Medium-severity CVEs (page 41)
Page 41 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15473 | Medium | 6.3 | 2026-07-12 | A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the file /callrec/restoreCallAction.do of… |
CVE-2026-15472 | Medium | 4.3 | 2026-07-12 | A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/composeEmailAction.do. Exe… |
CVE-2026-15471 | Medium | 4.3 | 2026-07-12 | A vulnerability was found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/pci_dss_status.jsp. Performing a manipulat… |
CVE-2026-15470 | Medium | 4.3 | 2026-07-12 | A vulnerability has been found in Eleveo Call Recording Software 9.7.0. Affected by this issue is some unknown functionality of the file /callrec/group.jsp. Su… |
CVE-2026-10660 | Medium | 6.4 | 2026-07-11 | The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assistant.c reassembled remote Broadcast Receive State data into a si… |
CVE-2026-61454 | Medium | 5.3 | 2026-07-11 | The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at… |
CVE-2026-60088 | Medium | 5.5 | 2026-07-11 | PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers c… |
CVE-2026-56763 | Medium | 4.8 | 2026-07-11 | Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ pr… |
CVE-2026-56296 | Medium | 5.3 | 2026-07-11 | Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transfer_app RPC function that returns distinct error messages for existi… |
CVE-2026-56240 | Medium | 4.3 | 2026-07-11 | Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows organizations with exhausted or expired… |
CVE-2026-9017 | Medium | 5.3 | 2026-07-11 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. Thi… |
CVE-2026-6801 | Medium | 5.3 | 2026-07-11 | The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the context_blog_modal_pop… |
CVE-2026-1382 | Medium | 6.4 | 2026-07-11 | The fresh Podcaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'freshpodcaster' shortcode in all versions up to, and including… |
CVE-2026-15010 | Medium | 6.4 | 2026-07-11 | The bbp Style Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.4.5 via the Topic Form Additional Fiel… |
CVE-2026-12994 | Medium | 5.3 | 2026-07-11 | The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is du… |
CVE-2026-12738 | Medium | 4.3 | 2026-07-11 | The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-12126 | Medium | 6.4 | 2026-07-11 | The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment 'post_title' in… |
CVE-2026-12103 | Medium | 4.3 | 2026-07-11 | The Wallet for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.4. This is due to the plugin no… |
CVE-2026-11901 | Medium | 5.3 | 2026-07-11 | The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 2.3.1. This is… |
CVE-2026-11898 | Medium | 4.4 | 2026-07-11 | The White Label CMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.7.12 due to in… |
CVE-2026-11591 | Medium | 4.4 | 2026-07-11 | The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3… |
CVE-2026-10865 | Medium | 5.3 | 2026-07-11 | The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template… |
CVE-2026-10041 | Medium | 4.3 | 2026-07-11 | The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27… |
CVE-2025-5017 | Medium | 4.9 | 2026-07-11 | The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uid’ parameter in all versions up to, and i… |
CVE-2026-9738 | Medium | 4.4 | 2026-07-11 | The Print, PDF, Email by PrintFriendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content_position_css' parameter in all versio… |
CVE-2026-7620 | Medium | 4.3 | 2026-07-11 | The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.1. This is due to the plugin… |
CVE-2026-7559 | Medium | 4.3 | 2026-07-11 | The Affilia – Affiliate Program & Referral Tracking for WordPress plugin for WordPress is vulnerable to unauthorized access in all versions up to, and includin… |
CVE-2026-6804 | Medium | 5.3 | 2026-07-11 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12. This is d… |
CVE-2026-6803 | Medium | 5.3 | 2026-07-11 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.12. This is… |
CVE-2026-3552 | Medium | 4.3 | 2026-07-11 | The SurfLink - Ultimate Link Manager plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the ajax_import_… |
CVE-2026-1832 | Medium | 4.3 | 2026-07-11 | The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base plugin for WordPress is vulnerable to unauthorized cache deletion due to a missing capability… |
CVE-2026-15097 | Medium | 6.4 | 2026-07-11 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'height_slider' Slider Module Field in all versions up to, and includ… |
CVE-2026-15096 | Medium | 6.4 | 2026-07-11 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Map Module 'b_width_map' Field in all versions up to, and including… |
CVE-2026-13250 | Medium | 5.3 | 2026-07-11 | The Solace Extra plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.3. This is due to the plugin not properly… |
CVE-2026-13116 | Medium | 4.3 | 2026-07-11 | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5… |
CVE-2026-12141 | Medium | 4.9 | 2026-07-11 | The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_to… |
CVE-2025-13968 | Medium | 6.4 | 2026-07-11 | The Starboard Suite Reservation Calendars plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in the [starboard-suite-li… |
CVE-2026-8678 | Medium | 4.3 | 2026-07-11 | The MyParcel plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.25.1. This is due to the plugin not properly ve… |
CVE-2026-7544 | Medium | 4.3 | 2026-07-11 | The Mux Video Uploader plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the muxvideo_enqueu… |
CVE-2026-5743 | Medium | 6.4 | 2026-07-11 | The SimpLy Gallery Block & Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block attributes in all versions up to, and including… |
CVE-2026-3367 | Medium | 4.4 | 2026-07-11 | The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and i… |
