Medium-severity CVEs (page 42)
Page 42 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-86351 | Medium | 6.1 | 2026-09-07 | Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because… |
CVE-2026-86294 | Medium | 4.3 | 2026-09-07 | A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-setti… |
CVE-2026-85640 | Medium | 6.3 | 2026-09-07 | Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component |
CVE-2026-77699 | Medium | 5.0 | 2026-09-07 | Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path. |
CVE-2026-77697 | Medium | 6.3 | 2026-09-07 | Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction |
CVE-2026-86347 | Medium | 6.5 | 2026-09-07 | Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wild… |
CVE-2026-86293 | Medium | 6.5 | 2026-09-07 | A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.p… |
CVE-2026-86291 | Medium | 6.3 | 2026-09-07 | A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/us_edit1.php. Su… |
CVE-2026-77698 | Medium | 5.7 | 2026-09-07 | Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade. |
CVE-2026-86342 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against a… |
CVE-2026-86332 | Medium | 6.5 | 2026-09-07 | A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the… |
CVE-2026-86289 | Medium | 4.3 | 2026-09-07 | A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. P… |
CVE-2026-86288 | Medium | 6.3 | 2026-09-07 | A vulnerability has been found in ModelCloud GPTQModel up to 7.2.0. This vulnerability affects unknown code of the file gptqmodel/nn_modules/qlinear/tritonv2.p… |
CVE-2026-86285 | Medium | 4.3 | 2026-09-07 | A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Con… |
CVE-2026-86284 | Medium | 5.3 | 2026-09-07 | A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnera… |
CVE-2026-86281 | Medium | 4.3 | 2026-09-07 | A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This impacts an unknown function. Performi… |
CVE-2026-86280 | Medium | 5.3 | 2026-09-07 | A vulnerability was identified in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This affects an unknown function of the file ci… |
CVE-2026-86279 | Medium | 6.3 | 2026-09-07 | A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impacted element is an unknown function of… |
CVE-2026-86278 | Medium | 4.3 | 2026-09-07 | A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected element is an unknown function of the f… |
CVE-2026-86275 | Medium | 5.3 | 2026-09-07 | A vulnerability was detected in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This vulnerability affects the function register… |
CVE-2026-86274 | Medium | 5.3 | 2026-09-07 | A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar… |
CVE-2026-86271 | Medium | 4.7 | 2026-09-07 | A vulnerability was found in FluentCMS up to 0.0.5. This affects the function GetAccessible of the file src/Backend/FluentCMS.Services/Permissions/PermissionMa… |
CVE-2026-86270 | Medium | 6.3 | 2026-09-07 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/settings_edit.php… |
CVE-2026-86315 | Medium | 6.2 | 2026-09-07 | An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to… |
CVE-2026-86269 | Medium | 6.3 | 2026-09-07 | A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/emp_edit1.php. This manipu… |
CVE-2026-86267 | Medium | 6.3 | 2026-09-07 | A security vulnerability has been detected in itsourcecode Information System Society Membership System 1.0. This issue affects some unknown processing of the… |
CVE-2026-86265 | Medium | 6.3 | 2026-09-07 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/us… |
CVE-2026-86314 | Medium | 6.2 | 2026-09-07 | Integer overflow in the source-bounds check in Memory::init() (src/runtime/Memory.cpp) in Samsung walrus on all platforms allows a remote attacker to cause an… |
CVE-2026-86264 | Medium | 4.3 | 2026-09-07 | A flaw has been found in sfturing ssm_pro up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file ssm_pro/src/main/java/cn/… |
CVE-2026-86260 | Medium | 6.5 | 2026-09-07 | A security flaw has been discovered in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function modifyPassWord… |
CVE-2026-86245 | Medium | 6.3 | 2026-09-07 | A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_… |
CVE-2026-86244 | Medium | 4.3 | 2026-09-07 | A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_beta. Affected is the function register/login of the file application/index/contro… |
CVE-2026-86241 | Medium | 4.3 | 2026-09-07 | A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of… |
CVE-2026-86240 | Medium | 4.7 | 2026-09-07 | A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. This affects the function catchImage of the file backend/widgets/ueditor/Uploader.php of th… |
CVE-2026-86239 | Medium | 5.3 | 2026-09-07 | A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/Ued… |
CVE-2026-20518 | Medium | 4.4 | 2026-09-07 | In geniezone, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor ha… |
CVE-2026-20517 | Medium | 6.7 | 2026-09-07 | In geniezone, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has alre… |
CVE-2026-20516 | Medium | 5.5 | 2026-09-07 | In MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denial of service with User execution privil… |
CVE-2026-20515 | Medium | 5.5 | 2026-09-07 | In gpu, there is a possible system crash due to use after free. This could lead to local information disclosure with User execution privileges needed. User int… |
CVE-2026-20514 | Medium | 4.4 | 2026-09-07 | In Audio HAL, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious acto… |
CVE-2026-20513 | Medium | 4.4 | 2026-09-07 | In Audio HAL, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure if a malicious actor… |
CVE-2026-20512 | Medium | 6.7 | 2026-09-07 | In Audio HAL, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious act… |
CVE-2026-20511 | Medium | 6.7 | 2026-09-07 | In SurfaceFlinger, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has alrea… |
CVE-2026-20510 | Medium | 6.7 | 2026-09-07 | In camera middleware, there is a possible escalation of privilege due to double free. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2026-20509 | Medium | 6.7 | 2026-09-07 | In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2026-20508 | Medium | 6.7 | 2026-09-07 | In Power HAL, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege if a malicious actor has alre… |
CVE-2026-20507 | Medium | 6.7 | 2026-09-07 | In Audio HAL, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has alre… |
