Medium-severity CVEs (page 32)
Page 32 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-58481 | Medium | 6.5 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `ba… |
CVE-2026-58414 | Medium | 5.5 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursively collects files using `_collectB… |
CVE-2026-58413 | Medium | 6.1 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes the backup path with… |
CVE-2026-55645 | Medium | 6.5 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connectio… |
CVE-2026-55238 | Medium | 5.3 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capa… |
CVE-2026-50743 | Medium | 5.4 | 2026-07-20 | A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered v… |
CVE-2026-47276 | Medium | 6.5 | 2026-07-20 | In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attacker to crash the NanoMQ broker by sendi… |
CVE-2026-44978 | Medium | 5.3 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulne… |
CVE-2026-42218 | Medium | 5.3 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in respon… |
CVE-2026-35217 | Medium | 6.5 | 2026-07-20 | NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SUBSCRIBE` handling: if a subscription entry is missing the final 1-byte `Subscription Options` field… |
CVE-2026-32823 | Medium | 4.3 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-32819 | Medium | 4.3 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-6793 | Medium | 5.4 | 2026-07-20 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bifra Engineering Consulting Ltd. Q-smart NexT Poll allow… |
CVE-2026-63428 | Medium | 5.8 | 2026-07-20 | HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id, name, value}]` array from the submitte… |
CVE-2026-63102 | Medium | 5.4 | 2026-07-20 | rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting… |
CVE-2026-51026 | Medium | 6.5 | 2026-07-20 | Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request. |
CVE-2026-48824 | Medium | 5.3 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2026-45710, "Mailpit: Set a default 50MB… |
CVE-2026-46671 | Medium | 4.4 | 2026-07-20 | Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciously crafted `.onetoc2` table-of-content… |
CVE-2026-45712 | Medium | 5.9 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=…) maintains a package-level assets m… |
CVE-2026-45711 | Medium | 5.9 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http <base-url> <out-dir> sub-command downloads every mess… |
CVE-2026-45709 | Medium | 5.8 | 2026-07-20 | Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, "Server-Side Request Forgery (SSRF) via HTML Check AP… |
CVE-2026-32822 | Medium | 6.1 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-26199 | Medium | 6.5 | 2026-07-20 | HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for… |
CVE-2026-26081 | Medium | 4.8 | 2026-07-20 | HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected. |
CVE-2026-13724 | Medium | 4.3 | 2026-07-20 | Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Man… |
CVE-2026-63091 | Medium | 6.5 | 2026-07-20 | ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated… |
CVE-2026-54685 | Medium | 5.3 | 2026-07-20 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute… |
CVE-2026-45139 | Medium | 6.5 | 2026-07-20 | CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','j… |
CVE-2026-16277 | Medium | 6.5 | 2026-07-20 | A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address information returned by… |
CVE-2026-16244 | Medium | 6.3 | 2026-07-20 | A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2026-63762 | Medium | 6.5 | 2026-07-20 | SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via… |
CVE-2026-63761 | Medium | 4.3 | 2026-07-20 | SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 (DEFINE ACCESS ... TYPE JWT ALGORIT… |
CVE-2026-63759 | Medium | 6.5 | 2026-07-20 | SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can sen… |
CVE-2026-63758 | Medium | 5.4 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other… |
CVE-2026-63755 | Medium | 6.5 | 2026-07-20 | SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE K… |
CVE-2026-63754 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CRE… |
CVE-2026-63753 | Medium | 4.3 | 2026-07-20 | SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-tim… |
CVE-2026-63752 | Medium | 4.3 | 2026-07-20 | SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwri… |
CVE-2026-63751 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protecte… |
CVE-2026-63750 | Medium | 5.3 | 2026-07-20 | SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffe… |
CVE-2026-63749 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permission expressions referencing $value, $b… |
CVE-2026-63748 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by fi… |
CVE-2026-63746 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records f… |
CVE-2026-63745 | Medium | 5.4 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing t… |
CVE-2026-63744 | Medium | 4.1 | 2026-07-20 | SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targ… |
CVE-2026-63743 | Medium | 6.4 | 2026-07-20 | SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-ne… |
CVE-2026-63742 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries o… |
CVE-2026-63741 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated… |
CVE-2026-63740 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead… |
CVE-2026-63738 | Medium | 4.3 | 2026-07-20 | SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals… |
CVE-2026-63737 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of… |
CVE-2026-63736 | Medium | 4.1 | 2026-07-20 | SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists… |
CVE-2026-63734 | Medium | 4.9 | 2026-07-20 | SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash th… |
CVE-2026-63733 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement… |
CVE-2026-16254 | Medium | 4.3 | 2026-07-20 | A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an out-of-bounds access that panics the sca… |