CVE-2026-15073 | Medium | 6.5 | 2026-07-11 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions… |
CVE-2026-15072 | Medium | 6.5 | 2026-07-11 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions… |
CVE-2026-13262 | Medium | 6.5 | 2026-07-11 | The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'val' parameter… |
CVE-2026-12426 | Medium | 5.3 | 2026-07-11 | The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3… |
CVE-2026-10628 | Medium | 4.3 | 2026-07-11 | The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to… |
CVE-2026-11426 | Medium | 6.5 | 2026-07-11 | The UnderConstructionPage PRO plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.76. This is due to the plugin a… |
CVE-2026-15087 | Medium | 5.9 | 2026-07-10 | vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*. |
CVE-2026-15086 | Medium | 5.9 | 2026-07-10 | vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*. |
CVE-2026-11915 | Medium | 5.9 | 2026-07-10 | vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*. |
CVE-2026-11914 | Medium | 5.9 | 2026-07-10 | vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*. |
CVE-2026-58591 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This i… |
CVE-2026-58590 | Medium | 5.4 | 2026-07-10 | Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0. |
CVE-2026-58589 | Medium | 5.4 | 2026-07-10 | Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0. |
CVE-2026-58588 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). T… |
CVE-2026-58587 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). T… |
CVE-2026-55808 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Thi… |
CVE-2026-55806 | Medium | 5.9 | 2026-07-10 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from… |
CVE-2026-55804 | Medium | 5.9 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects… |
CVE-2026-55803 | Medium | 5.9 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects… |
CVE-2026-55187 | Medium | 5.8 | 2026-07-10 | Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped for CVE-2026-27808 is incomplete because the tools.IsInternal… |
CVE-2026-52761 | Medium | 5.8 | 2026-07-10 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode t… |
CVE-2026-49844 | Medium | 5.9 | 2026-07-10 | Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This iss… |
CVE-2026-15085 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue… |
CVE-2026-15084 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS… |
CVE-2026-15083 | Medium | 4.2 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection… |
CVE-2026-15082 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting… |
CVE-2026-15080 | Medium | 4.3 | 2026-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Trans… |
CVE-2026-15079 | Medium | 5.4 | 2026-07-10 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions… |
CVE-2026-13243 | Medium | 4.8 | 2026-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: fro… |
CVE-2026-13242 | Medium | 6.5 | 2026-07-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue… |
CVE-2026-13241 | Medium | 6.5 | 2026-07-10 | Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0. |
CVE-2026-13240 | Medium | 6.5 | 2026-07-10 | Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0. |
CVE-2026-13239 | Medium | 6.5 | 2026-07-10 | Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0. |
CVE-2026-13238 | Medium | 4.8 | 2026-07-10 | Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payment… |
CVE-2026-13237 | Medium | 4.8 | 2026-07-10 | Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1… |
CVE-2026-13236 | Medium | 4.2 | 2026-07-10 | Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2… |
CVE-2026-13234 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scr… |
CVE-2026-13231 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) all… |
CVE-2026-11908 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagif… |
CVE-2026-10770 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This… |
CVE-2026-10769 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affect… |
CVE-2026-57230 | Medium | 5.4 | 2026-07-10 | OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built… |
CVE-2026-57221 | Medium | 5.0 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.decl… |
CVE-2026-57218 | Medium | 6.5 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expi… |
CVE-2026-57217 | Medium | 6.5 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6, RabbitMQ topic authorization can allow restricted topic writes and b… |
CVE-2026-57216 | Medium | 6.8 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a… |
CVE-2026-57214 | Medium | 5.4 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML… |
CVE-2026-57213 | Medium | 4.8 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag f… |
CVE-2026-57211 | Medium | 6.5 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static ca… |
CVE-2026-55664 | Medium | 4.3 | 2026-07-10 | Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying th… |
CVE-2026-13039 | Medium | 5.3 | 2026-07-10 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression… |
CVE-2026-57157 | Medium | 6.5 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, FreeRDP server implementations with the MS-RDPECAM camera device enumerator c… |
CVE-2026-55515 | Medium | 5.0 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes Checko… |
CVE-2026-55481 | Medium | 4.8 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header_color and related branding color settings inside a CSS styl… |
CVE-2026-55479 | Medium | 4.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permissi… |
CVE-2026-55475 | Medium | 5.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to… |
CVE-2026-55469 | Medium | 6.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal s… |
CVE-2026-55462 | Medium | 4.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authorize only user viewing before loading and… |
CVE-2026-55461 | Medium | 6.1 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled Referer header into… |