CVE-2026-20506 | Medium | 6.7 | 2026-09-07 | In Audio HAL, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has alre… |
CVE-2026-20504 | Medium | 5.3 | 2026-09-07 | In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base st… |
CVE-2026-20503 | Medium | 5.3 | 2026-09-07 | In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base st… |
CVE-2026-20500 | Medium | 5.5 | 2026-09-07 | In Modem, there is a possible system crash due to improper input validation. This could lead to local denial of service with User execution privileges needed… |
CVE-2026-86238 | Medium | 4.3 | 2026-09-07 | A vulnerability was determined in projectworlds Online Examination System 1.0. The affected element is an unknown function of the file feedback.php of the comp… |
CVE-2026-86237 | Medium | 5.3 | 2026-09-07 | A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function test_default_model of the file sdk/src/openagents/sd… |
CVE-2026-86236 | Medium | 6.3 | 2026-09-07 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/pro_transac.php?ac… |
CVE-2026-86235 | Medium | 6.3 | 2026-09-07 | A flaw has been found in itsourcecode Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/pos_transac.php?action=add. Th… |
CVE-2026-86234 | Medium | 6.3 | 2026-09-07 | A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/cust_transac.php?action=add. The m… |
CVE-2026-86233 | Medium | 6.3 | 2026-09-07 | A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /pa… |
CVE-2026-86232 | Medium | 6.3 | 2026-09-06 | A weakness has been identified in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/su… |
CVE-2026-86228 | Medium | 4.3 | 2026-09-06 | A security vulnerability has been detected in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module… |
CVE-2026-83534 | Medium | 6.4 | 2026-09-06 | PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arbitrary code with s… |
CVE-2026-19634 | Medium | 6.4 | 2026-09-06 | PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted… |
CVE-2026-86217 | Medium | 5.3 | 2026-09-06 | A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function of the file /ht/hotel_db%20(1).sql of t… |
CVE-2026-86216 | Medium | 4.3 | 2026-09-06 | A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details… |
CVE-2026-86215 | Medium | 4.3 | 2026-09-06 | A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/server.php of the compo… |
CVE-2026-86258 | Medium | 5.9 | 2026-09-06 | nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validat… |
CVE-2026-86257 | Medium | 5.4 | 2026-09-06 | wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas… |
CVE-2026-86256 | Medium | 5.4 | 2026-09-06 | wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enter… |
CVE-2026-86255 | Medium | 6.5 | 2026-09-06 | wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long period… |
CVE-2026-86254 | Medium | 6.8 | 2026-09-06 | wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using… |
CVE-2026-86253 | Medium | 5.9 | 2026-09-06 | h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized… |
CVE-2026-86252 | Medium | 5.3 | 2026-09-06 | h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events… |
CVE-2026-86251 | Medium | 5.9 | 2026-09-06 | h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-enc… |
CVE-2026-86212 | Medium | 4.3 | 2026-09-06 | A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper aut… |
CVE-2026-86205 | Medium | 5.4 | 2026-09-06 | h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Refer… |
CVE-2022-51008 | Medium | 5.3 | 2026-09-06 | PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacke… |
CVE-2021-48007 | Medium | 6.5 | 2026-09-06 | PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted mo… |
CVE-2020-37277 | Medium | 6.5 | 2026-09-06 | PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clien… |
CVE-2026-80439 | Medium | 4.8 | 2026-09-06 | The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it s… |
CVE-2026-80437 | Medium | 4.8 | 2026-09-06 | The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them… |
CVE-2026-19862 | Medium | 4.8 | 2026-09-06 | The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before addi… |
CVE-2026-19859 | Medium | 6.5 | 2026-09-06 | The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users… |
CVE-2026-86183 | Medium | 5.3 | 2026-09-06 | A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmW… |
CVE-2026-86182 | Medium | 4.3 | 2026-09-06 | A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/a… |
CVE-2026-86179 | Medium | 5.3 | 2026-09-06 | A flaw has been found in code-projects Daily Expense Manager 1.0. Affected is an unknown function of the file /Daily-Expense-Manager/exp_ak.sql of the componen… |
CVE-2026-86172 | Medium | 6.3 | 2026-09-06 | A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation… |
CVE-2026-86171 | Medium | 6.3 | 2026-09-06 | A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /modules/orders/delete.php. Such manipulat… |
CVE-2026-85038 | Medium | 5.3 | 2026-09-06 | The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a ro… |
CVE-2026-84028 | Medium | 6.8 | 2026-09-06 | The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing user… |
CVE-2026-75793 | Medium | 6.5 | 2026-09-06 | The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated… |
CVE-2026-13159 | Medium | 4.3 | 2026-09-06 | The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such… |
CVE-2026-86170 | Medium | 6.3 | 2026-09-06 | A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation… |
CVE-2026-86164 | Medium | 6.3 | 2026-09-06 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/trans_view.php. The mani… |
CVE-2026-86163 | Medium | 6.3 | 2026-09-06 | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/pro_del.php. The manipulatio… |
CVE-2026-86150 | Medium | 4.1 | 2026-09-05 | A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of… |
CVE-2026-67279 | Medium | 6.5 | 2026-09-05 | RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated cli… |
CVE-2026-6554 | Medium | 5.5 | 2026-09-05 | libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the… |
CVE-2026-6244 | Medium | 5.5 | 2026-09-05 | libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a… |
CVE-2026-31912 | Medium | 5.5 | 2026-09-05 | libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with… |
CVE-2026-31911 | Medium | 5.5 | 2026-09-05 | libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program… |
CVE-2026-18313 | Medium | 4.3 | 2026-09-05 | rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the me… |