Medium-severity CVEs (page 31)
Page 31 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9161 | Medium | 5.3 | 2026-09-10 | Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 1009202… |
CVE-2026-88038 | Medium | 4.8 | 2026-09-10 | cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name… |
CVE-2026-85544 | Medium | 6.1 | 2026-09-10 | Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within… |
CVE-2026-85543 | Medium | 4.3 | 2026-09-10 | Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device W… |
CVE-2026-88859 | Medium | 6.3 | 2026-09-10 | A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. W… |
CVE-2026-84828 | Medium | 6.5 | 2026-09-10 | A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' comm… |
CVE-2026-5399 | Medium | 6.4 | 2026-09-10 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and inclu… |
CVE-2026-15889 | Medium | 6.4 | 2026-09-10 | The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due… |
CVE-2026-88288 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary f… |
CVE-2026-88284 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control… |
CVE-2026-88283 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack cont… |
CVE-2026-88281 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack… |
CVE-2026-88280 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF work… |
CVE-2026-88279 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to c… |
CVE-2026-88270 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated. |
CVE-2026-88269 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSV… |
CVE-2026-88268 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service. |
CVE-2026-88265 | Medium | 5.6 | 2026-09-10 | A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file… |
CVE-2026-88264 | Medium | 5.6 | 2026-09-10 | A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-cont… |
CVE-2026-42808 | Medium | 6.8 | 2026-09-10 | An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11. The host streaming API function {{coines_read_stream_sensor_data()}} fails… |
CVE-2026-42806 | Medium | 4.3 | 2026-09-10 | An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data par… |
CVE-2026-88770 | Medium | 6.5 | 2026-09-10 | A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption… |
CVE-2026-88763 | Medium | 5.9 | 2026-09-10 | A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. T… |
CVE-2026-82582 | Medium | 4.3 | 2026-09-10 | An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the gr… |
CVE-2026-81635 | Medium | 5.4 | 2026-09-10 | A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses… |
CVE-2026-19840 | Medium | 6.5 | 2026-09-10 | The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user… |
CVE-2026-85645 | Medium | 6.1 | 2026-09-10 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_ac… |
CVE-2026-75880 | Medium | 6.5 | 2026-09-10 | An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery… |
CVE-2026-57822 | Medium | 6.5 | 2026-09-10 | When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform… |
CVE-2026-4657 | Medium | 6.4 | 2026-09-10 | The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the control_selectors meta field in all versions up to, and includi… |
CVE-2026-18594 | Medium | 4.3 | 2026-09-10 | The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugi… |
CVE-2026-18386 | Medium | 4.9 | 2026-09-10 | The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backup_file' p… |
CVE-2026-15823 | Medium | 4.3 | 2026-09-10 | The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable() functi… |
CVE-2026-15820 | Medium | 6.4 | 2026-09-10 | The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module 'attributes' Setting in all versions up to, and… |
CVE-2026-15796 | Medium | 6.4 | 2026-09-10 | The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bg_video_service_url' Setting in all versions up to, and in… |
CVE-2026-87870 | Medium | 6.4 | 2026-09-10 | The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters (interval, format, emailTo) in al… |
CVE-2026-84063 | Medium | 6.5 | 2026-09-10 | BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file… |
CVE-2026-84062 | Medium | 4.3 | 2026-09-10 | BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of th… |
CVE-2026-87926 | Medium | 4.3 | 2026-09-10 | A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the… |
CVE-2026-87924 | Medium | 6.5 | 2026-09-09 | A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part… |
CVE-2026-87923 | Medium | 4.3 | 2026-09-09 | A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown f… |
CVE-2026-15460 | Medium | 5.4 | 2026-09-09 | The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c dispatched inbound data PDUs based only on… |
CVE-2026-88002 | Medium | 6.5 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backe… |
CVE-2026-88001 | Medium | 5.0 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETC… |
CVE-2026-88000 | Medium | 6.5 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/{id}/messages/{message_id}… |
CVE-2026-87997 | Medium | 4.3 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/cha… |
CVE-2026-87994 | Medium | 4.3 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend… |
CVE-2026-87017 | Medium | 4.3 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the ca… |
CVE-2026-75308 | Medium | 6.1 | 2026-09-09 | yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload of the system lacks file type validation. Attackers can uploa… |
CVE-2026-75307 | Medium | 6.1 | 2026-09-09 | zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint. |
CVE-2026-71807 | Medium | 4.3 | 2026-09-09 | In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does… |
