Medium-severity CVEs (page 40)
Page 40 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57797 | Medium | 4.3 | 2026-07-13 | Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Edu… |
CVE-2026-57783 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in merkulove Speaker speaker allows Stored XSS.This issue af… |
CVE-2026-57782 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in PressTigers Universal Clocks universal-clocks allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-57781 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in Sovlix MeetingHub meetinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-57780 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Envision Envision Page Builder envision-page-build… |
CVE-2026-57779 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in themebeez Fascinate fascinate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-57778 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access C… |
CVE-2026-57776 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2026-57774 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-57711 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PSM Plugins SupportCandy supportcandy allows Stored XSS.T… |
CVE-2026-57698 | Medium | 6.5 | 2026-07-13 | Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows… |
CVE-2026-57694 | Medium | 6.5 | 2026-07-13 | Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-57693 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Exploiting Incor… |
CVE-2026-57691 | Medium | 5.8 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli Anti-Malware Security and Brute-Force Firewall gotmls… |
CVE-2026-57424 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in knitpay Razorpay Payment Links for WooCommerce rzp-woocommerce allows Exploiting Incorrectly Configured Access Control S… |
CVE-2026-57420 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Netrr Author Box WP Lens author-box-for-divi allows Store… |
CVE-2026-57419 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured A… |
CVE-2026-57418 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2026-57414 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot for eCommerce – WoowBot woowbo… |
CVE-2026-57413 | Medium | 6.4 | 2026-07-13 | Server-Side Request Forgery (SSRF) vulnerability in bdthemes Instant Image Generator ai-image allows Server Side Request Forgery.This issue affects Instant Ima… |
CVE-2026-57412 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in Codemenschen Gift Vouchers gift-voucher allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-57408 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control S… |
CVE-2026-57406 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in Roxnor FundEngine wp-fundraising-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-57404 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Confi… |
CVE-2026-57402 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible Refund and Return Order for WooCommerce f… |
CVE-2026-57400 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in WP Swings Event Tickets Manager for WooCommerce event-tickets-manager-for-woocommerce allows Exploiting Incorrectly Conf… |
CVE-2026-57395 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tour… |
CVE-2026-57393 | Medium | 6.5 | 2026-07-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder… |
CVE-2026-57392 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tour… |
CVE-2026-57391 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tangible Loops & Logic tangible-loops-and-logic allows St… |
CVE-2026-57390 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in EDGARROJAS Extra Product Options Builder for WooCommerce additional-product-fields-for-woocommerce allows Exploiting Inc… |
CVE-2026-57377 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2026-57375 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-57365 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hitesh Chandwani reCAPTCHA (v2 & v3) for Asgaros Foru… |
CVE-2026-57364 | Medium | 6.5 | 2026-07-13 | Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &a… |
CVE-2026-49876 | Medium | 6.5 | 2026-07-13 | Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs… |
CVE-2026-9708 | Medium | 4.9 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has access to the target te… |
CVE-2026-9597 | Medium | 5.4 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token… |
CVE-2026-9571 | Medium | 5.9 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allow… |
CVE-2026-6850 | Medium | 6.5 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which a… |
