Medium-severity CVEs (page 43)
Page 43 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18238 | Medium | 5.0 | 2026-09-05 | The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a craf… |
CVE-2026-86192 | Medium | 6.5 | 2026-09-05 | SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hid… |
CVE-2026-86191 | Medium | 4.3 | 2026-09-05 | SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate… |
CVE-2026-86187 | Medium | 5.9 | 2026-09-05 | WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integers. Attackers with a… |
CVE-2026-86186 | Medium | 6.5 | 2026-09-05 | AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login… |
CVE-2026-15550 | Medium | 4.3 | 2026-09-05 | The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack o… |
CVE-2026-12843 | Medium | 5.4 | 2026-09-05 | The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that… |
CVE-2025-15647 | Medium | 5.5 | 2026-09-05 | CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge intersections are computed in floating po… |
CVE-2026-86178 | Medium | 5.4 | 2026-09-05 | Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access followe… |
CVE-2026-86176 | Medium | 4.3 | 2026-09-05 | NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authentica… |
CVE-2026-86175 | Medium | 6.5 | 2026-09-05 | NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission… |
CVE-2026-86174 | Medium | 4.3 | 2026-09-05 | Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comment… |
CVE-2026-86122 | Medium | 5.0 | 2026-09-05 | Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can poi… |
CVE-2026-86120 | Medium | 4.3 | 2026-09-05 | APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when pe… |
CVE-2026-86118 | Medium | 4.3 | 2026-09-05 | gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library resc… |
CVE-2026-86116 | Medium | 6.5 | 2026-09-05 | Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, an… |
CVE-2026-86115 | Medium | 5.0 | 2026-09-05 | Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal… |
CVE-2026-86114 | Medium | 6.5 | 2026-09-05 | Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates… |
CVE-2026-86113 | Medium | 6.5 | 2026-09-05 | BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' r… |
CVE-2026-86112 | Medium | 5.4 | 2026-09-05 | BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfa… |
CVE-2026-86111 | Medium | 6.5 | 2026-09-05 | BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and d… |
CVE-2026-76573 | Medium | 6.4 | 2026-09-05 | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not_found' Shortcode Attribute in all version… |
CVE-2026-85414 | Medium | 6.4 | 2026-09-05 | The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and… |
CVE-2026-75586 | Medium | 6.1 | 2026-09-05 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, a… |
CVE-2026-75018 | Medium | 4.3 | 2026-09-05 | The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not p… |
CVE-2026-84937 | Medium | 6.8 | 2026-09-05 | The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allow… |
CVE-2026-84936 | Medium | 5.3 | 2026-09-05 | The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the… |
CVE-2026-84931 | Medium | 6.8 | 2026-09-05 | The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's… |
CVE-2026-84930 | Medium | 6.8 | 2026-09-05 | The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in… |
CVE-2026-84901 | Medium | 4.9 | 2026-09-05 | The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contribut… |
CVE-2026-84899 | Medium | 6.8 | 2026-09-05 | The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users… |
CVE-2026-84898 | Medium | 6.6 | 2026-09-05 | The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contr… |
CVE-2026-84896 | Medium | 6.8 | 2026-09-05 | The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowi… |
CVE-2026-84221 | Medium | 6.8 | 2026-09-05 | The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and… |
CVE-2026-84022 | Medium | 6.8 | 2026-09-05 | The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowi… |
CVE-2026-84021 | Medium | 6.8 | 2026-09-05 | The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that c… |
CVE-2026-83544 | Medium | 6.8 | 2026-09-05 | The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing use… |
CVE-2026-83543 | Medium | 4.1 | 2026-09-05 | The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level acce… |
CVE-2026-82846 | Medium | 6.8 | 2026-09-05 | The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors… |
CVE-2026-81424 | Medium | 5.3 | 2026-09-05 | The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the author… |
CVE-2026-81423 | Medium | 4.3 | 2026-09-05 | The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attacker… |
CVE-2026-78149 | Medium | 5.3 | 2026-09-05 | The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through… |
CVE-2026-4361 | Medium | 5.0 | 2026-09-05 | The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `et_pb_set_video_oem… |
CVE-2026-3853 | Medium | 6.4 | 2026-09-05 | The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in… |
CVE-2026-19861 | Medium | 4.7 | 2026-09-05 | The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it… |
CVE-2026-18843 | Medium | 6.1 | 2026-09-05 | The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no_results_message' node_preview Paramete… |
CVE-2026-15247 | Medium | 5.4 | 2026-09-05 | The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-prior… |
CVE-2026-14975 | Medium | 6.5 | 2026-09-05 | The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This… |
CVE-2026-8625 | Medium | 6.4 | 2026-09-05 | The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (C… |
CVE-2026-8623 | Medium | 6.4 | 2026-09-05 | The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (c… |
CVE-2026-83628 | Medium | 4.3 | 2026-09-05 | The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due… |
