Medium-severity CVEs (page 35)
Page 35 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-62214 | Medium | 6.5 | 2026-07-17 | OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and c… |
CVE-2026-62213 | Medium | 6.5 | 2026-07-17 | OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework… |
CVE-2026-62211 | Medium | 5.0 | 2026-07-17 | OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust callers to acces… |
CVE-2026-62210 | Medium | 6.5 | 2026-07-17 | OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker r… |
CVE-2026-62208 | Medium | 6.5 | 2026-07-17 | OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller… |
CVE-2026-44251 | Medium | 6.5 | 2026-07-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.0.0 and above, prior to 4.14.5, a size_t integer un… |
CVE-2026-40106 | Medium | 4.7 | 2026-07-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above prior to 4.14.5 contain a heap-based buf… |
CVE-2026-2594 | Medium | 6.4 | 2026-07-17 | The Smart Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.7. This is due to insufficient… |
CVE-2026-33754 | Medium | 6.5 | 2026-07-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.9.0 and above, prior to 4.14.5, a remote attacker c… |
CVE-2026-33434 | Medium | 4.3 | 2026-07-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.6.0 and above, prior to 4.14.5, a logic error in Ch… |
CVE-2026-44452 | Medium | 5.9 | 2026-07-16 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it co… |
CVE-2026-44434 | Medium | 5.3 | 2026-07-16 | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit dccf5d4, Quicly was vulnerable to statele… |
CVE-2026-44433 | Medium | 5.3 | 2026-07-16 | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, an adversarial peer could send a… |
CVE-2026-62826 | Medium | 4.6 | 2026-07-16 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-58643 | Medium | 6.1 | 2026-07-16 | Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofin… |
CVE-2026-14782 | Medium | 4.9 | 2026-07-16 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, an… |
CVE-2026-13713 | Medium | 6.2 | 2026-07-16 | YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled… |
CVE-2026-61378 | Medium | 5.5 | 2026-07-16 | A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash. |
CVE-2026-60073 | Medium | 5.9 | 2026-07-16 | An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system cras… |
CVE-2026-57896 | Medium | 6.1 | 2026-07-16 | An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request… |
CVE-2026-36425 | Medium | 6.5 | 2026-07-16 | An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process t… |
CVE-2026-33731 | Medium | 6.5 | 2026-07-16 | WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook handler at plugin/AuthorizeNet/webhook.php contains a signat… |
CVE-2026-11889 | Medium | 6.5 | 2026-07-16 | SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation attack that could allow an authorized at… |
CVE-2024-32387 | Medium | 5.7 | 2026-07-16 | An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via the community string… |
CVE-2024-32385 | Medium | 4.3 | 2026-07-16 | An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via a boardID and revisio… |
CVE-2026-63397 | Medium | 6.4 | 2026-07-16 | remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript… |
CVE-2026-62299 | Medium | 5.3 | 2026-07-16 | CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response… |
CVE-2026-61718 | Medium | 5.4 | 2026-07-16 | bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization b… |
CVE-2026-60140 | Medium | 6.1 | 2026-07-16 | An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request… |
CVE-2026-47089 | Medium | 4.3 | 2026-07-16 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMA… |
CVE-2026-47085 | Medium | 4.0 | 2026-07-16 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name o… |
CVE-2026-47084 | Medium | 6.5 | 2026-07-16 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could inv… |
CVE-2026-47083 | Medium | 4.3 | 2026-07-16 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authentica… |
CVE-2026-47082 | Medium | 5.4 | 2026-07-16 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve… |
CVE-2026-46514 | Medium | 6.5 | 2026-07-16 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext passwor… |
CVE-2026-46404 | Medium | 6.8 | 2026-07-16 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link loc… |
CVE-2026-46378 | Medium | 6.2 | 2026-07-16 | Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPatte… |
CVE-2026-46377 | Medium | 6.2 | 2026-07-16 | Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*T… |
CVE-2026-46338 | Medium | 4.3 | 2026-07-16 | PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containme… |
CVE-2026-46341 | Medium | 6.1 | 2026-07-16 | The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Pr… |
CVE-2026-44968 | Medium | 6.3 | 2026-07-16 | dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended unsanitized n… |
CVE-2026-15945 | Medium | 4.3 | 2026-07-16 | A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a del… |
CVE-2026-15737 | Medium | 5.7 | 2026-07-16 | AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. … |
CVE-2026-6511 | Medium | 5.5 | 2026-07-16 | During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows that could allow a… |
CVE-2026-55548 | Medium | 4.3 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsA… |
CVE-2026-50012 | Medium | 5.5 | 2026-07-16 | Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_di… |
CVE-2026-47729 | Medium | 6.5 | 2026-07-16 | Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway… |
CVE-2026-45795 | Medium | 5.3 | 2026-07-16 | The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects beca… |
CVE-2026-45612 | Medium | 5.5 | 2026-07-16 | rz-libdemangle is a Rizin library for demangling symbols. Prior to 6bf56d3, the Rust demangler in src/rust/rust_v0.c can perform an out-of-bounds read when the… |
CVE-2026-44596 | Medium | 6.5 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamc… |
CVE-2026-44595 | Medium | 4.3 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the req… |
