Medium-severity CVEs (page 47)
Page 47 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14766 | Medium | 6.3 | 2026-07-05 | A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /apartmen… |
CVE-2026-14757 | Medium | 5.3 | 2026-07-05 | A vulnerability was determined in radareorg radare2 up to 6.1.6. This affects the function core_anal_bytes of the file libr/core/cmd_anal.inc. This manipulatio… |
CVE-2026-14751 | Medium | 6.3 | 2026-07-05 | A weakness has been identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. The impacted element is the function Notes_controller::se… |
CVE-2026-14748 | Medium | 6.3 | 2026-07-05 | A flaw has been found in AIAnytime Awesome-MCP-Server up to a884bb51bcd99e08e14fd712c749d55d9d9a13ab. Affected by this issue is some unknown functionality of t… |
CVE-2026-14731 | Medium | 6.3 | 2026-07-05 | A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patientreport.php. Executing a manipul… |
CVE-2026-14730 | Medium | 6.3 | 2026-07-05 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /patientpr… |
CVE-2026-14725 | Medium | 6.3 | 2026-07-05 | A vulnerability was identified in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality. Such manipulat… |
CVE-2026-14723 | Medium | 5.3 | 2026-07-05 | A vulnerability was determined in AD-Security AD_Miner 1.9.0. Affected is the function request_a of the file ad_miner/scripts/analyse_cache.py of the component… |
CVE-2026-14781 | Medium | 4.8 | 2026-07-05 | A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC identity provider i… |
CVE-2026-14717 | Medium | 6.3 | 2026-07-05 | A vulnerability was detected in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /patientlogin.php. Perform… |
CVE-2026-14716 | Medium | 6.3 | 2026-07-05 | A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.13.0-beta.2. Impacted is the function MethodRouter.Handle of the file internal/ga… |
CVE-2026-14714 | Medium | 6.5 | 2026-07-05 | A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.1.0. This issue affects the function verify_server of the file channel/wechatmp/common… |
CVE-2026-14706 | Medium | 6.3 | 2026-07-05 | A vulnerability was identified in code-projects Online Examination 1.0. This affects an unknown part of the file /update.php?q=addquiz of the component Quiz Cr… |
CVE-2026-14704 | Medium | 4.3 | 2026-07-05 | A vulnerability was found in stephen-kruger bluebox up to 4.5.12. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the… |
CVE-2026-14703 | Medium | 6.3 | 2026-07-05 | A vulnerability has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /patientorder.php. Such manipulation… |
CVE-2026-14701 | Medium | 6.3 | 2026-07-05 | A vulnerability was detected in code-projects Internship Management System 1.0. This affects an unknown function of the file employer/details/change_password.p… |
CVE-2026-14698 | Medium | 6.3 | 2026-07-05 | A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0. Impacted is an unknown function of the f… |
CVE-2026-14694 | Medium | 6.3 | 2026-07-05 | A vulnerability has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Affected by this issue is the function cancel_order of the… |
CVE-2026-14693 | Medium | 5.4 | 2026-07-05 | A flaw has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Affected by this vulnerability is the function cancel_order of the f… |
CVE-2026-14692 | Medium | 6.3 | 2026-07-05 | A vulnerability was detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0/5.7.26. Affected is the function save_shop_type of the file cl… |
CVE-2026-14691 | Medium | 6.3 | 2026-07-05 | A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This impacts the function update_settings_info… |
CVE-2026-14689 | Medium | 6.3 | 2026-07-05 | A security flaw has been discovered in CodeAstro Apartment Visitor Management System 1.0. The impacted element is an unknown function of the file /apartment-vi… |
CVE-2026-14687 | Medium | 5.3 | 2026-07-05 | A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacted is the function _deduplicate_results of the file InsightEngine/agent.py of the compone… |
CVE-2026-14659 | Medium | 6.3 | 2026-07-04 | A vulnerability has been found in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /patientappointment.php. Such manipu… |
CVE-2026-14658 | Medium | 6.3 | 2026-07-04 | A vulnerability was detected in code-projects Assessment Management 1.0. This vulnerability affects unknown code of the file /lecturer/marking-scheme.php. The… |
CVE-2026-14657 | Medium | 6.3 | 2026-07-04 | A flaw has been found in code-projects Assessment Management 1.0. This issue affects some unknown processing of the file /lecturer/marking-scheme.php of the co… |