CVE-2026-15547 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in Shibby Tomato up to 1.28.0000. This affects the function sub_2D048 of the component CIFS Mount Handler. Executing a manipulat… |
CVE-2026-15546 | Medium | 6.3 | 2026-07-13 | A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub_2D568 of the component start_jffs2. Performing… |
CVE-2026-10106 | Medium | 6.5 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify that the channel referenced in an action cookie matches the channel… |
CVE-2026-10103 | Medium | 4.3 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which all… |
CVE-2026-10085 | Medium | 5.4 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constrained channel flag to public and private channels… |
CVE-2026-57829 | Medium | 6.1 | 2026-07-13 | Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthentica… |
CVE-2026-15540 | Medium | 4.3 | 2026-07-13 | A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the co… |
CVE-2026-15539 | Medium | 4.7 | 2026-07-13 | A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=bo… |
CVE-2026-15538 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This ma… |
CVE-2026-15536 | Medium | 6.3 | 2026-07-13 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patviewprescription.php. The manipulat… |
CVE-2026-12397 | Medium | 4.3 | 2026-07-13 | The WP Job Portal WordPress plugin before 2.5.5 does not verify ownership when returning an employer's contact email for a given job, allowing authenticated u… |
CVE-2026-12396 | Medium | 5.4 | 2026-07-13 | The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated… |
CVE-2026-12274 | Medium | 6.5 | 2026-07-13 | The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its con… |
CVE-2026-12273 | Medium | 4.3 | 2026-07-13 | The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, an… |
CVE-2026-12271 | Medium | 5.4 | 2026-07-13 | The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with su… |
CVE-2026-12081 | Medium | 5.0 | 2026-07-13 | The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacke… |
CVE-2026-10551 | Medium | 6.1 | 2026-07-13 | The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used du… |
CVE-2026-15535 | Medium | 6.3 | 2026-07-13 | A vulnerability was determined in AkariAsai self-rag up to 1fcdc420e48f50a7d7ab1ece5494221b93252e99. Affected by this issue is the function Indexer.deserialize… |
CVE-2026-15533 | Medium | 4.7 | 2026-07-13 | A security flaw has been discovered in DedeCMS 5.7.118. Impacted is an unknown function of the file /plus/search.php of the component Column Management. Perfor… |
CVE-2026-15531 | Medium | 5.3 | 2026-07-13 | A vulnerability has been found in yashbhalgat HashNeRF-pytorch up to 82885e698295982504eb6a26d060a6b2473e3706. Affected by this issue is the function torch.loa… |
CVE-2026-15530 | Medium | 5.3 | 2026-07-13 | A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=up… |
CVE-2026-15553 | Medium | 5.3 | 2026-07-13 | Enterprise Cloud Database developed by Ragic has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload malicious files and… |
CVE-2026-15552 | Medium | 6.1 | 2026-07-13 | Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated remote attackers to inject persistent Ja… |
CVE-2026-15529 | Medium | 6.3 | 2026-07-13 | A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performi… |
CVE-2026-15527 | Medium | 5.3 | 2026-07-13 | A vulnerability has been found in better-auth better-icons up to 1.0.5. This vulnerability affects unknown code of the component scan_project_icons/sync_icon… |
CVE-2026-15525 | Medium | 6.3 | 2026-07-13 | A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function _validate_urls of the file src/adloop/ads/write.py. Performin… |
CVE-2026-15523 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /Simple… |
CVE-2026-15522 | Medium | 5.3 | 2026-07-13 | A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js… |
CVE-2026-15521 | Medium | 5.3 | 2026-07-13 | A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the file build/server.cjs of the component upd… |
CVE-2026-15520 | Medium | 5.3 | 2026-07-13 | A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompress_R2004_section of the file src/decode.c of the compone… |
CVE-2026-15519 | Medium | 5.0 | 2026-07-13 | A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file system_prompt.jinja of the component PyPI Handler. Perfor… |
CVE-2026-15551 | Medium | 5.5 | 2026-07-13 | Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects . |
CVE-2026-15518 | Medium | 4.7 | 2026-07-13 | A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Con… |
