… |
CVE-2026-36392 | Medium | 5.4 | 2026-09-10 | FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can inject arbitrary JavaScript into an item's ti… |
CVE-2026-9667 | Medium | 5.3 | 2026-09-10 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause… |
CVE-2026-9327 | Medium | 6.3 | 2026-09-10 | IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This… |
CVE-2026-9225 | Medium | 6.5 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access… |
CVE-2026-9176 | Medium | 6.7 | 2026-09-10 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this v… |
CVE-2026-89089 | Medium | 6.5 | 2026-09-10 | A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authen… |
CVE-2026-45752 | Medium | 5.9 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to ve… |
CVE-2026-45751 | Medium | 5.9 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suric… |
CVE-2026-3096 | Medium | 4.7 | 2026-09-10 | The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly… |
CVE-2026-19596 | Medium | 5.9 | 2026-09-10 | An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a s… |
CVE-2022-26962 | Medium | 5.4 | 2026-09-10 | Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS via the name… |
CVE-2026-9338 | Medium | 5.3 | 2026-09-10 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could expl… |
CVE-2026-9336 | Medium | 6.5 | 2026-09-10 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative end… |
CVE-2026-88060 | Medium | 6.1 | 2026-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22… |
CVE-2026-88059 | Medium | 4.0 | 2026-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20… |
CVE-2026-88058 | Medium | 6.1 | 2026-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22… |
CVE-2026-88057 | Medium | 6.1 | 2026-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20… |
CVE-2026-88035 | Medium | 4.7 | 2026-09-10 | A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past… |
CVE-2026-88032 | Medium | 5.9 | 2026-09-10 | A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted… |
CVE-2026-87107 | Medium | 5.4 | 2026-09-10 | Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-impor… |
CVE-2026-87106 | Medium | 6.5 | 2026-09-10 | Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory b… |
CVE-2026-89045 | Medium | 4.0 | 2026-09-10 | zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infi… |
CVE-2026-89044 | Medium | 6.5 | 2026-09-10 | Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-En… |
CVE-2026-88055 | Medium | 5.5 | 2026-09-10 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager… |
CVE-2026-88054 | Medium | 5.5 | 2026-09-10 | Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks b… |
CVE-2026-88028 | Medium | 6.5 | 2026-09-10 | Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-… |
CVE-2026-88026 | Medium | 6.5 | 2026-09-10 | Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied chara… |
CVE-2026-88050 | Medium | 5.5 | 2026-09-10 | Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts… |
CVE-2026-88049 | Medium | 5.5 | 2026-09-10 | Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and Ne… |
CVE-2026-88046 | Medium | 5.3 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject pare… |
CVE-2026-52097 | Medium | 6.8 | 2026-09-10 | An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, loca… |
CVE-2026-88940 | Medium | 5.3 | 2026-09-10 | knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories… |
CVE-2026-88938 | Medium | 6.5 | 2026-09-10 | knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywher… |
CVE-2026-88015 | Medium | 5.3 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or li… |
CVE-2026-88014 | Medium | 6.3 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend… |
CVE-2026-88012 | Medium | 5.3 | 2026-09-10 | Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.res… |
CVE-2026-87913 | Medium | 5.9 | 2026-09-10 | A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source… |
CVE-2026-87912 | Medium | 5.9 | 2026-09-10 | A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obt… |
CVE-2026-81052 | Medium | 6.8 | 2026-09-10 | Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical acc… |
CVE-2026-81051 | Medium | 6.6 | 2026-09-10 | Dell ThinOS 10, versions prior to 2605_10.2616, contain a Security Version Number Mutable to Older Versions vulnerability. A low privileged attacker with physi… |
CVE-2026-81049 | Medium | 4.4 | 2026-09-10 | Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could… |
CVE-2026-88898 | Medium | 6.5 | 2026-09-10 | AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to… |
CVE-2026-88897 | Medium | 5.9 | 2026-09-10 | Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web… |
CVE-2026-88006 | Medium | 6.5 | 2026-09-10 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issue… |
CVE-2026-88005 | Medium | 6.5 | 2026-09-10 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues… |
CVE-2026-85310 | Medium | 6.5 | 2026-09-10 | import_contacts Path Traversal in Groundhogg <= 4.7.1 versions. |
CVE-2026-81793 | Medium | 6.5 | 2026-09-10 | Unauthenticated Broken Access Control in Salon booking system <= 10.31.5 versions. |