CVE-2026-14656 | Medium | 4.3 | 2026-07-04 | A security vulnerability has been detected in code-projects Assessment Management 1.0. This affects an unknown part of the file /admin/remove-user.php. The man… |
CVE-2024-1248 | Medium | 4.8 | 2026-07-04 | The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation w… |
CVE-2026-14647 | Medium | 4.3 | 2026-07-04 | A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of… |
CVE-2026-14639 | Medium | 6.3 | 2026-07-04 | A vulnerability has been found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /ecommerce-website-php/customer/my_account.php?… |
CVE-2026-14638 | Medium | 6.3 | 2026-07-04 | A flaw has been found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /patient.php. This manipulation of the argum… |
CVE-2026-14636 | Medium | 5.4 | 2026-07-04 | A weakness has been identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 23105f25dadf57b4314fc015a63a7c6e910c89df. Impacted is the function do_uploa… |
CVE-2026-14634 | Medium | 4.3 | 2026-07-04 | A vulnerability was identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 213babdbaa949e94557246414db0130e01394517. This vulnerability affects the fu… |
CVE-2026-14633 | Medium | 4.3 | 2026-07-04 | A vulnerability was determined in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 49b20f53de2b7ec34e920b11c863f1491d911a04. This affects an unknown part of t… |
CVE-2026-14632 | Medium | 4.3 | 2026-07-04 | A vulnerability was found in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 95dfa8cebbb87ab46ae450643a07241274a74dce. Affected by this issue is the function… |
CVE-2026-14629 | Medium | 4.3 | 2026-07-04 | A flaw has been found in RT-Thread up to 5.2.2. Affected is the function read/write/sys_ioctl of the file components/lwp/lwp_syscall.c of the component Paramet… |
CVE-2026-14628 | Medium | 5.3 | 2026-07-04 | A vulnerability was detected in NousResearch hermes-agent up to 2026.5.16. This impacts the function extract_media of the file gateway/platforms/base.py of the… |
CVE-2026-14627 | Medium | 5.6 | 2026-07-04 | A security vulnerability has been detected in NousResearch hermes-agent up to 0.15.2. This affects the function DiscordAdapter._is_allowed_user of the file gat… |
CVE-2026-14626 | Medium | 4.3 | 2026-07-04 | A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. The impacted element is the function AIAgent.run_conversation of the file run_agen… |
CVE-2026-14625 | Medium | 6.3 | 2026-07-04 | A security flaw has been discovered in NousResearch hermes-agent up to 0.15.2. The affected element is the function shell.exec of the file tui_gateway/server.p… |
CVE-2026-14624 | Medium | 4.3 | 2026-07-04 | A vulnerability was identified in omec-project amf up to 2.0.2/2.1.1. Impacted is an unknown function of the file /go/src/amf/ngap/handler.go of the component… |
CVE-2026-14623 | Medium | 4.3 | 2026-07-04 | A vulnerability was determined in omec-project amf up to 2.1.1. This issue affects the function RRCInactiveTransitionReport of the component NGAP Message Handl… |
CVE-2026-14619 | Medium | 6.3 | 2026-07-04 | A flaw has been found in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /medicine.php. This mani… |
CVE-2026-14618 | Medium | 4.3 | 2026-07-04 | A vulnerability was detected in Open5GS up to 2.7.7. Affected by this vulnerability is the function amf_nnrf_handle_nf_discover of the file src/amf/nnrf-handle… |
CVE-2026-58523 | Medium | 6.5 | 2026-07-03 | Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-58597 | Medium | 4.3 | 2026-07-03 | Insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-58524 | Medium | 5.4 | 2026-07-03 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf… |
CVE-2026-58522 | Medium | 6.8 | 2026-07-03 | Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally. |
CVE-2026-58418 | Medium | 6.5 | 2026-07-03 | SSRF via HTTP Redirect in Repository Migration |
CVE-2026-58300 | Medium | 6.2 | 2026-07-03 | Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally. |
CVE-2026-58291 | Medium | 6.1 | 2026-07-03 | Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58278 | Medium | 5.4 | 2026-07-03 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-57987 | Medium | 6.5 | 2026-07-03 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-56646 | Medium | 6.5 | 2026-07-03 | Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a networ… |
CVE-2026-55945 | Medium | 4.2 | 2026-07-03 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to… |