CVE-2026-10590 | Medium | 4.4 | 2026-07-16 | A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrarily trigger a System Management Interru… |
CVE-2026-10589 | Medium | 6.0 | 2026-07-16 | A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode. |
CVE-2026-10588 | Medium | 4.4 | 2026-07-16 | A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory. |
CVE-2026-10587 | Medium | 6.0 | 2026-07-16 | A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode. |
CVE-2025-45870 | Medium | 6.5 | 2026-07-16 | LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet class, allowing authenticated user to ex… |
CVE-2026-63082 | Medium | 5.4 | 2026-07-16 | Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agen… |
CVE-2026-63081 | Medium | 5.4 | 2026-07-16 | Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability that allows authenticated attackers wit… |
CVE-2026-57205 | Medium | 4.3 | 2026-07-16 | SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated… |
CVE-2026-55440 | Medium | 6.5 | 2026-07-16 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in ufo/server/ws/handl… |
CVE-2026-54568 | Medium | 4.3 | 2026-07-16 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket se… |
CVE-2026-56456 | Medium | 5.3 | 2026-07-16 | HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding i… |
CVE-2026-56455 | Medium | 5.3 | 2026-07-16 | HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input si… |
CVE-2026-56454 | Medium | 5.9 | 2026-07-16 | HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographi… |
CVE-2026-56453 | Medium | 5.5 | 2026-07-16 | HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the serv… |
CVE-2026-9494 | Medium | 5.5 | 2026-07-16 | An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credential… |
CVE-2026-12391 | Medium | 5.0 | 2026-07-16 | An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framewo… |
CVE-2024-58360 | Medium | 6.5 | 2026-07-16 | stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification… |
CVE-2026-35148 | Medium | 6.3 | 2026-07-16 | HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authen… |
CVE-2026-35146 | Medium | 6.3 | 2026-07-16 | HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via t… |
CVE-2026-15727 | Medium | 4.9 | 2026-07-16 | The WP Bulk Delete plugin for WordPress is vulnerable to generic SQL Injection via the 'delete_user_roles' parameter in all versions up to, and including, 1.4… |
CVE-2026-15651 | Medium | 4.9 | 2026-07-16 | The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via the 'filtersource' parameter in all versions up to, and includ… |
CVE-2026-15610 | Medium | 4.3 | 2026-07-16 | The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inc… |
CVE-2026-15407 | Medium | 4.3 | 2026-07-16 | The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not prope… |
CVE-2026-15350 | Medium | 4.3 | 2026-07-16 | The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.20. This is due to the plugin not pro… |
CVE-2026-15324 | Medium | 4.4 | 2026-07-16 | The SysBasics Customize My Account for WooCommerce – Live My Account Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'row_… |
CVE-2026-15106 | Medium | 5.3 | 2026-07-16 | The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inc… |
CVE-2026-15099 | Medium | 6.4 | 2026-07-16 | The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10… |
CVE-2026-15022 | Medium | 6.5 | 2026-07-16 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions u… |
CVE-2026-15021 | Medium | 6.4 | 2026-07-16 | The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due… |
CVE-2026-13767 | Medium | 6.5 | 2026-07-16 | The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to ins… |
CVE-2026-13755 | Medium | 6.4 | 2026-07-16 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute in all ver… |
CVE-2026-13754 | Medium | 6.5 | 2026-07-16 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and includi… |
CVE-2026-12979 | Medium | 5.5 | 2026-07-16 | The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing user… |
CVE-2026-12869 | Medium | 6.1 | 2026-07-16 | The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action (i… |
CVE-2026-12684 | Medium | 6.5 | 2026-07-16 | The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJ… |
CVE-2026-12510 | Medium | 5.9 | 2026-07-16 | The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing use… |
CVE-2026-12395 | Medium | 6.5 | 2026-07-16 | The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users… |
CVE-2026-11866 | Medium | 5.4 | 2026-07-16 | The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request d… |
CVE-2026-11371 | Medium | 6.1 | 2026-07-16 | The BetterDocs WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and outputting it, and the feature that ge… |
CVE-2026-15458 | Medium | 4.9 | 2026-07-16 | The SEO Booster plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_field' parameter in all versions up to, and including, 7.3.1 due to i… |
CVE-2026-15445 | Medium | 4.9 | 2026-07-16 | The SEO Booster plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.3.1 due to i… |
CVE-2026-15306 | Medium | 6.1 | 2026-07-16 | The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search… |
CVE-2026-15652 | Medium | 6.4 | 2026-07-16 | The Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'align' Block Attribu… |
CVE-2026-15336 | Medium | 4.3 | 2026-07-16 | The Catch Themes Demo Import plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.3. This is due to the catch_themes… |
CVE-2026-14987 | Medium | 6.4 | 2026-07-16 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twitter_message' Sequoia Template… |
CVE-2026-13005 | Medium | 4.4 | 2026-07-16 | The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions… |
CVE-2026-12941 | Medium | 6.5 | 2026-07-16 | The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' para… |
CVE-2026-12434 | Medium | 4.3 | 2026-07-16 | The List category posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.95.0 via the sanitize_stat… |
CVE-2026-12409 | Medium | 4.3 | 2026-07-16 | The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forg… |