CVE-2026-15516 | Medium | 5.6 | 2026-07-13 | A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/install/controller/Index.php of the com… |
CVE-2026-15513 | Medium | 6.3 | 2026-07-13 | A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the file /cgi-bin/adm.cgi. Performing a mani… |
CVE-2026-15512 | Medium | 6.3 | 2026-07-13 | A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen… |
CVE-2026-15510 | Medium | 6.3 | 2026-07-12 | A vulnerability was found in Leantime up to 3.8.0. Affected is the function Setting::saveSetting of the component API. The manipulation results in improper aut… |
CVE-2026-15509 | Medium | 6.3 | 2026-07-12 | A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the… |
CVE-2026-15508 | Medium | 6.3 | 2026-07-12 | A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function build_target_url of the file ai-gateway/src/dispatcher/service.rs o… |
CVE-2026-15507 | Medium | 6.3 | 2026-07-12 | A vulnerability was detected in coollabsio Coolify up to 4.1.1. The impacted element is an unknown function of the file /app/Policies/ of the component Policy… |
CVE-2026-10664 | Medium | 5.0 | 2026-07-12 | The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied TWT (Target Wake Ti… |
CVE-2026-10663 | Medium | 6.1 | 2026-07-12 | In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) freed the root usb_device slab object… |
CVE-2026-15502 | Medium | 6.3 | 2026-07-12 | A vulnerability was detected in AojiaoZero Antaris 1.0. This affects the function _rewardPurchase of the file /ipn.php of the component PayPal IPN Payment Hand… |
CVE-2026-15501 | Medium | 6.3 | 2026-07-12 | A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function ToolsRoute.test_mcp_connection of the fi… |
CVE-2026-56336 | Medium | 5.3 | 2026-07-12 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id a… |
CVE-2026-56252 | Medium | 5.4 | 2026-07-12 | Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook… |
CVE-2026-15500 | Medium | 6.3 | 2026-07-12 | A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Affected by this vulnerability is the function get_online_plugins of the file astrbot/dashb… |
CVE-2026-15499 | Medium | 6.3 | 2026-07-12 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/cron_tools… |
CVE-2026-15496 | Medium | 6.3 | 2026-07-12 | A vulnerability was found in SonicCloudOrg sonic-agent up to 2.7.2. The impacted element is the function evalIsFailed of the file sonic-agent/src/main/java/org… |
CVE-2026-15495 | Medium | 6.3 | 2026-07-12 | A vulnerability has been found in SonicCloudOrg sonic-agent up to 2.7.2. The affected element is an unknown function of the file AndroidWSServer.java of the co… |
CVE-2026-15494 | Medium | 4.7 | 2026-07-12 | A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switch_status.php. Executing a… |
CVE-2026-15492 | Medium | 4.3 | 2026-07-12 | A security vulnerability has been detected in igweze wizgrade up to b1d55f22b90cd7e7a6e5002f006d7c649e8086d6. This vulnerability affects unknown code of the fi… |
CVE-2026-15487 | Medium | 6.3 | 2026-07-12 | A vulnerability was found in TRENDnet TEW-821DAP 1.11B03. This impacts the function sub_41FBD0 of the file /goform/system_ntp of the component Firmware Update… |
CVE-2026-15486 | Medium | 6.3 | 2026-07-12 | A vulnerability has been found in TRENDnet TEW-821DAP 1.11B03. This affects the function sub_42026C of the file /goform/tools_ddns of the component Firmware Up… |
CVE-2026-15485 | Medium | 6.3 | 2026-07-12 | A flaw has been found in TRENDnet TEW-821DAP 1.11B03. The impacted element is the function sub_43F2C4 of the file /goform/tools_nslookup of the component DNS L… |
CVE-2026-15478 | Medium | 6.3 | 2026-07-12 | A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the co… |
CVE-2026-15477 | Medium | 6.3 | 2026-07-12 | A vulnerability was detected in Bahmni bahmnicore up to 0.93. This affects the function additionalParams of the file /openmrs/ws/rest/v1/bahmnicore/sql of the… |
CVE-2026-15476 | Medium | 5.3 | 2026-07-12 | A security vulnerability has been detected in QILING Disk Master 6.0.0.0. The impacted element is an unknown function in the library diskbckp.sys of the compon… |
CVE-2026-15475 | Medium | 5.3 | 2026-07-12 | A weakness has been identified in MiniTool Partition Wizard up to 13.6. The affected element is an unknown function in the library pwdrvio.sys of the component… |
CVE-2026-15474 | Medium | 4.3 | 2026-07-12 | A security flaw has been discovered in Eleveo Call Recording Software 9.7.0. Impacted is an unknown function of the file /callrec/audio.jsp of the component Ca… |