CVE-2026-81791 | Medium | 6.5 | 2026-09-10 | Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions. |
CVE-2026-81788 | Medium | 6.3 | 2026-09-10 | Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions. |
CVE-2026-81787 | Medium | 6.5 | 2026-09-10 | Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions. |
CVE-2026-81785 | Medium | 6.5 | 2026-09-10 | Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions. |
CVE-2026-81782 | Medium | 6.5 | 2026-09-10 | Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions. |
CVE-2026-81275 | Medium | 6.5 | 2026-09-10 | Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions. |
CVE-2026-78536 | Medium | 6.5 | 2026-09-10 | Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions. |
CVE-2026-66674 | Medium | 5.6 | 2026-09-10 | Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions. |
CVE-2026-66632 | Medium | 6.5 | 2026-09-10 | Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions. |
CVE-2026-15461 | Medium | 5.3 | 2026-09-10 | The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl78xx/) embeds a generic struct gnss_nmea0183_match… |
CVE-2026-88896 | Medium | 5.3 | 2026-09-10 | EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to int… |
CVE-2026-88894 | Medium | 5.4 | 2026-09-10 | Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk… |
CVE-2026-88892 | Medium | 5.0 | 2026-09-10 | OpenPanel is an analytics platform. In all versions (no patched release available at time of publication), the data importer fetches a caller-supplied URL with… |
CVE-2026-88884 | Medium | 5.8 | 2026-09-10 | Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15… |
CVE-2026-88878 | Medium | 5.3 | 2026-09-10 | Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transpor… |
CVE-2026-88875 | Medium | 4.3 | 2026-09-10 | AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video respons… |
CVE-2026-88871 | Medium | 4.3 | 2026-09-10 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request forgery vulnerability in the CustomizeUs… |
CVE-2026-88860 | Medium | 6.3 | 2026-09-10 | Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can ret… |
CVE-2026-88790 | Medium | 4.8 | 2026-09-10 | A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/f… |
CVE-2026-45763 | Medium | 5.9 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to ve… |
CVE-2026-12683 | Medium | 5.4 | 2026-09-10 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allo… |
CVE-2026-12682 | Medium | 5.4 | 2026-09-10 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allo… |
CVE-2026-9161 | Medium | 5.3 | 2026-09-10 | Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 1009202… |
CVE-2026-88038 | Medium | 4.8 | 2026-09-10 | cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name… |
CVE-2026-85544 | Medium | 6.1 | 2026-09-10 | Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within… |
CVE-2026-85543 | Medium | 4.3 | 2026-09-10 | Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device W… |
CVE-2026-88859 | Medium | 6.3 | 2026-09-10 | A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. W… |
CVE-2026-84828 | Medium | 6.5 | 2026-09-10 | A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' comm… |
CVE-2026-5399 | Medium | 6.4 | 2026-09-10 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and inclu… |
CVE-2026-15889 | Medium | 6.4 | 2026-09-10 | The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due… |
CVE-2026-88288 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary f… |
CVE-2026-88284 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control… |
CVE-2026-88283 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack cont… |
CVE-2026-88281 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack… |
CVE-2026-88280 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF work… |
CVE-2026-88279 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to c… |
CVE-2026-88270 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated. |
CVE-2026-88269 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSV… |
CVE-2026-88268 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service. |
CVE-2026-88265 | Medium | 5.6 | 2026-09-10 | A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file… |
CVE-2026-88264 | Medium | 5.6 | 2026-09-10 | A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-cont… |
CVE-2026-42808 | Medium | 6.8 | 2026-09-10 | An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11. The host streaming API function {{coines_read_stream_sensor_data()}} fails… |
CVE-2026-42806 | Medium | 4.3 | 2026-09-10 | An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data par… |
CVE-2026-88770 | Medium | 6.5 | 2026-09-10 | A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption… |
CVE-2026-88763 | Medium | 5.9 | 2026-09-10 | A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. T… |
CVE-2026-82582 | Medium | 4.3 | 2026-09-10 | An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the gr… |
CVE-2026-81635 | Medium | 5.4 | 2026-09-10 | A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses… |