CVE-2026-15813 | Medium | 6.5 | 2026-07-20 | A vulnerability was found in the network packet de-fragmentation engine of kronosnet (Version affected <= 1.34). The internal reassembly code does not properly… |
CVE-2026-15588 | Medium | 5.3 | 2026-07-20 | A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforc… |
CVE-2026-2445 | Medium | 6.1 | 2026-07-20 | The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the resp… |
CVE-2026-8825 | Medium | 4.9 | 2026-07-20 | The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoi… |
CVE-2026-13432 | Medium | 5.4 | 2026-07-20 | The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-leve… |
CVE-2026-13156 | Medium | 5.4 | 2026-07-20 | The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but… |
CVE-2026-12973 | Medium | 6.5 | 2026-07-20 | The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to… |
CVE-2026-12972 | Medium | 5.3 | 2026-07-20 | The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to… |
CVE-2026-12898 | Medium | 6.5 | 2026-07-20 | The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, all… |
CVE-2026-12724 | Medium | 4.3 | 2026-07-20 | The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the pass… |
CVE-2026-12723 | Medium | 5.3 | 2026-07-20 | The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the c… |
CVE-2026-11868 | Medium | 5.3 | 2026-07-20 | The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unau… |
CVE-2026-10724 | Medium | 4.8 | 2026-07-20 | The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through it… |
CVE-2026-45138 | Medium | 5.4 | 2026-07-20 | CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` validation rule used to sanitize blog po… |
CVE-2026-64185 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: sysfs: don't remove existing directory on update failure When sysfs_update_group() is cal… |
CVE-2026-64184 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() damon_sysfs_memcg_path_to_id… |
CVE-2026-64183 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: efi: Allocate runtime workqueue before ACPI init Since commit 5894cf571e14 ("acpi/prmt… |
CVE-2026-64182 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: fix memory block reference leak in poison accounting memblk_nr_poiso… |
CVE-2026-64180 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: mm/memory_hotplug: fix memory block reference leak on remove Patch series "mm: Fix memory… |
CVE-2026-64179 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix potential memory leaks in ipc_imem_init() The memory allocated in ip… |
CVE-2026-64177 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded sk_receive_skb() The networking receive path is u… |
CVE-2026-64174 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() cfg80211_merge_profile() re… |
CVE-2026-64173 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: tracing: Do not call map->ops->elt_free() if elt_alloc() fails In paths where tracing_map… |
CVE-2026-64171 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: i2c: tegra: fix pm_runtime leak on mutex_lock failure If tegra_i2c_mutex_lock() fails, th… |
CVE-2026-64170 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: spi: qup: fix error pointer deref after DMA setup failure The driver falls back to PIO mo… |
CVE-2026-64169 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: spi: ep93xx: fix error pointer deref after DMA setup failure The driver falls back to PIO… |
CVE-2026-64168 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: spi: sprd: fix error pointer deref after DMA setup failure The driver falls back to PIO m… |
CVE-2026-64167 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: kho: skip KHO for crash kernel kho_fill_kimage() unconditionally populates the kimage wit… |
CVE-2026-64166 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Check for NULL FF-A ID table while driver registration The bus match c… |
CVE-2026-64165 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ARM: integrator: Fix early initialization Starting with commit bdb249fce9ad4 ("ARM: integ… |
CVE-2026-64164 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() The trace even… |
CVE-2026-64163 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: test_kprobes: clear kprobes between test runs Running the kprobes sanity tests twice make… |
CVE-2026-64161 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: ti: icssm-prueth: fix eth_ports_node leak in probe The error path on of_property_rea… |
CVE-2026-64156 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfs, afs: Fix write skipping in dir/link writepages Fix netfs_write_single() and afs_si… |
CVE-2026-64135 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX adm1266_nvmem_re… |
CVE-2026-64131 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: mm/memory: fix spurious warning when unmapping device-private/exclusive pages Device priv… |
CVE-2026-64130 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free __GFP_… |
CVE-2026-64129 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page When check_stabl… |
CVE-2026-64128 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISO_END frames received without prior ISO_START ISO data PDUs carry… |
CVE-2026-64127 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer Commit 1c08108f30… |
CVE-2026-64120 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: ethtool: fix NULL pointer dereference in phy_reply_size In phy_prepare_data(), sever… |
CVE-2026-64119 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: l2tp: use list_del_rcu in l2tp_session_unhash An unprivileged local user can pin a host C… |
CVE-2026-64110 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: igc: fix potential skb leak in igc_fpe_xmit_smd_frame() When igc_fpe_init_tx_descriptor()… |
CVE-2026-64107 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put() In the pcm… |
CVE-2026-64105 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Free private_irqs when init fails after allocation Companion to commit… |