CVE-2026-45489 | Medium | 6.5 | 2026-07-03 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2026-45488 | Medium | 5.4 | 2026-07-03 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2026-28705 | Medium | 5.3 | 2026-07-03 | Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names… |
CVE-2026-27783 | Medium | 4.3 | 2026-07-03 | Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints. |
CVE-2026-27761 | Medium | 4.3 | 2026-07-03 | Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository com… |
CVE-2026-25782 | Medium | 5.3 | 2026-07-03 | Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to… |
CVE-2026-25779 | Medium | 6.1 | 2026-07-03 | Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values. |
CVE-2026-25714 | Medium | 4.3 | 2026-07-03 | Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE… |
CVE-2026-20909 | Medium | 5.3 | 2026-07-03 | Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries. |
CVE-2026-14611 | Medium | 4.3 | 2026-07-03 | A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function initProjectMemory of the file src/managers/MemoryManager.ts… |
CVE-2026-14610 | Medium | 5.3 | 2026-07-03 | A flaw has been found in Open Asset Import Library Assimp up to 6.0.5. Impacted is the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/C… |
CVE-2026-14609 | Medium | 5.6 | 2026-07-03 | A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This issue affects some unknown processing. The m… |
CVE-2026-14355 | Medium | 5.6 | 2026-07-03 | In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extensi… |
CVE-2026-14608 | Medium | 4.3 | 2026-07-03 | A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown… |
CVE-2026-14607 | Medium | 5.5 | 2026-07-03 | A weakness has been identified in RT-Thread up to 5.0.2. This affects the function sys_getaddrinfo of the file components/lwp/lwp_syscall.c. Executing a manipu… |
CVE-2026-14604 | Medium | 6.3 | 2026-07-03 | A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetL… |
CVE-2026-14631 | Medium | 5.3 | 2026-07-03 | webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malfor… |
CVE-2026-14620 | Medium | 4.7 | 2026-07-03 | webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that… |
CVE-2026-14615 | Medium | 4.3 | 2026-07-03 | A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system… |
CVE-2026-14614 | Medium | 5.4 | 2026-07-03 | A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a del… |
CVE-2026-14613 | Medium | 4.3 | 2026-07-03 | A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have ac… |
CVE-2026-14612 | Medium | 4.2 | 2026-07-03 | Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized r… |
CVE-2026-49813 | Medium | 6.7 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-46465 | Medium | 5.5 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-46464 | Medium | 4.9 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-46463 | Medium | 6.5 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-54483 | Medium | 6.7 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-46730 | Medium | 4.2 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-46468 | Medium | 4.4 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-46467 | Medium | 5.8 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-44269 | Medium | 4.4 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-44268 | Medium | 4.4 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-41123 | Medium | 4.3 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-26355 | Medium | 6.5 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-5137 | Medium | 4.3 | 2026-07-03 | The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insuffic… |
CVE-2026-4322 | Medium | 6.1 | 2026-07-03 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency… |
CVE-2026-9756 | Medium | 6.4 | 2026-07-03 | The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versi… |
CVE-2026-4804 | Medium | 6.4 | 2026-07-03 | The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the… |
CVE-2026-35159 | Medium | 5.3 | 2026-07-03 | Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical access could potential… |
CVE-2026-11900 | Medium | 4.3 | 2026-07-03 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via th… |
CVE-2026-11778 | Medium | 5.4 | 2026-07-03 | The The CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution in all version… |
CVE-2026-11398 | Medium | 5.3 | 2026-07-03 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inclu… |
CVE-2026-9230 | Medium | 4.3 | 2026-07-03 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-8351 | Medium | 6.4 | 2026-07-03 | The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, a… |
CVE-2026-8458 | Medium | 6.5 | 2026-07-03 | libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services… |