CVE-2026-18404 | Medium | 6.4 | 2026-09-05 | The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp da… |
CVE-2025-14945 | Medium | 5.4 | 2026-09-05 | The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all… |
CVE-2026-86144 | Medium | 5.6 | 2026-09-05 | In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example… |
CVE-2026-86143 | Medium | 6.9 | 2026-09-05 | In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a c… |
CVE-2026-86142 | Medium | 6.9 | 2026-09-05 | In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation. |
CVE-2026-86139 | Medium | 6.9 | 2026-09-05 | In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. |
CVE-2026-86138 | Medium | 6.9 | 2026-09-05 | In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. |
CVE-2026-86100 | Medium | 6.4 | 2026-09-05 | Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated atta… |
CVE-2026-52774 | Medium | 6.1 | 2026-09-05 | YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_… |
CVE-2026-52773 | Medium | 6.1 | 2026-09-05 | YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hi… |
CVE-2026-52772 | Medium | 5.5 | 2026-09-05 | YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute a… |
CVE-2026-52763 | Medium | 6.5 | 2026-09-05 | YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argument from two disjoi… |
CVE-2026-86097 | Medium | 6.5 | 2026-09-04 | PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows at… |
CVE-2026-86096 | Medium | 5.9 | 2026-09-04 | PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and objec… |
CVE-2026-76925 | Medium | 5.8 | 2026-09-04 | A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulner… |
CVE-2026-85787 | Medium | 6.5 | 2026-09-04 | An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthentica… |
CVE-2026-85703 | Medium | 6.5 | 2026-09-04 | A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the… |
CVE-2026-85701 | Medium | 5.3 | 2026-09-04 | A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.cre… |
CVE-2026-77847 | Medium | 6.5 | 2026-09-04 | Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to inter… |
CVE-2026-53769 | Medium | 6.5 | 2026-09-04 | Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks s… |
CVE-2022-26961 | Medium | 5.4 | 2026-09-04 | Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMSCI-WebGui/storage.j… |
CVE-2026-85643 | Medium | 4.7 | 2026-09-04 | A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli_query of the file admin/adduser.php. Executing a manipulatio… |
CVE-2026-55513 | Medium | 5.4 | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ign… |
CVE-2026-55512 | Medium | 5.3 | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is r… |
CVE-2026-85639 | Medium | 5.6 | 2026-09-04 | A security vulnerability has been detected in jofpin trape 2.0. This vulnerability affects unknown code of the file core/user.py of the component Telemetry End… |
CVE-2026-85637 | Medium | 5.3 | 2026-09-04 | A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function join_room of the file core/sockets.py of the component Ad… |
CVE-2026-80115 | Medium | 6.1 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation and d… |
CVE-2026-85769 | Medium | 6.5 | 2026-09-04 | A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on… |
CVE-2026-85636 | Medium | 5.3 | 2026-09-04 | A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Log… |
CVE-2026-84890 | Medium | 5.9 | 2026-09-04 | undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is… |
CVE-2026-61688 | Medium | 6.5 | 2026-09-04 | SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API token… |
CVE-2026-61614 | Medium | 5.9 | 2026-09-04 | SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter… |
CVE-2026-61608 | Medium | 6.8 | 2026-09-04 | SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users… |
CVE-2026-57166 | Medium | 5.3 | 2026-09-04 | PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a31, a stack buffer overflow exists in the PJLIB-UTIL telnet… |
CVE-2026-57165 | Medium | 5.3 | 2026-09-04 | PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in the PJLIB-UTIL telnet… |
CVE-2026-57164 | Medium | 5.9 | 2026-09-04 | PJSIP is a free and open source multimedia communication library written in C. Prior to commit 8d5956a, a heap buffer overflow exists in the PJLIB-UTIL HTTP cl… |
CVE-2026-57160 | Medium | 5.3 | 2026-09-04 | PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsip_generic_array_hdr_… |
CVE-2026-53760 | Medium | 5.2 | 2026-09-04 | Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation… |
CVE-2026-53756 | Medium | 4.9 | 2026-09-04 | Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User_Model::getUserDataByLogin(). The… |
CVE-2026-18149 | Medium | 5.9 | 2026-09-04 | undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length… |
CVE-2026-85024 | Medium | 5.9 | 2026-09-04 | undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error… |
CVE-2026-85014 | Medium | 5.9 | 2026-09-04 | undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake… |
CVE-2026-84933 | Medium | 6.5 | 2026-09-04 | undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In… |
CVE-2026-78849 | Medium | 5.4 | 2026-09-04 | Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 allows a remote attacker to execute… |
CVE-2026-38961 | Medium | 5.4 | 2026-09-04 | Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) allows remote authe… |
CVE-2026-18341 | Medium | 6.3 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corrupt memory due to an integer underflow. |
CVE-2026-18078 | Medium | 4.3 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to an integer overflow. |
CVE-2026-18076 | Medium | 4.3 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a memory leak. |
CVE-2026-18073 | Medium | 4.4 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralization of special elemen… |