Medium-severity CVEs (page 46)
Page 46 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-84965 | Medium | 5.1 | 2026-09-03 | An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operat… |
CVE-2026-84964 | Medium | 5.9 | 2026-09-03 | A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already tr… |
CVE-2026-84963 | Medium | 5.3 | 2026-09-03 | An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently sho… |
CVE-2026-84962 | Medium | 4.2 | 2026-09-03 | An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorize… |
CVE-2026-82525 | Medium | 5.5 | 2026-09-03 | Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesys… |
CVE-2026-50554 | Medium | 5.3 | 2026-09-03 | Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "dele… |
CVE-2026-85230 | Medium | 5.4 | 2026-09-03 | A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the wid… |
CVE-2026-85227 | Medium | 6.1 | 2026-09-03 | MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttri… |
CVE-2026-85226 | Medium | 4.3 | 2026-09-03 | MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applyin… |
CVE-2026-85210 | Medium | 4.3 | 2026-09-03 | Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts… |
CVE-2026-85177 | Medium | 5.4 | 2026-09-03 | CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbi… |
CVE-2026-85135 | Medium | 6.3 | 2026-09-03 | A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file… |
CVE-2026-84971 | Medium | 6.5 | 2026-09-03 | Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the… |
CVE-2026-84970 | Medium | 6.2 | 2026-09-03 | A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding a… |
CVE-2026-71403 | Medium | 6.1 | 2026-09-03 | A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user h… |
CVE-2026-63694 | Medium | 5.0 | 2026-09-03 | Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vu… |
CVE-2026-56128 | Medium | 5.4 | 2026-09-03 | pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the des… |
CVE-2026-56127 | Medium | 5.4 | 2026-09-03 | pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr p… |
CVE-2026-56126 | Medium | 5.4 | 2026-09-03 | pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configur… |
CVE-2026-35160 | Medium | 5.0 | 2026-09-03 | Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injecti… |
CVE-2026-84815 | Medium | 5.8 | 2026-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects E… |
CVE-2026-85173 | Medium | 4.3 | 2026-09-03 | n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights s… |
CVE-2026-85172 | Medium | 6.4 | 2026-09-03 | n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The va… |
CVE-2026-85171 | Medium | 6.5 | 2026-09-03 | n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decry… |
CVE-2026-85170 | Medium | 6.5 | 2026-09-03 | n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifying it is a string… |
CVE-2026-85167 | Medium | 6.5 | 2026-09-03 | n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Qu… |
CVE-2026-85166 | Medium | 6.5 | 2026-09-03 | n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e… |
CVE-2026-85163 | Medium | 6.5 | 2026-09-03 | AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary i… |
CVE-2026-85162 | Medium | 6.5 | 2026-09-03 | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidT… |
CVE-2026-85161 | Medium | 4.3 | 2026-09-03 | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken chec… |
CVE-2026-85159 | Medium | 5.4 | 2026-09-03 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href att… |
CVE-2026-85158 | Medium | 5.4 | 2026-09-03 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comme… |
CVE-2026-85157 | Medium | 5.3 | 2026-09-03 | WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a prog… |
CVE-2026-85156 | Medium | 5.3 | 2026-09-03 | WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted vide… |
CVE-2026-85107 | Medium | 4.3 | 2026-09-03 | A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/… |
CVE-2026-85106 | Medium | 6.3 | 2026-09-03 | A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.t… |
CVE-2026-85100 | Medium | 4.3 | 2026-09-03 | A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squ… |
CVE-2026-85093 | Medium | 6.5 | 2026-09-03 | Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticat… |
CVE-2026-85092 | Medium | 6.6 | 2026-09-03 | LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing… |
CVE-2026-85090 | Medium | 5.4 | 2026-09-03 | FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A ma… |
CVE-2026-85089 | Medium | 6.5 | 2026-09-03 | FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in… |
CVE-2026-85084 | Medium | 6.3 | 2026-09-03 | Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers. |
CVE-2026-85040 | Medium | 4.7 | 2026-09-03 | A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/sav… |
CVE-2026-85021 | Medium | 4.3 | 2026-09-03 | A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of th… |
CVE-2026-82918 | Medium | 5.5 | 2026-09-03 | XG VisionTerminal and XG-X VisionTerminal provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially craft… |
CVE-2026-80254 | Medium | 6.5 | 2026-09-03 | Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who can log in to the product may change the… |
CVE-2026-80253 | Medium | 6.8 | 2026-09-03 | An improper physical access control issue exists in ShizenBox2 (dev-conf). If exploited, an attacker with physical access to the product may execute bootloader… |
CVE-2026-74769 | Medium | 6.5 | 2026-09-03 | Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker… |
CVE-2026-74768 | Medium | 4.1 | 2026-09-03 | Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A high privileged remo… |