CVE-2026-87015 | Medium | 6.8 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a co… |
CVE-2026-87014 | Medium | 6.5 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/route… |
CVE-2026-87013 | Medium | 4.3 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/{id}/update/parent allowed… |
CVE-2026-87012 | Medium | 4.3 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/open_webui/models/calendar.py stored the… |
CVE-2026-79522 | Medium | 6.5 | 2026-09-09 | An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via se… |
CVE-2026-79516 | Medium | 4.0 | 2026-09-09 | An out-of-bounds read in the stbsp_vsnprintf function (stb_sprintf.h) of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via se… |
CVE-2026-79515 | Medium | 4.3 | 2026-09-09 | An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a cra… |
CVE-2026-79514 | Medium | 6.5 | 2026-09-09 | An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a cra… |
CVE-2026-79513 | Medium | 6.5 | 2026-09-09 | A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denia… |
CVE-2026-79387 | Medium | 4.3 | 2026-09-09 | SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords… |
CVE-2026-71803 | Medium | 5.4 | 2026-09-09 | money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to filter or escape the goodsName paramete… |
CVE-2026-71802 | Medium | 5.4 | 2026-09-09 | A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HT… |
CVE-2026-53956 | Medium | 5.4 | 2026-09-09 | Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to version 0.9.0 and `py-rattler` prior to versi… |
CVE-2026-73789 | Medium | 5.3 | 2026-09-09 | A vulnerability in the web-based management interface of CPPM guest account management services could allow an unauthenticated remote attacker to manipulate ac… |
CVE-2026-73788 | Medium | 6.5 | 2026-09-09 | A vulnerability in the ClearPass OnGuard agent could allow an authenticated remote attacker to elevate their own privileges on a vulnerable ClearPass OnGuard d… |
CVE-2026-71616 | Medium | 6.2 | 2026-09-09 | An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gf_route_media_complete_object(). Fi… |
CVE-2026-61915 | Medium | 4.2 | 2026-09-09 | An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker wi… |
CVE-2026-61911 | Medium | 4.3 | 2026-09-09 | An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed… |
CVE-2026-38998 | Medium | 6.5 | 2026-09-09 | A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.26) allows attacker… |
CVE-2026-61907 | Medium | 4.3 | 2026-09-09 | An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another… |
CVE-2026-39020 | Medium | 5.5 | 2026-09-09 | An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted Wavefront OBJ file |
CVE-2025-51619 | Medium | 5.5 | 2026-09-09 | A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows local unprivileged users to cause a denial-of-service (BSOD) condition o… |
CVE-2026-87928 | Medium | 5.4 | 2026-09-09 | MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload… |
CVE-2026-87875 | Medium | 4.3 | 2026-09-09 | The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-o… |
CVE-2026-87872 | Medium | 6.8 | 2026-09-09 | A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS cer… |
CVE-2026-85788 | Medium | 5.5 | 2026-09-09 | Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass th… |
CVE-2026-70425 | Medium | 6.7 | 2026-09-09 | Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain a command injection… |
CVE-2026-40635 | Medium | 5.4 | 2026-09-09 | Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially e… |
CVE-2026-81330 | Medium | 6.5 | 2026-09-09 | The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, a… |
CVE-2026-79947 | Medium | 5.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special E… |
CVE-2026-79946 | Medium | 5.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate… |
CVE-2026-79945 | Medium | 5.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special E… |
CVE-2026-79741 | Medium | 5.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special E… |
CVE-2026-79735 | Medium | 4.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key… |
CVE-2026-79689 | Medium | 5.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special E… |
CVE-2026-78493 | Medium | 5.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special E… |
CVE-2026-78484 | Medium | 5.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special E… |
CVE-2026-83530 | Medium | 4.3 | 2026-09-09 | A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocatio… |
CVE-2026-82530 | Medium | 5.3 | 2026-09-09 | IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to… |
CVE-2026-79941 | Medium | 5.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special E… |
CVE-2026-78482 | Medium | 5.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special E… |
CVE-2026-86774 | Medium | 6.3 | 2026-09-09 | Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission… |
CVE-2026-86773 | Medium | 5.4 | 2026-09-09 | Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints a… |
CVE-2026-86772 | Medium | 5.4 | 2026-09-09 | Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rende… |
CVE-2026-86769 | Medium | 4.3 | 2026-09-09 | Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target… |
CVE-2026-86768 | Medium | 5.4 | 2026-09-09 | Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inven… |
CVE-2026-86767 | Medium | 5.0 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, all… |
CVE-2026-86766 | Medium | 6.5 | 2026-09-09 | Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}… |
CVE-2026-86765 | Medium | 6.5 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users wi… |