CVE-2026-71224 | Medium | 4.7 | 2026-09-03 | A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk me… |
CVE-2026-71222 | Medium | 5.3 | 2026-09-03 | A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds vali… |
CVE-2026-71219 | Medium | 4.7 | 2026-09-03 | A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the u… |
CVE-2026-68860 | Medium | 6.8 | 2026-09-03 | Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker could p… |
CVE-2026-3852 | Medium | 6.4 | 2026-09-03 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all vers… |
CVE-2026-3416 | Medium | 5.9 | 2026-09-03 | The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This… |
CVE-2026-2573 | Medium | 6.4 | 2026-09-03 | The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2026-17539 | Medium | 5.9 | 2026-09-03 | RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry o… |
CVE-2021-43614 | Medium | 6.7 | 2026-09-03 | Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure. |
CVE-2021-43613 | Medium | 6.5 | 2026-09-03 | An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalat… |
CVE-2026-84888 | Medium | 4.3 | 2026-09-03 | A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shell_exec of the file crates/openfang-runtime/src/… |
CVE-2026-84887 | Medium | 4.3 | 2026-09-03 | A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the componen… |
CVE-2026-84886 | Medium | 5.3 | 2026-09-03 | A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_… |
CVE-2026-84885 | Medium | 4.3 | 2026-09-03 | A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code_agent.py of the component CodeAgent. Such m… |
CVE-2026-84857 | Medium | 5.3 | 2026-09-02 | A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulatio… |
CVE-2026-84856 | Medium | 5.3 | 2026-09-02 | A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/co… |
CVE-2026-84852 | Medium | 4.4 | 2026-09-02 | A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of… |
CVE-2026-75137 | Medium | 6.1 | 2026-09-02 | UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process me… |
CVE-2026-75136 | Medium | 6.1 | 2026-09-02 | UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key store… |
CVE-2026-75135 | Medium | 6.1 | 2026-09-02 | UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vaul… |
CVE-2026-75134 | Medium | 6.4 | 2026-09-02 | SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious… |
CVE-2026-84840 | Medium | 6.5 | 2026-09-02 | A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstra… |
CVE-2026-84839 | Medium | 5.3 | 2026-09-02 | A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component… |
CVE-2026-84833 | Medium | 4.3 | 2026-09-02 | A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of… |
CVE-2026-84380 | Medium | 5.6 | 2026-09-02 | HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length h… |
CVE-2026-84379 | Medium | 5.3 | 2026-09-02 | HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attack… |
CVE-2026-84378 | Medium | 5.9 | 2026-09-02 | HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copie… |
CVE-2026-84377 | Medium | 6.5 | 2026-09-02 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user… |
CVE-2026-82522 | Medium | 5.4 | 2026-09-02 | libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploit… |
CVE-2026-77123 | Medium | 6.5 | 2026-09-02 | Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privile… |
CVE-2026-77122 | Medium | 4.3 | 2026-09-02 | An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed a… |
CVE-2026-77121 | Medium | 6.5 | 2026-09-02 | A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes fut… |
CVE-2026-55221 | Medium | 6.5 | 2026-09-02 | Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0… |
CVE-2026-49833 | Medium | 5.5 | 2026-09-02 | DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to bef… |
CVE-2026-49831 | Medium | 5.5 | 2026-09-02 | DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Cu… |
CVE-2026-49830 | Medium | 4.4 | 2026-09-02 | DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when i… |
CVE-2026-84811 | Medium | 6.5 | 2026-09-02 | agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping ma… |
CVE-2026-84810 | Medium | 6.5 | 2026-09-02 | claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, a… |
CVE-2026-84809 | Medium | 6.5 | 2026-09-02 | Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd ex… |
CVE-2026-55421 | Medium | 6.8 | 2026-09-02 | Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url… |
CVE-2026-53636 | Medium | 4.7 | 2026-09-02 | Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in… |
CVE-2026-52832 | Medium | 4.9 | 2026-09-02 | Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without auth… |
CVE-2026-20355 | Medium | 5.9 | 2026-09-02 | Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthentic… |
CVE-2026-20354 | Medium | 5.9 | 2026-09-02 | Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthentic… |
CVE-2026-84677 | Medium | 5.4 | 2026-09-02 | Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pa… |
CVE-2026-84676 | Medium | 4.3 | 2026-09-02 | Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be vie… |
CVE-2026-84674 | Medium | 5.4 | 2026-09-02 | Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2026-84666 | Medium | 5.4 | 2026-09-02 | Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data… |
CVE-2026-84664 | Medium | 5.4 | 2026-09-02 | Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to conn… |
CVE-2026-84663 | Medium | 5.4 | 2026-09-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared… |
CVE-2026-84662 | Medium | 4.3 | 2026-09-02 | Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an a… |